Grandstream Configuration Tool
http://www.grandstream.com/y-configurationtool.htm you can download the tool if you want it here
Configuration Files Generator Tool for WINDOWS http://sourceforge.net/projects/provisioning/
Using the template file the configuration tool makes phone specific configuration files, basically it just reformats the config options into one line serpated by ampersands and attaches its custom header
The custom header takes up the first 16 characters and only makes sense if viewed in a hex editor
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a
The mac address of the phone used in this example is 000b82000000
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a
Followed by two CRLF's (Newlines)
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a
The first 6 bytes dont make alot of sense but they appear to be some sort of verification code as if u change the contents and or length of the configuration options it will change changeing the mac address it appears to go down 1 for every 1 the mac address goes up...
if anyone could shed some light on this particular part of the cfg file it would be great :)
i seem to get the feeling it is some sort of hash of the configuration options with the mac address subtracted from it ...
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a
configuration file format
The parameters are strung together without whitespace, ie:
"P30=time.nist.gov&P63=1&P31=1"
A "key" parameter ("&gnkey=0b82") is then added to the parameter string. ie:
"P30=time.nist.gov&P63=1&P31=1&gnkey=0b82"
If the length of this parameter string is not even, a zero byte is added to the string,
A 16 byte "header" that is prepended to the resulting configuration string.
The header consists of:
Byte 0x00: 0x00
Byte 0x01: 0x00
Byte 0x02: high byte of (length of parameter string) divided by 2
Byte 0x03: low byte of (length of parameter string) divided by 2
Byte 0x04: 0x00 (replaced by high byte of checksum)
Byte 0x05: 0x00 (replaced by low bytes of checksum)
Byte 0x06: first byte of device MAC address
Byte 0x07: second byte of device MAC address
Byte 0x08: third byte of device MAC address
Byte 0x09: fourth byte of device MAC address
Byte 0x0A: fifth byte of device MAC address
Byte 0x0B: sixth byte of device MAC address
Byte 0x0C: carriage return ( 0x0C )
Byte 0x0D: line feed (0x0A)
Byte 0x0E: carriage return ( 0x0C )
Byte 0x0F: line feed (0x0A)
This results in a configuration string of:
16 bytes header + (configuration parameters) + (&gnkey=0b82) + (Padding byte if length is not even)
You then compute a 16 bit checksum (initial value 0x0000 - adding the value of each individual byte)
of the entire confguration string. This value is the subtracted from 0x10000 and placed in bytes 4 and
5 of the header, then the header and parameter strings are written to a binary file.
calculate checksum with file lenght bytes set to 00 00 and write lenght after
This format has been tested and confirmed with firmware versions ip to 1.0.6.0 of the grandstream and
BudgeTon and HandyTone devices.
Template
Grandstream do provide a template (with largely correct comments) on their website. However, as of June 2006, it only covered the 1.0.6 firmware family, and so doesn't have the options for 1.0.8.x. However, if you view source on the phone's HTTP configuration, you can see the new P numbers.
If you want to know parameters, you just have to edit the html source of the phone configuration pages.
