How to change BT Videophone1000 setting to work on my own PBX ?

Well I thought I would start this off in an atempt to discover if anyone knows a method of unlocking the Videophone 1000 unit from BT. I would like to edit the connection settings to point to my own PBX rather than the broardtalk one. Any cluse anyone. I shall pop another post up to give the Processor used later.. many thanks in hope ...

[Memfis]

I presume you're running a SIP/IAX pbx, in which case as far as I know they don't support video.

Hi there memfis,

Yep I guessed that the PBX would not support the Video side of things but I would still like to get the SIP phone side of things working..

Then perhaps the Video side of things could be discovered later.
Perhaps even used as an IP webcam in times to come but dont hold ya breth.

But just a method of accessing the HIDDEN setup functions would be nice if there is any,,
or some method of reprogramming the SIP server/pbx address that it is looking for .
anything along those lines !


The processor it uses by the way was a TMS320DM64 IGNZ from texus instruments. wow that does loads nice processor.
If you have never looked inside one of these units well don't be shocked that there is almost nothing in them. A rather nice board with about 3 sections.

Power, DSP, Cat5. thats it. A few suppor components around the main chips and a little bit of external Flash for the processor but 85% bare board. Nice.

Looks like it could have been laid out for a PSTN line also but thats all bare.

.

[Memfis]

I doubt the videophone uses sip. I'm guessing it would have to be completely re-flashed with a modified firmware.
A quick search on google doesn't return any sites looking at modifying this phone. Sorry I think it's a lost cause.

ahh you found the same results. I can confirm that the phone is SIP and the Video side of things is a seperate protocol. Who knows what....?

well,, lost cause or new challenge ?, i thought it was worth asking and putting the idea out there..... who knows what will happen given time..

..

[Memfis]

Well good luck, I'm afraid it's out of my knowledge range.

[Nosilla99]

@Hiddenvision

I am successfully using a number of these phones at home using asterisk. The phones are fully SIP compliant and use H263, H263p and H264 codecs for video which are all standard codecs used by other SIP video phones.

Unfortunately BT have issued firmware updates causing the phone to authenticate via https to a BT server, if this is unsuccessful then phone is unusable.

However if you have firmware version 0.5.3.96 (as supplied on the phone out of the box) then you can use the phone with asterisk. You will need to spoof DNS so that www.videophone1000.bt.com points to a non existant or local server. This is the server that the phone downloads software updates from, so until you have done this do not allow the phone access to the internet.

Once you have achieved the above you just need to spoof DNS so that server sip.btsip.bt.net points to your local pbx.

Easy really, I can confirm that video is working fine with asterisk between phones when using H263 as the video codec and either ulaw or alaw as audio codecs.

Good luck

NOS.

[Memfis]

Oh Wow, Thank You very much for posting.

P.s. Welcome to TS!

[Nosilla99]

@Memfis,

Thanks for the welcome. I picked up four from ebay for under a twenty pounds excluding P&P. So for five pounds a phone they are a bargain.

I trashed one phone by upgrading it to the latest firmware, so will see if I can get around the https problem caused by later firmwares. I am going to try a man in the midle attack to see if I can decode the https session if this is successful it may be able to resurrect models which have been connected to BT.

I can't find any info on the processor as I would also like to dump the flash just incase they inadvertantly connect to BT one day

So if anyone has any tips or info on identifying if it has a jtag interface their input would be welcomed

NOS

Hi Nosilla

Ahh, now thats what I call a plan.
I thought of that concept but when I asked an IT mate of mine if it could be done he just laughed and told me to roll another....
So I sort of put that thought to the back of the tray.

I did have it semi up and running, at least I should say, I could get into the menus and activate the video section and play with the camera but I could not work out how to change the settings to where it trys to connect. User name/number and password were easy to do (prompted at start) but the IP of the pbx server ?? never found anything that got me close to that.

I know what you meen about them being cheep on Ebay.
It is amazing how that much kit can get sold so cheep.
I bought them because I just love to recycle and make things usefull as they are rather than turning perfectly good items into land fill.

Don't get me wrong, I know we need the landfill to fight off the rising waters but I get selfish sometimes......

Now down to the notty grotty..
How did you do that spoofing thing ??
I have a few boxes around so I can give it a go if I have the how knows...

Yep I know I am a lazy git too, but I fugured I if ask someone that has done it it may save me some time getting it wrong......

