Spot the EEPROM?

[kujina]

Hello all

Question
I have looked over the board in the photo below and searched the codes on google but I cant locate the eeprom on this board, I appreciate any help.

Background
Basically I bought a couple of cisco spa502g voIP phones cheap on eBay and unfortunately they are password protected (this often is the case with these phones second hand), the problem I have is these phones have strong security and I cant factory reset these phones (tried tftp provisioning).

The idea now is to remove the EEPROM and swap in an un-programmed one, and perhaps the phone would go in SOS (recovery) mode and then I could re-flash using the 'Cisco SPA Device Firmware Upgrade Utility'.

Thanks

Click for much larger image

[Kjelt]

Which foto?

[kujina]

Which foto?

Sorry was faffing with image 

[Kjelt]

The 29lv64 is a huge flash rom, why would they not store it in there?
I would first try a factory reset and the factory passwords if you can get them.

[Kilrah]

If there's one it would most likely be the little 8-pin chip on top right (U16), but it's likely there is none and everything's stored in the flash with a small partition of it being mounted read/write. 

[andtfoot]

In the firmware download from the Cisco site there is a recovery .exe.
I haven't tried it (I've only worked with the Call Manager connected stuff), but does that maybe work without having to reset the phone first?

[tszaboo]

If there's one it would most likely be the little 8-pin chip on top right (U16), but it's likely there is none and everything's stored in the flash with a small partition of it being mounted read/write. 

doubt it, it goes to J23 so it is power.
I think it might be one of the small SOT23 devices. U9 is either a reset IC or a one wire eeprom.

[kujina]

Thanks guys really appreciate all the replies, I'm trying to get those working to give to my brother in law to use with his new business.  The eBay seller sells lot of general commercial & industrial items and has no clue about these phones. I've tried all the standard avenues of reseting the phone including trying to "provision" the phone via TFTP on boot. I did actually get the provisioning via TFTP (as a test) to work on my spa504g I already have. So these spa502G's probably have provisioning disabled and the web (admin) interface is also disabled so they have been really locked down!

doubt it, it goes to J23 so it is power.
I think it might be one of the small SOT23 devices. U9 is either a reset IC or a one wire eeprom.

The U9 component has written on it AM034 or AMO34.

The following link is where I got the idea about the eeprom (unfortunately the thread is closed as it's old).

[daqq]

Try contacting CISCO for a reset procedure maybe? Other than that there's still the possibility that any configuration data is stored either in the main ASIC or in the main FLASH memory... maybe if you have access to a scope you could scope out the communication in and out of the U9 to see/guess what it does?

Also, I'm guessing that there is a fair amount of stuff to configure on such a phone - it'll probably run some kind of linux/obscure OS with a lot of networking settings. As such 1-2kB is the bare minimum value for such a configuration, probably more. As such it's a good bet that they won't be storing it in a small 1 wire memory. My best guess would be that it's stored in the main FLASH.

[Kjelt]

You could desolder the flash chip, solder it on a breakoutboard and read out its contents.
However looking in the manual that this thing can do real time 256 bits  encryption/decryption, if I was the SW engineer I would encrypt the entire external flash and sign it.
Still it could be unencrypted in which case the flash might give clues about configuration or passwords etc.

[kujina]

Sorry guys you'll have to forgive me, my knowledge of electronics is very very basic. Re-reading the responses I've realised that the answer is probably the large 29LV640ETTI-70G - "The 29lv64 is a huge flash rom, why would they not store it in there?" comments from Kjelt made the penny drop.

As I wrote before, I got the idea from this thread to remove the EEPROM flash memory and swap in an un-programmed one, hopfully making the phone go into SOS mode recovery and then I could re-flash using the 'Cisco SPA Device Firmware Upgrade Utility'.

Is this making more sense now?

[ade]

If you attempt to replace the flash memory you'll probably just damage the phone permanently.

It sounds like your phone is provider locked.   Your best bet is to find out which company was the service provider (maybe there's a message on boot), call them up and kindly ask them if they would unlock the phone for you ("pretty please"). 

[ve7xen]

You can also try hooking the phone up to a network you control and monitor its traffic. Chances are that it reaches out for a provisioning file. Set up a server to respond on whatever address it is reaching out to (maybe you can just set a local DNS entry to override it) and I believe you should be able to re-provision the phone. I'm not too familiar with the provisioning files for these phones, but you should be able to set the front-panel password that way, then do a factory reset.

Pretty sure Cisco didn't use encryption anywhere inside the box. They are stuck in the 90s when it comes to software development, and this series of phones is no exception. The software quality is quite horrible.

[kujina]

ve7xen I actually just did that before refreshing this page and reading your post! Earlier I read ade's reply and I knew trying to get the password from the original supplies of the phones would be a long shot but I decided to look through the phone's menu's once again for any details and I saw the provisioning server url in the Status menu so I set everything up DNS wise etc and a correctly named .xml file with a password of 0000, the phone provisioned and voilà  factory reseted them both!

Thanks everybody for your responses, these phones will be off to my brother in-law now. I will pick up one or two more of these spa50XG series phones for myself and if provisioning doesn't work (these phones are almost always password protected coming from business environments) I will attempt removing the flash memory as a last resort.

Thanks!