Configuration Parameters
P2: Admin Password
P3: Display (CallerID) Name
P8: IP Address Type ( 0 = DHCP, 1 = static )
P9: Static IP Address - octet 0
P10: Static IP Address - octet 1
P11: Static IP Address - octet 2
P12: Static IP Address - octet 3
P13: Subnet Mask - octet 0
P14: Subnet Mask - octet 1
P15: Subnet Mask - octet 2
P16: Subnet Mask - octet 3
P17: Default Router - octet 0
P18: Default Router - octet 1
P19: Default Router - octet 2
P20: Default Router - octet 3
P21: DNS server 1 - octet 0
P22: DNS server 1 - octet 1
P23: DNS server 1 - octet 2
P24: DNS server 1 - octet 3
P25: DNS server 2 - octet 0
P26: DNS server 2 - octet 1
P27: DNS server 2 - octet 2
P28: DNS server 2 - octet 3
P29: Early Dial
P30: NTP Time Server ( FQDN or IP Address )
P31: SIP Registration ( 0 = do not register, 1 = register )
P32: Register Expiration ( in minutes )
P33: VoiceMail Dial String
P34: Authentication Password
P35: SIP User ID
P36: Authenticate ID
P37: Voice Frames per TX
P38: Layer 3 QoS
P39: Local RTP Port
P40: Local SIP Port
P41: TFTP server IP Address - octet 0
P42: TFTP server IP Address - octet 1
P43: TFTP server IP Address - octet 2
P44: TFTP server IP Address - octet 3
P47: SIP Server (FQDN or IP Address)
P48: Outbound Proxy (FQDN or IP Address)
P49: G723 Frame rate
P50: Silence Suppression ( 0 = no, 1 = yes)
P51: 802.1Q/VLAN Tag
P52: STUN NAT Traversal ( 0 = no, 1 = yes)
P57: Codec choice 1 ( 0 = g.711u, 8 = g.711u, 18 = g.729 )
P58: Codec choice 2
P59: Codec choice 3
P60: Codec choice 4
P61: Codec choice 5
P62: Codec choice 6
P46: Codec choice 7
P98: Codec choice 8
P63: User ID is phone number ( 0 = no, 1 = yes)
P64: Timezone Offset ( Offset from GMT in minutes + 720, IE: MST (GMT - 7 hours) = -420 + 720 = 300 )
P65: Send Anonymous ( 0 = no, 1 = yes)
P66: Dial Plan Prefix
P71: Offhook Auto Dial
P72: Use # as Dial Key ( 0 = no, 1 = yes)
P73: Send DTMF Type (0 = inband, 1 = RFC2833, 2 = SIP INFO)
P74: Send Flash Event ( 0 = no, 1 = yes )
P75: Daylight Savings Time ( 0 = no, 1 = yes)
P76: STUN NAT Traversal Server
P78: Use random port ( 0 = no, 1 = yes)
P79: DTMF Payload Type ( defaults to 101 )
P81: Unregister on Reboot ( 0 = no, 1 = yes)
P82: PPPoE Account ID
P83: PPPoE Password
P84: Keep-Alive Interval
P85: No Key Entry Timeout
P87: 802.1p priority value
P88: Lock keypad update ( 0 = no, 1 = yes)
P90: Auto Answer ( 0 = no, 1 = yes)
P91: Disable Call Waiting ( 0 = disabled, 1 = enabled)
P96: iLBC payload type
P97: iLBC frame size
P99: Subscribe for MWI
P101: Use NAT IP ( 0 = no, 1 = yes)
P102: Date Display Format
P103: Use DNS SRV ( 0 = no, 1 = yes)
P104: Default Ring Tone
P191: Enable Call Features ( 0 = no, 1 = yes)
P192: HTTP Firmware Update Server (also TFTP server if P212 is set to TFTP, on 1.0.8.x)
P193: Firmware Check Interval (in minutes in 1.0.8.x)
P194: Auto Update ( 0 = no, 1 = yes)
P197: Proxy-Require ( 0 = no, 1 = yes)
P212: Firmware Upgrade ( 0 = TFTP Upgrade, 1 = HTTP Upgrade )
P232: Firmware File Prefix (1.0.8.x)
P233: Firmware File Suffix (1.0.8.x)
P234: Config File Prefix (1.0.8.x)
P235: Config File Suffix (1.0.8.x)
P237: TFTP/HTTP Config Server (based on P212, 1.0.8.x)
P238: Check for new Firmware ( 0 = Every time, 1 = only when suffix/prefix changes, 2 = Never - 1.0.8.x)
HandyTone Specific Parameters
P86: FXS Impedance:: 0 = 600ohm (North America)
(1 = 900ohm , 2 = 600ohm+2.16uF, 3 = 900ohm+2.16uF, 4 = CTR21, 5 = Australia / New Zealand,
6 = Slovenia / Slovakia / South Africa, 7 = New Zealand #2)
P110: Lan Subnet Mask
P111: Lan DHCP Base IP Address
P112: DHCP IP Lease Time
P113: LAN DMZ IP Address
P150: Port Forwarding entry 1 - WAN Port