Don't need the whole hand but just as happy to accept a finger, as long as it is pointed in the right way :-))


Hv.

[Nosilla99]

@Hiddenvision

The key hurdle to overcome is DNS. Since we can't change the settings on the phone you are going to have to do the following:

1. Make sure the phone has no way of accessing the internet until you have completed the following steps otherwise you will end up with a phone which will not work using my solution. There is another option which is using the router to deny access to "www.videophone1000.bt.com". You can verify this step by using a PC and making sure you can't access the site following changes to your router.

2. If you have DHCP enabled on your internet router, disable it ! otherwise it will give the phone all the details it needs to access bt's servers and update its firmware.

3. You need a DHCP server which will issue the phone with an IP address and DNS server information. The DNS server must point to something on your network which is able to be manually configured. This could be a Windows Server or Linux Server (If you are using a linux based PBX system then you already have a box suitable for carrying out this step)

4. If using linux create a domain record for videophone1000.bt.com and point the host "www.videophone1000.bt.com" to your pbx (actually you can point it anywhere you want as long as it is not BT's real server). On linux this is usually achieved using the named.conf files belonging to the BIND service. I can provide examples if required.

5. Test that "www.videophone1000.bt.com" using a PC or other device to ensure that is now redirected to where ever you specified in the named.conf. If all is OK you can now safely use the phone without fear of its firmware being updated.

6. Finally create a domain record for btsip.bt.net and create a host record for sip.btsip.bt.net which points to the IP address of your PBX.

7. On the videophone set the username and password to whatever you configured as a SIP extention on your PBX and it should all work.

I use linuxmce with asterisk PBX which is an ubuntu version of linux so can provide the files required if you want to go down that route.

If your firmware has been updated to something other than 0.5.3.96 the above won't work until I have figured out how to spoof the https conversation it has with sp2.btsip.bt.net

Good Luck, hopefully the above makes some sense and if I can help any futher just ask

NOS

Hey NOS,
many thanks for the details there and the offer of further assistance.
I shall have a go with that in the next couple of days.

I do have a Centos box running Astrix so I should not have too many problems with the suggestions you made.
I just have to figure out how to drive linux again.
I forget things quick and I never understood much of what I did the first time,, ha ha ....

My mate sugested simpledns from the address dot com. So that is another avenue, that is supposed to be a simple dns server for windows type boxes.
He mentioned that he used it to do something simular a year of two back (but seemed to forget that when I asked about the videophone !!!)

Not got the time to look at this till the weekend but I shall gather all the bits and see what we can cook up by sunday !

Once again many many thanks for the original disclosure of the information.
I think you are one of the first to have found the solution, or at least been the first I have found prepared to talk about it.........

I shall let you know how I get on and perhaps take you up on the offer of more words if I get my head stuck in the fence.

Hv...

[Memfis]

Many Thanks,

I'll get some video phones after I've bought a new property.
Always wanted to play with asterix

[silver]

@Hv, just a quick thought, I notice you are not logged in to the forums, if you create an account you can choose to get notified when replies are made to this thread - upto you

[mastermonkey]

I'm glad I found this thread. This sounds promising.

I have setup my router (Monowall) to act as a DNS forwarder and dish out its own address as the DNS server by DHCP. I have then set it to override www.videophone1000.bt.com and sip.btsip.bt.net. You can see screenshots of the setup and a test nslookup to make sure that its all working.

Does that all look OK to you Nosilla99?

Many thanks

Simon Dale

[mastermonkey]

Hi again,

Now that I've got my network right I'm trying to buy a couple of the phones!

Obviously I want a couple that have firmware 0.5.3.96. Is it easy for a seller to check the firmware for me? EG does it say the firmware on bootup or is there a menu that I can ask them to look in for me?

Could you describe the steps to check the firmware version please and I will ask the seller's to check and confirm for me.

Many thanks

Simon

[mastermonkey]

To answer my own question in case any one is Googling for this:

View technical details

This can be used to provide useful information if you need to call
the Helpdesk. It will include information about the hardware and
software versions in use, your IP address, BT Broadband Talk
telephone number and MAC address.

1. Open the Phone Settings menu.
2. Scroll to Technical and press OK.
3. Technical Information is highlighted. Press OK
4. Details about your BT Videophone 1000 are displayed.
5. Press Back to return to standby.

