Unlocking BT Home Hub V1 *Upgrade at your own risk*

Hi,
i got the unlocked home hub with super user rights but can anyone explain how to increase the signal as it hardly gets through the walls in my house at the moment. thanks

[54321dan12345]

Rob, Austin,

Thanks for the advice but I've gotta do something tricky enough to get a good grade using the WRT54GL would indeed be alot easier but would not provide enough scope to pick up points.

I was hoping to get away with using a modified version of the already ported linux which i "should" be able to implant over the top of the current version. with full ftp rights (which I believe is available through ftp 192.168.1.254/dl according to another site) I should be able to cross compile the torrent client into the kernel.

i know there are lots of "shoulds" in there but i'll muddle through also when i get my JTAG interface going i'll let you know what i find!

[pepsi_max2k]

@ rob, what authentication does talk talk use? if it's pppoa and doesnt reference a user name / password you may be in luck...
also, have you actually managed to get voip working on the thomson firmware? i could get my sip provider registered / active in it but anything plugged in just had no ring tone. i'm gona try again by uploading a bt config to it but dont hold out much hope


@dan, as others have said, there's not been any progress by anyone wanting to do stuff with the HH other than what it already allows. enabling a bash shell would appear to involve replacing chips on the board, and so far nothing's been done with the source code. dunno if it's through lack of trying or not, but there's deffinately enough people with one for me to think if it's not already been done, it's not gonna be. then again, check the last page for an example of my own hh hack that no one appears to have done before, and i've only had mine for just over a week

i don't see why a bittorrent client on ddwrt wouldn't be a good enough project. hell, i spent 2 days on my comp sci major and still got a 2:2. if you were to try on the home hub you'd probably end up doing stuff like reverse engineer the firmware, hack it to open up a bash shell, implement a swap file on remote storage, then implement the bittorrent client. all sound like decent major projects on their own. and you'd be the first to do more than think about any of it. i mean, even linus only wrote a kernel

dd-wrt on the other hand, all you gotta concentrate on is implementing bittorrent, and even that's been done on openwrt with ctorrent http://www.stud.uni-karlsruhe.de/~uz95/openwrt/ so you could reference that for help. and reasoning the move away from the home hub could make up some decent documentation.

[54321dan12345]

loving the documentation padding idea

It'd be cool to have a fully unlocked hub tho, when I realise I've bitten off more than I can chew I could always just concentrate on gettin the bash working then let you guys do cool stuff with it!

+ admitting defeat to BT would be somewhat soul destroying!

[Seith]

Okay so I've been trolling the Internet for a good few hours, spoken to a friend who's good with this stuff (I, however, am not) and I can't seem to get a final answer on my question.

I'm not too bad with computers, I understand how to open and use Telnet. I don't know exactly what the scripts and commands are/do but I understand how to get into the Hub's Telnet service for modifying the information.

I have some understanding of what flashing is (from what I've read it means changing it from a BT Homehub to Thomson's origional firmware thus making it into a generic router).

So my question is... can you modify the BT Homehub in order to use it on another ISP's line?

I just need a yes or a no so I will stop trying...

Alternativly, say I'm with some ISP which is not BT, can I just use the BT Hub as a wireless router? I don't need it for the ADSL modem (the ISP's line that I'm trying to use it on use a Thomson ADSL modem (the one BT also used before the Homehub, little silver thing used USB). For that line it's just a case of putting in a username and password and logging into the broadband.

So can I do either of these things:
Use the Modem and Wireless Router of the Homehub on a non BT line.
or
Use the current ADSL Thomson modem, and use the Homehub just to connect a laptop wirelessly and use the Internet on the computer which it is connected to.



Thank you thank you thank you for any help you can give me ^_^;;

seith

[blueled]

i add a picture

[Wheel_nut]

Blueled,

I am VERY interedted in what you have done. Please could you upload your v6.2.29 firmware file to Rapidshare.com and give us a URL so we can download and try the file.

Have you had to modify the original file?

What Changes have you made?

[pepsi_max2k]

@blueled, wow, i do hope that's not the v1.5 home hub you got there

@ Seith,

>> Use the Modem and Wireless Router of the Homehub on a non BT line.

If you use Be*, O2, or know what unauthenticated pppoa or ethoa is and have it, then yes. If you don't mind losing voip functionality and flashing the router then yes with all pppoe, pppoa or ethoa isps (most/all uk ones).

