A few weeks back I picked up a couple of Engin 221 VOIP DECT phones (a rebadged DLink DPH-C160S) from Ebay, with the hopes of being able to use them with my Asterisk server. As it turns out, the Engin ship these units with crippled firmware, so you can only reconfigure the IP settings, but not the SIP settings, rendering it useless for anything except talking to Engin. It won't even work with their VOIPer accounts, nor are they willing to unlock the device.
After being frustrated for a few minutes, I dismantled the unit and found a serial port within it. Although the port speaks the serial protocol, it uses +3.3V, not +/-12V like proper RS232 ports, so to connect to it, you need to use a level shifter such as the MAX232. If you don't have one handy, Sean Lincolne has a useful tutorial describing how to modify a $20 phone cable from Ebay to connect to the serial port.
Here is the pinout of the serial port:
Pin 1 (marked with a square) UART0, RX
Pin 2 (no connection)
Pin 3 +3.3V,
Pin 4 Ground
Pin 5 UART0, TX
Once you're connected, power the unit up. You will see something similar as the machine boots:
* Power On Testing *
* DRAM Memory Test ..... PASSED
* Active RunTime Region ..... 2
* Active RunTime Code Checksum ..... PASSED
* Standby RunTime Region ..... 1
* Standby RunTime Code Checksum ..... PASSED
Boot Code Version : ATA1.1B01
Active RUNTIME Version : 1.00.009DPH-EN
Standby RUNTIME Version: 1.00.004DPH-AUS
Initializing Device OS
---------------------------------- ---------------------------------- ----
-> DOWNLOAD RUN TIME IMAGE FROM FLASH:
.. Decompress Run Time Image : 100%(STOP system boot/load )
Active RunTime Region: 2
Configure: End the decode process
System Driver Initialization is Ready
In MXP Root before lock
In MXP Root after lock
NWIF: get_mac_address()=00:19:5b:xx:xx:x x
NWIF: NET Device Ready
SSL Init ok
000000301 XmlTask: task running...
Rompager ssl =0
000000501 ===== SIP Stack version 1.0.5 =====
000000501 SIP: (0) Server Address= byo.engin.com.au
000000501 SIP: (0) Server Port= 5060
000000501 SIP: (0) Phone Number =
000000501 SIP: (0) User Agent Address = 10.1.1.1
000000501 SIP: (0) User Agent Port = 5060
000000501 SIP: (0) Display Name =
cphone add command
000000501 SIP network task started.
000000511 SIP will restart after Prov Sending!!
000000511 SIP User Agent task started.
FXO on-hook : 1
Log in using the same username/password as you use to log in to the web interface (the default is admin/admin). Once logged in, you can issue a "help" command to get a summary of commands.
The phone's flash memory is divided into 2 regions, the first region contains the original factory firmware, the second region contains the Engin butchered firmware. You can request the phone to boot from the first region by issuing the following commands:
runtime active_region 1
nwdbg system reboot
Once your phone comes back up, you are ready to reflash the second region with an up to date copy of the factory firmware. Download the firmware from ftp://files.dlink.com.au/products/DPH-C160S/REV_A/Firmware and set up a TFTP server on an available computer on your network (make sure this computer can ping the phone's IP address). Place the firmware in the root of the TFTP server. Under Windows 2000/XP, there is apparently a tftp daemon on the CD. Run the following to extract and install it, setting the path to tftpd.ex_ as appropriate (code lifted from http://www.governmentsecurity.org/archive/t13902.html, note that this procedure is untested):
expand tftpd.ex_ %windir%\system32\tftpd.exe
instsrv tftpd %windir%\system32\tftpd.exe
reg add hklm\system\currentcontrolset\services\tftpd\Parameters
reg add hklm\system\currentcontrolset\services\tftpd\Parameters /v Directory /t REG_SZ /d c:\tftproot
net start tftpd
Back on the phone, log in, then issue the following commands to fetch and reflash the firmware. This will overwrite the firmware in region 2 (region 1 will still contain the original factory firmware).
tftp srvip <your tftp server>
tftp get dph_c160s-100006DPH-AUS-20070226.tfp
nwdbg system reboot
After rebooting, disable the automatic provisioning on boot (the phone will still try and download its settings from Engin) by issuing the following commands:
nwdbg prov disable
nwdbg save changes
Finally, enable telnet access, so you don't need to dismantle the unit again to get access to the console
nwdbg save changes
Thats it! Your phone should now be unlocked, and you can configure it both via telnet and via the web interface for whatever SIP service you like.