The manual is available online at: http://www.shop.bt.com/content/uni2/...5br/027099.pdf

[mastermonkey]

OK - the seller had 5 phones and he checked them all and 2 have the magic firmware! It must by my lucky day!

They are on their way to me now!

[Hiddenvision]

Hi MasterMonkey and NOSILLA

I can confirm that that setup works and allows the VP1000 unit to connect and make Viedo and voice calls via Astrix.

I have not even checked the version but I guess it is a good one.
Very cool.


Now we just have to find out how to locate that hidden door to allow the setings to be changed inside the VideoPhone...

I can see there is going to be a rush on Videophones now.
Hold on tight.....

Hv.

[mastermonkey]

Hi Hiddenvision,

Are there any numbers of markings on the phone anywhere that might help us identify who makes it?

If its an OEM piece of gear we may be able to find the manufacturer and possibly a vanilla firmware without the locked BT settings.

I'm not too hopeful on this front though.

Thanks

Simon

[Hiddenvision]

Hi MM.

I did find the Manafacture of the chip used, I even thought I had saved the PDF. I shall have another search and see what I find again.. Ahh praise the History folder......

[Hiddenvision]

Here is some info.

Looks like it is a fairly new device but I am sure with a bit of digging something will show itself. Ahh. sunday is over.....

My firewall NIC cards crashed so I had to stop play but it worked !!!!!!!
.......

Hv..

[Hiddenvision]

Ahh So it is one of these !!

Suncorp make them.

They also have unbranded.
Now what firmware can I find.....

Hv.

[Hiddenvision]

Unbranded version....
Humm Suncorp make it hard to find things !!!!

[Hiddenvision]

Hi again,
Well I got the new NIC's and up we are again with monobloc...

Nosilla or MM ....
Could I ask if you noticed attempted traffic to other destinations from the VP1000 ?
I notice it was trying to get to

ns2 . wgate . com port 123

and

sipserver . ojodc . com port 123

Source port was 57400 and rising !

I wonder if this was an alternate update route or some bad and nasty backdoor of BT.....?

I blocked it all the same !!!!!!
Ahh. Time servers. Must read the manual !


On a totaly seperate note, but it maybe connected in some crazy way,,

I now have a problem where I can dial out of the VP1000 but when I try to dial in I get "not available" message from the trixbox woman as if the DND was on.
If I dial the VP from the same VP then I get the busy woman..How odd,!!
I noticed this with a Homehub I installed at my brothers but that problem would not go away till I reconfigured trixbox and gave him a new extension number... tried that on the VP but still the same,, hoe hum....

Still not much found on a new firmware, but I hunt, never the less,


Hv.

[mastermonkey]

Hi HiddenVision,

I have got my phones now but I haven't been able to get them to work.

Like you I can call out from them but if I call them the other phones just say "number not available" and the Askozia box says "route not possible".

I'm not sure what to try next!

Good work on the manufacturer. Perhaps we can contact them and see about firmware.

[Hiddenvision]

where has the master Nosilla gone..

Hi Nos,
As you can see the strugglers are at it.........

Did you experience this one way problem ??
If so did you find a cure .....??

Still no luck searching for suncorp stuff, I think I shall call them tomorrow if I get the moment.

Hv.

[mastermonkey]

Sounds good. I have emailed them asking about purchasing a number of them with custom firmware, etc. for a new venture. It might get me somewhere...

It would be interesting to know how the firmware is served to the phone. I wonder if BT are running a TFTP server or something similar at their www.videophone1000.bt.com address?

I have tried monitoring it and the phone tries to access it on port 80, at least initially. But if I access www.videophone1000.bt.com on port 80 I get nothing.

I wonder if Nosilla99 had extra initialization settings for Asterisk to get the phones to work properly? Did you say that yours worked fine intitially but now don't? Weird.

[mastermonkey]

Just in case anybody knows what this means...this is my log file output when I try to dial one of the video phones (they both do the same):

