search

bohdan-s / WanWay-Tech-S20

GNU General Public License v3.0
33 stars 8 forks source link

WanWay S20 Unlock IP: ERROR:101 #4

Open 0x1234567890 opened 11 months ago

0x1234567890 commented 11 months ago

I try to change the server ip but

  1. Request: SERVER,0,148.251.67.210,24871,0#

  2. Response: ERROR:The domain name or IP is locked,not allowed to modify.

  3. Request: LOCKIP,WWDSS20,UNLOCK#

  4. Response: ERROR:101

I also tryed to Factory reset with: FACTORYALL# after that i still not can change the IP.

What can i do now?

bohdan-s commented 11 months ago

It seems they may have changed the password. can you put the original sim into a phone and see if receives any SMS? It may tell us the new password.

0x1234567890 commented 11 months ago

It seems they may have changed the password. can you put the original sim into a phone and see if receives any SMS? It may tell us the new password.

And why they should send the password via sms? How Can i unlock with the code?

Or is it possible to reflash the device?

bohdan-s commented 11 months ago

Hi, most of this is explained in the readme. These devices come locked from the factory, when the device is turned on for the first time the unlock code is sent to set the APN correctly. We then used the same code to unlock the server/ip settings. If the code in the readme is not working, then they have changed the code. The best way to get the new code would be to try to get it the same way we got the old one, by putting the supplied SIM in a phone and check what commands are sent (as per the discovery part of the readme). As for flashing the firmware, if you can figure it out let me know :) I was able to get it into flash mode, but could not find any alternate firmware's or code to load.

highground88 commented 10 months ago

Try FACTORY# instead of

I try to change the server ip but

  1. Request: SERVER,0,148.251.67.210,24871,0#
  2. Response: ERROR:The domain name or IP is locked,not allowed to modify.
  3. Request: LOCKIP,WWDSS20,UNLOCK#
  4. Response: ERROR:101

I also tryed to Factory reset with: FACTORYALL# after that i still not can change the IP.

What can i do now?

Try FACTORY# rather than FACTORYALL# before the other commands - I believe that will fix your problem (seems to have been a change)

russerpio commented 10 months ago

Hi. Not work

image

highground88 commented 10 months ago

Hi. Not work

image

Mine seems to be an older version: Version: S20_4G_LA_V01_Oct 22 2022_13:49:35.

Did you try: If the code in the readme is not working, then they have changed the code. The best way to get the new code would be to try to get it the same way we got the old one, by putting the supplied SIM in a phone and check what commands are sent (as per the discovery part of the readme).

jansierakowski commented 9 months ago

Hi, same software, same problem. I put the sim card from tracker to my phone. This simcard is set as DATA ONLY. I am not reciving any sms.

luterovk commented 8 months ago

Hola, compré dos artículos la semana pasada y ambos están bloqueados para cambiar de servidor. Tampoco funciona el comando FACTORYALL# en ninguno. VERSION#: Y2517_S20_DS_1_V02_2023.05.02_1 Modelo de chip: V1.6

Tengo otro dispositivo de unos meses atrás que permite toda la configuración. Creo que los nuevos los están capando. Por ahora devolveré estos e intentaré comprarlos en otro proveedor, a ver si hay algo más antiguo disponible.

diego-cr commented 7 months ago

Can read sms with AT+ commands.

AT+CGMR

+CGMR: Y2517_S20_DS_1SEC_V02, 2023/05/02 17:03

OK

AT+CMGR=1

+CMGR: 2,, 72 00110000FF0008A94000B600B200BA00B600A000B600B200BA00B600AC00A900D300C700C900C800C600CB00C900CF00CA00CE00CA00C800C600CA00C900C600D300CD00CF00CC00DC

AT+CMGR=4

+CMGR: 2,, 24 00510000FF0008A9100500032A020200CD00BC00CD00BB00DC

OK

fabryhtml commented 7 months ago

Can you explain the procedure to unlock Ip server and Apn?

i've my traccar server

thx!

diego-cr commented 7 months ago

On mine new s20 APN isn't locked but IP yes, don't have new password to unclock IP. This sms seems to be sent and no one are received. They don't need to send a sms with password to change APN.

fabryhtml commented 7 months ago

ok for APN ,i need change ip server,can you help me?

diego-cr commented 7 months ago

No password, no party 😔

fabryhtml commented 7 months ago

the psw is sent from default sim installed? with another s20 ,remove first sim default,install own sim,the ip server can change?

diego-cr commented 7 months ago

2G versión have a mt2503dv, I have dumped the rom.

fabryhtml commented 7 months ago

i can restore the modified rom with ip server unlocked?

fabryhtml commented 7 months ago

can you send me dumped rom and tool for restore fw unlock?

diego-cr commented 7 months ago

https://github.com/johnyHV/MTK2503-DOCUMENTATION/

To read need FlashTool_v5.1516.00 and scatter files from dl_src dir

fabryhtml commented 7 months ago

Before first power on,new item, if remove the original sim and put my sim, is possible send command to change ip server?

fabryhtml commented 7 months ago

if the original sim on first boot power on send the lock code for ip server, if change before power on the original sim, unlocked probabily is possible?

nop0x900 commented 6 months ago

https://github.com/johnyHV/MTK2503-DOCUMENTATION/

To read need FlashTool_v5.1516.00 and scatter files from dl_src dir and a connect a usb to serial to rx tx and [ground.