P151: Port Forwarding entry 2 - WAN Port
P152: Port Forwarding entry 3 - WAN Port
P153: Port Forwarding entry 4 - WAN Port
P154: Port Forwarding entry 5 - WAN Port
P155: Port Forwarding entry 6 - WAN Port
P156: Port Forwarding entry 7 - WAN Port
P157: Port Forwarding entry 8 - WAN Port
P158: Port Forwarding entry 1 - LAN IP
P159: Port Forwarding entry 2 - LAN IP
P160: Port Forwarding entry 3 - LAN IP
P161: Port Forwarding entry 4 - LAN IP
P162: Port Forwarding entry 5 - LAN IP
P163: Port Forwarding entry 6 - LAN IP
P164: Port Forwarding entry 7 - LAN IP
P165: Port Forwarding entry 8 - LAN IP
P166: Port Forwarding entry 1 - LAN Port
P167: Port Forwarding entry 2 - LAN Port
P168: Port Forwarding entry 3 - LAN Port
P169: Port Forwarding entry 4 - LAN Port
P170: Port Forwarding entry 5 - LAN Port
P171: Port Forwarding entry 6 - LAN Port
P172: Port Forwarding entry 7 - LAN Port
P173: Port Forwarding entry 8 - LAN Port
P174: Port Forwarding entry 1 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P175: Port Forwarding entry 2 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P176: Port Forwarding entry 3 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P177: Port Forwarding entry 4 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P178: Port Forwarding entry 5 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P179: Port Forwarding entry 6 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P180: Port Forwarding entry 7 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P181: Port Forwarding entry 8 - Protocol ( 0 = UDP, 1 = TCP 2 = Both )
P115: Cloned WAN MAC Address - Octet 0
P116: Cloned WAN MAC Address - Octet 1
P117: Cloned WAN MAC Address - Octet 2
P118: Cloned WAN MAC Address - Octet 3
P119: Cloned WAN MAC Address - Octet 4
P120: Cloned WAN MAC Address - Octet 5
P190: Enable WAN Side HTTP Access
P195: PSTN Access code (default: *00)
P196: End-User password
P198: SPECIAL FEATURES ( 100 = standard, 101 = Nortel MCS, 102 = Broadsoft, 103 = Howdy )
P200: Caller ID Scheme, 0 = Bellcore, 1 = ETSI-FSK (France, Germany, Norway, Taiwan, UK-CCA), 2 = ETSI-DTMF (Finland, Sweden), 3 = Denmark-DTMF
P205: Polarity Reversal. 0 - No, 1 - Yes.
P206: 1 = 18V, 2 = 36V, 3 = 48V, 4 = 51V, 5 = 24V
P231: HandyTone Revision 2 Hardware - Bridge between WAN and LAN port. 1=yes, 0=no
P228: FAX Mode 0 - T.38 (Auto Detect), 1 - Pass Through
Page Changes
Correction on checksum calculation
$chk = 0x10000 - unpack("%16n*", pack("C*", @header, @cfg));
in addition to that slight change ("n" instead of "C"), you also have to make sure the length has already been installed in the header
CRC Calculation
//Calculate the CRC for the file
for (int i = 0; i < allConfig.length; i++)
{
crc16 += allConfigi;
}
crc16 = 0X10000 - crc16;
config format CRC problem
I have followed the format described above, but am unable to generate a correct CRC. I've used a crc += byte, crc += ord(byte) etc. but I can never come up with the same crc as the Windows tool does. Needless to say, the phone does not ever like my "hand made" configs... Perhaps someone could enlighten me on this CRC?
I can create an exact duplicate of the configuration generated from a template by the windows tool with the exception of those two bytes. I'm pulling my hair out!
In the perl snippet below, @header is a 16-byte array of the header bytes, @cfg is an array of the config bytes, including gnkey=0b82 and any required padding....
$chk = 0x10000 - unpack("%16C*", pack("C*", @header, @cfg));
$header[4] = ($chk & 0xFF00) >> 8;
$header[5] = $chk & 0x00FF;
Any help/pointers would be greatly appreciated.