Apr 9 23:42:06 -- Executing [128@SIP-PHONE-15931724844793bcdd0aaab:1] NoOp("SIP/1-0874c000", "internal calling internal phone: Videophone2 - <128>") in new stack
Apr 9 23:42:06 -- Executing [128@SIP-PHONE-15931724844793bcdd0aaab:2] Macro("SIP/1-0874c000", "main|SIP/128|128|128|tTo|20") in new stack
Apr 9 23:42:06 -- Executing [s@macro-main:1] Dial("SIP/1-0874c000", "SIP/128|20|tTo") in new stack
Apr 9 23:42:06 app_dial.c:1191 in dial_exec_full: Unable to create channel of type 'SIP' (cause 3 - No route to destination)
Apr 9 23:42:06 == Everyone is busy/congested at this time (1:0/0/1)
Apr 9 23:42:06 -- Executing [s@macro-main:2] NoOp("SIP/1-0874c000", "DIALSTATUS: CHANUNAVAIL") in new stack
Apr 9 23:42:06 -- Executing [s@macro-main:3] Goto("SIP/1-0874c000", "s-CHANUNAVAIL|1") in new stack
Apr 9 23:42:06 -- Goto (macro-main,s-CHANUNAVAIL,1)
Apr 9 23:42:06 -- Executing [s-CHANUNAVAIL@macro-main:1] Goto("SIP/1-0874c000", "noanswer|1") in new stack
Apr 9 23:42:06 -- Goto (macro-main,noanswer,1)
Apr 9 23:42:06 -- Executing [noanswer@macro-main:1] GotoIf("SIP/1-0874c000", "0?vm-noanswer|1") in new stack
Apr 9 23:42:06 -- Executing [noanswer@macro-main:2] Hangup("SIP/1-0874c000", "") in new stack
Apr 9 23:42:06 == Spawn extension (macro-main, noanswer, 2) exited non-zero on 'SIP/1-0874c000' in macro 'main'
Apr 9 23:42:06 == Spawn extension (macro-main, noanswer, 2) exited non-zero on 'SIP/1-0874c000'
Apr 9 23:42:06 -- Executing [h@macro-main:1] GotoIf("SIP/1-0874c000", "0?vm-h|1") in new stack
Apr 9 23:42:06 -- Executing [h@macro-main:2] Hangup("SIP/1-0874c000", "") in new stack
Apr 9 23:42:06 == Spawn extension (macro-main, h, 2) exited non-zero on 'SIP/1-0874c000'

Any help would be much appreciated.

[Hiddenvision]

Hi MM, & all

All the info is in the top 4 entrys.
Not that the info is of any help to man nor beast.
1: Sees you trying to call,
2: Puts you on the call stack,
3: Trys to Call the number,
4: Fails ..................

The rest is just the process of giving you to the answerphone and ending the call.


One thing I noticed while looking at the Firewall log is that the Videophone likes to sit on port 5070 unlike all my other devices that use 5060. It connects to port 5060 on the trixbox but it's port is 5070.
Or 5071 when I had two on the box.

I tried to change it in the port setting via freepbx extensions but no difference.
I did not look at the FW log again !!!

Anyone have a nice easy to digest version of the SIP protocol.??
Would be intresting to see what the process should be for registration and 'making yourself AVAILABLE' and perhps see why these fail.


I also noticed that the DTMF tones (key preses) are not being recognised on things like answerphone, AVR or directory services.
Humm that is something I forgot to check toooo.



On the update site I get under constuction !!
I would guess that they could have a bit of PHP or simular running and it may require some extra bits adding to the address www.video...bt.com/?ID=
or anything to be honest.
If it does not see some qualifiers then perhaps it just dumps the under construction site at you.

If I had a local web server running I could set it up and try to capture any extra info it trys to push. Maybe this weekend if I have the urge..

Good move on blagging them about custom phones.

Hey who knows maybe they would be intrested in buying them back off ebay.
Surely it must cost them more that 5 or 10 quid to make.!!!!!
Of perhaps the Devkit is available for them.

It realy makes you wonder where BT went wrong.
So much investment and for them to be dumped for such low costs.
I can see a fair few of these being turned into landfill before a good use can come of them.. Too hard to work out the logic there..........

On my getting them working and then 'not'.
To be honest I only tried to make the call in one direction.!!!!
As it happened, the right direction....
Then on rebuilding the firewall I decided to test it in the other direction...
My guess is that it did not work both ways at all at any time.

Even with two on the system I thought they may atleast get a link but you dial each from the other and you get UNAVAILABLE..!! Too bizare.

And don't bother to check the *79 DND Off (*78 on) as if that is on you get BUSY and not the aforementioned UnAvAiLaBlE. Sorry I had to do that...
There is no mention of any crazy built in keypad codes for diversion or DND.


Have you seen those new large flat screen cordless videophones these boys are making ?? Wow i hope that BT buy a load of them too.

Ho Hmmmm.


Hv.