To flash no idea, needed separate bootloader, rom and more partitions

rt

ROM.zip

Hello i have old version wanway s20. Please write how i can do dump and i will send for use it !!! thanke you

diego-cr commented 6 months ago

WARNING !!! CAN DAMAGE THE DEVICE

I HAVE ONE OLD S20, I WILL READ IT WHEN.......

Dont' know if old version fw can be flashed on new devices.

2G MTK mt2503dv version only. Need a usb ttl adapter (drivers installed) and solder 3 wires, Tx Rx and ground. Download latest mtk flash tool https://androidmtk.com/download-mtk-flash-tool

https://github.com/johnyHV/MTK2503-DOCUMENTATION/tree/master/WZ-203CS/%E5%BC%80%E5%8F%91%E5%B7%A5%E5%85%B7/QFlash_V4.0/dl_src/M26

Open 1.cfg scatter fille DON'T FLASH!!!!!!! Go to Read Back, read start 0x00000000 length 0x00400000

Connect Rx(white wire) to Tx, Tx(green wire) to Rx and ground, connect usb ttl and check port number.

Push read back button, turn on device and wait.

Don't share here the dump, imei and configured server is on dump

read

mtk

nop0x900 commented 6 months ago

WARNING !!! CAN DAMAGE THE DEVICE

I HAVE ONE OLD S20, I WILL READ IT WHEN.......

Dont' know if old version fw can be flashed on new devices.

2G MTK mt2503dv version only. Need a usb ttl adapter (drivers installed) and solder 3 wires, Tx Rx and ground. Download latest mtk flash tool https://androidmtk.com/download-mtk-flash-tool

https://github.com/johnyHV/MTK2503-DOCUMENTATION/tree/master/WZ-203CS/%E5%BC%80%E5%8F%91%E5%B7%A5%E5%85%B7/QFlash_V4.0/dl_src/M26

Open 1.cfg scatter fille DON'T FLASH!!!!!!! Go to Read Back, read start 0x00000000 length 0x00400000

Connect Rx(white wire) to Tx, Tx(green wire) to Rx and ground, connect usb ttl and check port number.

Push read back button, turn on device and wait.

Don't share here the dump, imei and configured server is on dump

read

mtk

Ok. Thx. I will create a dump soon and send it to you. Apparently they use a spi 25Q32 flash drive, you can make a dump using any programmer! I also want to try to analyze the dump through IDA to find the password there.

nop0x900 commented 6 months ago

WARNING !!! CAN DAMAGE THE DEVICE

I HAVE ONE OLD S20, I WILL READ IT WHEN.......

Dont' know if old version fw can be flashed on new devices.

2G MTK mt2503dv version only. Need a usb ttl adapter (drivers installed) and solder 3 wires, Tx Rx and ground. Download latest mtk flash tool https://androidmtk.com/download-mtk-flash-tool

https://github.com/johnyHV/MTK2503-DOCUMENTATION/tree/master/WZ-203CS/%E5%BC%80%E5%8F%91%E5%B7%A5%E5%85%B7/QFlash_V4.0/dl_src/M26

Open 1.cfg scatter fille DON'T FLASH!!!!!!! Go to Read Back, read start 0x00000000 length 0x00400000

Connect Rx(white wire) to Tx, Tx(green wire) to Rx and ground, connect usb ttl and check port number.

Push read back button, turn on device and wait.

Don't share here the dump, imei and configured server is on dump

read

mtk

Pls send you mail for send dump, after download from device.

diego-cr commented 6 months ago

Is on my GH profile

nop0x900 commented 6 months ago

Is on my GH profile, diegocr@gmail.com

Hello, I send to you mail, 2 dump, 1 dump from old version and 1 new version!!! and picture for analize HEX.

diego-cr commented 6 months ago

With nop0x900 dumps ww s20 is unlocked

Thanks nop0x900 !!!!

bohdan-s commented 6 months ago

Was there a new password required? Or how did you unlock it?

diego-cr commented 6 months ago

Flashing nop0x900 dump (version Y2517_GW005A_V03_2022.10.21_17) and WWDSS20 code, still testing

Can't flash full dump, need to separate partitions and start address ans sizes

bohdan-s commented 6 months ago

So we may have an option to flash a specific firmware version with known password?

diego-cr commented 6 months ago

2G version have mt2503dv, can dump and flash with mtk flashtool but need to split and modify it.

SzymonZy commented 6 months ago

Hello

First of all which pins did you use I see no regular pinheader for serial communication on board. Only pins tx1, rx1, plenty of gnd's. Was that TX1, RX1 - gnd does not matter? I want to compare two of my boards - locked and unlocked. Could be that we can edit server directly in hex and flash again. If there is not checksum made on boot.

diego-cr commented 6 months ago

Can't be flashed by USB cable, don't open it

SzymonZy commented 6 months ago

No idea why you want me to use usb? I'm looking on pcb and there is no regular pin header for ttl - btw: what ist the voltage levels 1.8v or older 3.3v? Only points marked as TX1/RX1 are over the sim card socket below antenna.

diego-cr commented 6 months ago

External micro usb connector

SzymonZy commented 6 months ago

What did you use to flash dump? https://multi-com.pl/,details,id_pr,22958,key,mt-nor-adapter-dla-procesorow-mediatek-2503dv.html something like that?

voltane commented 6 months ago

Any news on it? If you guys have some insights for now it might be useful to write here everything so other might help and contribute. I bet there are a lot of people who are really interested in solving this problem.

diego-cr commented 6 months ago

For 2G version see issue #7 I have tested on 3 devices only