Do you like my hacking? If so, please consider leaving something in the
Fediverse (Mastodon etc): @Sprite_tm@social. spritesmods.com
Ok, so I had my own phone unlocked... but what about those unfortunate people who were handier with software than with hardware? I decided to see if I could find a way to open up the firmware without having to solder.
One of the things that was already known is that, periodically, the phone would try to fetch a file called 'swinfo' from a now nonexistant server. After investigating this lead in the firmware, I found out that this was a firmware-update mechanism: the swinfo was a 'catalog' containing the md5-sums and versions of a couple of package files, which were basically .tar.gz'ed files which eventually would be extracted in the root of the phone.
I created a small utility to help me with the format of the swinfo file, and got to work on a nice package to offer. I eventually settled for one that just enabled the telnet server and opened up the ap selection screen so you can set all the sip and network options yourself. These files would then be put on a webserver and some kind of re-routing of the original update servers IP to that machine would have to happen. The (obsolete) description of that process is archived here.
I've hacked together a little something that should make soft-modding easier. You need a wireless router or access point or whatever with an internal or external DHCP server. Change the DHCP server to force it to use 188.40.123.50 as a DNS server. Now, associate your phone with the access point if you haven't done it already and reboot it by turning it off and on via holding the hangup-button. After it has rebooted, let it sit in it's reload cradle. First indication the process works should be that after a minute or so, the displayed clock will jump to 01.59. Now, keep your hands off the phone till its clock indicates 02.03 or 02.04. When that happens, an update screen will display and the phone reboots. Congrats, your phone is hacked: the menu where you chose your access point has a metric ton of options and a telnet server should be running on the phone, user/pw root/toor. (That pw, ofcourse, you should change ASAP, by the way.) In the mean time I've updated the package, by the way: you now also get access to the demomode, some more settings, a preliminary implementation of German langue support and an extra theme for free. (Thanks, ChrisK!)
This hack should work for both the VP6500 and the VP5500, and is permanent: you only have to do it once to forever unlock your phone. Don't forget to reset the DNS address in your router afterwards.