Hacking the Telecom Italia Aladino WiFi (AKA Samsung WIP-6000M) SIP phone

There’s no point to having an Asterisk server if there are no phones to go with it……….

I’ve got a Linksys SPA3102 which interfaces my old DECT Philips phones with my Asterisk server, but with only two handsets, it’s not really ideal.

Enter the Telecom Italia Aladino WiFi. This is a rebadged Samsung WIP-6000M, it’s a fairly old phone, around 2004 vintage, maybe even earlier, is only 802.11b, and worst of all, is locked to the Telecom Italia Alice service. However, it’s cheap (I picked up six of them for about EUR 9.00 each, excluding postage), it can be hacked, and it can have bog standard firmware flashed. Read on to find out how.

The first thing you need is the firmware, and it also helps to have some documentation. Here’s one I prepared earlier. Once you have the zip file, extract it, and then extract the firmware from aladino_fw.zip contained within it.

You will need an FTP server. Setting one up is beyond the scope of this post, please don’t ask me how, there’s just too many variables involved – Google is Your Friend! Once you have your FTP server set up, you will need to copy all of the firmware files to the root of the FTP server.

After you have your FTP server set up, you will need to prepare your WiFi router or access point. A better option is to go and buy a separate, cheap, 802.11b pure access point, that you can dedicate to phone service only. You will need to change some settings, don’t worry, you can set them back later. First, you will need to change the SSID of your access point to “Alice-12345678” (minus the quotes). Remove any encryption, and ensure any MAC filtering. You can add this back later.

Now on to the handset. You’re at a disadvantage here, if you’re not Italian, as it’s set (obviously!) to Italian. I’ve done the hard work for you, we’ll get it to a stage where we can change it to English. Switch it on buy pushing and holding down the on-hook button (the one with the red phone symbol). A spalsh screen will come up, it will play a cheesy tune, and eventually will give a display titled “Selezione Rete”, and allow you to select your “Alice-12345678” AP. Hit the OK button.when the sand timer has finished spinning, and it comes up with a display titled “Inserisci numero”, enter the number “0” and hit the OK button. More sand timer…..follwoed by an error message “Errore, riprovare”. Hit the exit button (top right smartkey), and you’ll have the display up and ready.

Now to change the language. Hit the menu smartkey, and use the cursor ring to scroll across to menu 5, “Impostazioni”. You can scroll down to item 5.6, “Lingua”, or just hit the 6 key. Hit OK, and OK again. select “English, and hit OK. You will go back to menu item 5.6.1. Hit the 2 button (Or scroll), and change the Input Mode to English as well. exit out of the menus (you will need to hit the exit key a few times).

Before we can do anything useful, we have to turn access control ON. You do this by entering the following key sequence: *#0214*1004#

Yeah, the sounds are really cheesy, aren’t they?

Now we need to enter the test menu. you do this by entering the following key sequence: *#8999*8378#

You will need to turn provisioning and firmware signing off. These settings are found in Test Mode 4.3 (Env Settings -> PROV) and 4.4 (Env Settings -> DSIGN)

Now set up the IP settings in Test Mode 6. If you are running a DHCP server, you only need to worry about setting the FTP server IP address in 6.6, otherwise also set 6.1 and 6.2.

In the upgrade menus in Test Mode 7, set the protocol in 7.3 to FTP Auto, the CNF file in 7.4 to “Upgrade.cnf” (note the uppercase “U”), your FTP server login and password in 7.7 and 7.7, and either “/” for the path in 7.8, otherwise set this to the path under your FTP root where you saved the firmware files. Now you can start the main upgrade, option 7.1. This takes a while. Go and make yourself a cup of coffee.

Once the phone has rebooted into a fresh new firmware, you will find that the Test Mode is now exposed in menu item 5.12. Set your Asterisk server IP address in 5.12.5.1 and 5.12.5.4. Set the phone number in 5.12.5.12. Set the auth username and password in 5.12.5.13 and 5.12.5.14. Exit out of the menus, and reboot the phone by removing and reinstalling the battery, and switching it on.

Congratulations. You now have a WiFi SIP handset that works with your Asterisk server.

5 thoughts on “Hacking the Telecom Italia Aladino WiFi (AKA Samsung WIP-6000M) SIP phone

  1. Hello Wanderer,

    Thanks for your instructions as to how to unlock the Samsung WIP-6000M. I have finally managed to unlock it.

    Now I would like to use it with one of my numerous Betamax VoIP accounts (they have many sub-brands like voipcheap, voipstunt, voipbuster, etc.)

    While I thought of myself as a specialist in the area, and while I do have numerous other WiFi phones, I badly failed this time, even after sacrificing some 24 hours on the subject. The phone gets registered on to the WiFi netweork, but the account does not get registered / logged on. The error on the dispaly reads ‘not registered’ and the small phone in the top left corner is crossed out with a red line.

    One of the main problems might be that this type of account does not have a ‘phone number’ as required by this device.

    Any ideas how to proceed from a factory reset?

    Here is one of my active VoIP accounts for testing purposes (still with a small credit)
    Account: *****
    P/W: *****

    SIP settings normally like this:
    https://www.dialnow.com/en/sip
    (in summary: everything is ‘sip.dialnow.com’)

    On a more generic basis, see also here:
    http://www.voipbuster.com/hardware#wi-fi phones
    and
    http://www.voipbuster.com/en/sipp.html

    Would be great of you could help me out here. I am happy to give a ‘small donation’ if you can.

    Cheers,

    Franco

  2. I don’t really know. Mine all register to an asterisk server on my internal home network. I’ve never tried registering to a provider outside my network.

    It could be ta few things:
    1. Your router/modem is firewalling you,
    2. It could be NAT issues – the Aladino is not so good at traversing NAT (In fact, it’s hopeless!)
    3. Your wireless access point absolutely must have an SSID of something like this: Alice-12345678

    Most of the information I found was in Italian spread out over many pages.

    Try these:
    http://www.napoliwireless.net/doku/doku.php?id=hack:aladino
    hhttp://www.liberailvoip.it/home/hardware/aladino

    And if all else fails, try googling “aladino wifi hacks”

  3. Hi Frank,

    Thank you for the great info. I havea Samsung OffeceServ Soho at the office, and would like to buy a few wireless phones to connect with it, for our employees.

    I searched for the WIP-5000 which I knew is supposed to work with the OfficeServ out of the box, but these phones are too expensive… The WIP-6000 has a much more accesible price for me, but I am worried because it is locked as you say, and I don’t really know if it will work with the OfficeServ Soho…

    Could you please advice? Thank you in advance!

    Diego

    • Hi Diego

      Sorry, I have no idea – I don’t know anything about OfficeServ. I do know that they work with Asterisk, as that is what I’m using.

  4. Hi,
    I just landed on you blog while I’m googling for the files of Samsung, but unfortunately they are gone away.. may the time: 7 years later.
    Maybe do you have a copy of them ?

    Thanks,
    Angelo

Leave a Reply to Angelo Corsaro Cancel reply

Your email address will not be published. Required fields are marked *

CAPTCHA