a GrandStream HandyTone 386 config template
# please edit
# Admin password for web interface
P2 =
# End User Password
P196 =
# SIP Server
P47 =
P244 =
# Local SIP port * 5060 * 5062
P40 =
P247 =
# Local RTP port 1024-65535 , * 5004 * 5008
P39 =
P248 =
# Outbound Proxy
P48 =
P245 =
# SIP User ID
P35 =
P241 =
# Authentication ID
P36 =
P242 =
# Authentication password
P34 =
P243 =
# User Caller Name (John Doe)
P3 =
P240 =
# NAT Traversal 0 , 1
P52 =
# STUN server
P76 =
# PPPoE support. PPPoE user ID
P82 =
# PPPoE password
P83 =
# IP Address
P9 = 192
P10 = 168
P11 =
P12 =
# Subnet mask
P13 = 255
P14 = 255
P15 =
P16 =
# Router
P17 = 192
P18 = 168
P19 =
P20 =
# DNS 1
P21 = 68
P22 = 87
P23 = 66
P24 = 196
# DNS 2
P25 = 0
P26 = 0
P27 = 0
P28 = 0
# DHCP support. 0 - yes, 1 - no
P8 =
# Use this DNS server
P92 =
P93 =
P94 =
P95 =
# Firmware Upgrade 0 - via TFTP , 1 - via HTTP
P212 = 0
# TFTP Server (for remote software upgrade and configuration)
## NOTE: this is a redundent setting, this one is not on html configuration
P213 = 192
P214 = 168
P215 =
P216 =
# TFTP Server (for remote software upgrade and configuration)
## NOTE: this one is
P41 = 192
P42 = 168
P43 =
P44 =
# HTTP Server - can be full URL
P192 =
# Automatic HTTP Upgrade. 0 - No, 1 - Yes Default is Yes.
P194 = 0
# Check for new firmware every () day, unit is in day, default is 7 days.
P193 = 0
# Use DNS SRV. 0 - No, 1 - Yes.
P103 =
# Use NAT IP. This will enable our SIP client to use this IP in the SIP message. Example 64.3.153.50.
P101 =
# Proxy-Require (A SIP extension to enable firewall penetration)
P197 =
# Use Random Port. 0 - no, 1 - yes
P78 =
# First codec. 0 - PCMU, 2 - G.726-32, 4 - G.723.1, 8 - PCMA, 15 - G.728, 18 - G.729A/B, 98 - iLBC, 9 - G.722
P57 = 0
# Second codec
P58 = 2
# Third codec
P59 = 4
# Forth codec
P60 = 8
# Fifth codec
P61 = 15
# Sixth codec
P62 = 18
# Seventh codec
P46 = 2
# G723 rate. 0 - 6.3kbps encoding rate, 1 - 5.3kbps encoding rate
P49 =
# iLBC payload type. Between 96 and 127, default is 97.
P96 =
# iLBC Frame Size. 0 - 20ms(default), 1 - 30ms.
P97 =
# Silence Suppression. 0 - no, 1 - yes
P50 =
# Voice Frames per TX (up to 10/20/32/64 frames for G711/G726/G723/other codecs respectively)
P37 =
# IP QoS (IP Diff-Serv or Precedence value for RTP)
P38 =
# Layer 2 QoS. 802.1Q/VLAN Tag (VLAN classification for RTP)
P51 =
# Layer 2 QoS. 802.1p priority value (0 - 7)
P87 =
# SIP Registration. 0 - no, 1 - yes
P31 =
# Register Expiration (in minutes. default 1 hour, max 45 days)
P32 =
P246 =
# Unregister On Reboot. 0 - no, 1 - yes
P81 = 1
# Keep-alive interval in seconds * 20
P84 =
# Send DTMF. 0 - in audio 1 - via RTP * 2 - via SIP INFO
P73 =
# DTMF Payload Type
P79 =
# Send Flash Event (Flash will be sent as a DTMF event if set to Yes). 0 - no, 1 - yes
P74 =
# NTP Server
P30 = 128.118.25.3
# Time Zone. Offset in minutes to GMT
P64 =
# Daylight Savings Time. * 0 , 1
P75 =
# SIP User ID is phone number * 0 , 1
P63 =
# Dial Plan (dial plan prefix string)
P66 =
# Early Dial (use "Yes" only if proxy supports 484 response) * 0 , 1
P29 =
# Use# as Dial Key (if set to Yes, "#" will function as the "(Re-)Dial" key) 0 , * 1
P72 =
# Voice Mail UserID (User ID/extension for 3rd party voice mail system)
P33 =
# SUBSCRIBE for MWI. Whether or not send SUBSCRIBE for Message Waiting Indication. * 0 , 1
P99 =