>> Use the current ADSL Thomson modem, and use the Homehub just to
>> connect a laptop wirelessly and use the Internet on the computer which it is
>> connected to.

yes. it involves doing this after having done the script subsytem bit in this. to do those you need to log in to the router via telnet. do that on windows by hitting start, run, enter "telnet 192.168.1.254", then login with admin / admin and you can enter the commands above. the first one you gotta log out "exit" then log in agian with the new user name (root / hubhax0r) to run the other commands.

[robadams]

Hi PepsiMax, it probably won't work for TalkTalk then as they do require a user name and password for pppoa, I haven't experimented with pppoe but it is a possibility, doubtful though. Like yourself, VoIP looks like it's working on the SpeedTouch, but I can't test it as the only DECT phone I have is the hubphone, which only registers to the HomeHub firmware. I thought people here had got DECT phones working off the ST, maybe with additional commands.

Anybody here making VoIP calls from a hub running the SpeedTouch firm?
And how?

[pepsi_max2k]

>> I thought people here had got DECT phones working off the ST, maybe with
>> additional commands.

not afaik. i had a huntch about some dect cli commands but couldn't test it in the end as my hub phone seems to have died an horrendous yet silent death.

>>Anybody here making VoIP calls from a hub running the SpeedTouch firm?

again, i've not seen anywhere confirming it's been done, and i did just try again with bt user.ini on the thomson and it didn't seem to help much, actually made it alot worse. so i'm back to the bt now and trying to figure out how the hell it's letting me dial out without adding the 0044 to numbers, which both betamax and bt say you need to do

[robadams]

Well, I'm italian user with router fastweb easy thomson 7G (is born unlocked); brother of Home BT, inventel dv7213,....motorola?..ecc)

Originally Posted by blueled

...

[Wheel_nut]

D'OH! .... It's not the same hardware as the BT Home Hub!

[mlance]

I'm also trying to get my homehub to work on Be. I have downgraded the firmware to BT's 6.2.2.6 and got root to play around with the user.ini. It then looks as though the hub can be reconfigured to do anything you want (either with a user.ini file or the cli interface), and I strongly suspect that with appropriate knowledge it could be connected to any adsl isp in the land. It's the knowledge part where I struggle...

However, I wasn't able to get it to work on Be with Pepsi's .ini file. I suspect that there may be too much in it that is specific to Pepsi. For example, there seems to be an ip address in it which I thought might be Pepsi's static ip address, if he has one. With some experimentation I sometimes managed to get it to partly work for a short period, suggesting that I was only a setting or two from having it sussed if only I knew more about the internal workings of adsl routers.

I have managed to establish a bridged connection to the internet on Be with one PC through the hub by using a bridge template from the unofficial Be forums, but I've not been able to figure out yet how to do the internal routing in the hub to allow a home network to connect internal PCs using the DHCP server and share the Be internet connection to wired and wireless PCs.

Hi guys, Looks like you are doing a great job here. I havent been online for a while so i have not followed the progress.

Could someone tell me what firmware to use to re-flash by Home Hub, but just as importantly i wish to use my Dect handsets 2 using the landline. (not bothered about using VOIP yet.

Hope someone can give me the instructions from start to finish.

thanks, Carl.


PS. again u are all great in my eyes for having the patients and helping us novices,

[mlance]

OK, I've managed to get the HH 6.2.2.6 to work with Be, as I wanted. I decided to go back to see how Pepsi went about it.

I went to the US ipstore site he mentioned and found the template Expert EthoA & DHCP with NAT for how I wanted the router to behave.

For mimimum fuss, I wanted to see if this would more or less work out of the box. So I simply changed the 12th line to
set var=ATM_addr value="0.101"
to match Be's settings.

Then I saved it as a .ini e.g. beuser.ini.

Probably optional step for safety: I reset the hub back to 6.2.2.6 default settings.

Gave myself root using the telnet commands:
:script add name = pwn command = "user add name = hubhax0r password = hubhax0r role = root descr = r00t"
:script run name = pwn pars = ""

At the back up and restore page, upped the beuser.ini file.

Then reset the wireless settings back to taste.

I found that it 'just works'. Computers can connect wired and wirelessly via DHCP, browse, use bittorrent etc. And the hub/DECT phones also work on the standard phone line. I've not tried any VOIP.

This is very much a quick and dirty solution. I don't pretend it's elegant, but it has the merit of being easy and operable with my limited knowledge.