# Offhook Auto-Dial (User ID/extension to dial automatically when offhook)
P71 =
# Disable Call-Waiting * 0 , 1
P91 =
# Enable/Disable Call Features, 0 - No, 1 - Yes.
P191 = 1
# Send Anonymous (caller ID will be blocked if set to Yes). 0 - no, 1 - yes
P65 =
# No Key Entry Timeout. Default - 4 seconds.
P85 =
# Lock Keypad Update. (configuration update via keypad is disabled if set to Yes)
# 0 - No, 1 - Yes.
P88 =
# Syslog Server (name of the server, max length is 64 charactors)
P207 = 192.168.123.115
# Syslog Level 0 - NONE, 1 - DEBUG, 2 - INFO, 3 - WARNING, 4 - ERROR
P208 = 1
# Special Feature. 100 - Standard, 101 - Nortel MCS, 102 - BroadSoft, 103 - Howdy.
P198 =
# PSTN Access Code (The Maximum is 6 digits). Default = *00
P195 =
# Default Ring Tone. 0 - system ring tone, 1,2,3
P104 =
# Use custom ring tone 1 if incoming caller ID is the following:
P105 =
# Use custom ring tone 2 if incoming caller ID is the following:
P106 =
# Use custom ring tone 3 if incoming caller ID is the following:
P107 =
# FXS Impedence
# Default setting is "600 Ohm (North America)"
# 600 Ohm (North America)
# 900 Ohm
# 600 Ohm + 2.16uF
# 900 Ohm + 2.16uF
# CTR21 (270 Ohm + 750 Ohm||150nF)
# Australia/New Zealand#1 (220 Ohm + 820 Ohm||120nF)
# Slovakia/Slovenia/South Africa (220 Ohm + 820 Ohm||115nF)
# New Zealand#2 (370 Ohm + 620 Ohm||310nF)
P86 = 0
# Caller ID Scheme
# current setting is "Bellcore"
# Bellcore (North America)
# ETSI-FSK (France, Germany, Norway, Taiwan, UK-CCA)
# ETSI-DTMF (Finland, Sweden)
# Denmark-DTMF
P200 = 0
# Onhook Voltage
# current setting is "36V"
# 18V
# 24V
# 36V
# 48V
# 51V
P206 = 2
# Polarity Reversal. 0 - No, 1 - Yes.
P205 = 0
# FAX Mode. 0 - T.38 (Auto Detect), 1 - Pass Through
P228 = 0
### HandyTone 486 Specific NAT Settings.
# WAN side http access * 0 , 1
P190 = 0
#Cloned WAN MAC Address.
P115 =
P116 =
P117 =
P118 =
P119 =
P120 =
#LAN Subnet Mask. Example: 255.255.255.224
P110 =
#LAN Base/Gateway/Router IP for the LAN port, default is 192.168.2.1.
P111 =
#DHCP IP Lease Time, in units of hours, default is 120 hours or 5 days.
P112 =
#DMZ IP.
P113 =
#### Port Forwarding.
### Choice 1
# WAN Port
P150 =
# LAN IP
P158 =
# LAN Port
P166 =
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P174 =
### Choice 2
# WAN Port
P151 =
# LAN IP
P159 =
# LAN Port
P167 =
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P175 =
### Choice 3
# WAN Port
P152 =
# LAN IP
P160 =
# LAN Port
P168 =
# Protocol 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P176 =
### Choice 4
# WAN Port
P153 =
# LAN IP
P161 =
# LAN Port
P169 =
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P177 =
### Choice 5
# WAN Port
P154 =
# LAN IP
P162 =
# LAN Port
P170 =
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P178 =
### Choice 6
# WAN Port
P155 =
# LAN IP
P163 =
# LAN Port
P171 =
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P179 =
### Choice 7
# WAN Port
P156 =
# LAN IP
P164 =
# LAN Port
P172 =
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P180 =
### Choice 8
# WAN Port
P157 = 8888
# LAN IP
P165 =
# LAN Port
P173 = 80
# Protocol. 0 - UDP Only, 1 - TCP Only, 2 - TCP and UDP.
P181 = 1
# BudgeTone Specific
# Eighth codec. 0 - PCMU, 2 - G.726-32, 4 - G.723.1, 8 - PCMA, 15 - G.728, 18 - G.729A/B, 98 - iLBC, 9 - G.722
P98 =
# Auto Answer
P90 =
# Date Display Format. 0 - Year-Month-Day, 1 - Month-Day-Year, 2 - Day-Month-Year
P102 =