[pepsi_max2k]

@ mlance, sorry about that, i uploaded the wrong user.ini file (twice i think edit: 3 times ). try it again (refresh the page first just incase): http://www.inaudible.co.uk/temp/st7g...HoA%20user.ini

i've fixed a few things on it including getting rid of any stuff relating to me which shouldn't have affected stuff much anyway, but i've removed a few security problems too (including no defualt users, no wan spoofing, no dsd).

to get it working for Be* you just need to rename it to user.ini, restore it (preferably to a router reset to defaults bar the root user hack), and you should get sync and internet within a minute or so. user name is "root" and password is "admin", change at least one of these as soon as you can. it's preferable to using the thomson template as bt have a load of bt specific stuff in there, and of course my security fixes are in the template too

@Carl2brum, if you want to use the dect handset you'll have to keep the bt firmware (6.2.2.6 is good). check out this site for further details on what you need to do (in the howto section) http://homehubhacks.co.uk/ to flash and config things. i'm gonna add a section with links to all the specific firmware tools / files in a few days though so you might wanna wait for that.


@everyone else, someone from speedtouchforum.de is kindly working on getting a bridge mode with voip working on the 7G, eg. pass wan ip + everything else through to a second router, then connect it back to enable voip on the home hub. it'll be handy if you want to use a second much more able router for all the routing work (i use a wrt54g) and still have a cheap voip ata and adsl2+ solution. not sure if they'll manage to get it working yet though, something to do with sip and nat and stun servers, but at the least they should manage the bridging bit. i'll let you know if anything happens...

[ljkenny]

@ Dan

I've told you from the very start that this project is too big for you as a final year degree project. Get yourself a nice Linksys and do your project on that. Even with a Linksys, your project choice is no mean feat.

Oh, and also let me know when you're going to relinquish the BT HH back to me. I want a crack at it myself. If I get something going on it, you can have it back, with all my work and claim it as your own - How's that?
Let me know if you need any help with anything.

[54321dan12345]

@ ljkenny

Its really annoying when you do this, and you can't have it back! its mine and i'll be most put out if you get the damn thing working! might still try jtag before giving up see what that throws up. Also there is alot of support for the UART in the kernel code so might pop it into that tech bloke at uni see if he can solder me a connection to it.

[ljkenny]

@ ljkenny

Its really annoying when you do this, and you can't have it back! its mine and i'll be most put out if you get the damn thing working! might still try jtag before giving up see what that throws up. Also there is alot of support for the UART in the kernel code so might pop it into that tech bloke at uni see if he can solder me a connection to it.

Originally Posted by 54321dan12345

You love it!

That's ok, I'm getting one off of a friend. He's sending it to me on Monday.

So, the race is on fat-man.

HINT: Don't worry about UART. Can you see the solder marks on the board? Well that's where I soldered -- Hang on! I think I left it on there. Aren't the pins still on the board? Anyway, it leads nowhere. I'll email you the output if you like?

[mlance]

@ mlance, sorry about that, i uploaded the wrong user.ini file

Originally Posted by pepsi_max2k

You tell me this NOW?

Seriously though, I've just loaded the new version and it seems to be working fine. Top bannana!

A couple of observations in the spirit of collaborative effort:

1. Renaming the file doesn't seem to be necessary.

2. I made a couple of minor mods before trying it. The main thing I did was to take out the blank WEP key. I think I'm right in saying that if you just leave the line out altogether it'll leave whatever settings were in there from the base 6.2.2.6 configuration. It's not necessary to define everything. I also took out the wireless SSID for the same reason. (You could call it BeBox. ) By leaving the settings to what they were, it saves having to reconfigure all the clients to find a new access point.

[pepsi_max2k]

>> You tell me this NOW?

sry, only found out about it yesterday evening, upped a new one, then realised today it was messed up too they were all good though, just with either no ethoa or a few security fixes left out.

>> if you just leave the line out altogether it'll leave whatever settings were in
>> there from the base 6.2.2.6 configuration

thanks for the tip. i'll prolly leave it as is anyway, just incase anyone forgets what the previous ssid/key were and haven't the nounce to find it in the config page again. and even i have problems finding stuff in that lot

[mlance]

thanks for the tip. i'll prolly leave it as is anyway, just incase anyone forgets what the previous ssid/key were and haven't the nounce to find it in the config page again. and even i have problems finding stuff in that lot

Originally Posted by pepsi_max2k

Well it's a matter of taste, but I think it is easier leaving the WEP code to be the one on the back of the router! Assuming that one left the homehub on default wireless settings in its sad life prior to becoming a BeBox, then that's probably going to be the settings in clients such as the missus's laptop.

I have just got a hubhome for free, iv tried using the bt upgrade tool to upgrade to the speedtouch firmware but it keeps saying teh router has stopped responding and fails, iv tried over 100 times but cant get anywhere I want to use this with sky broadband can anyone help point me in teh right direction?

[Austin_KW]

I have just got a hubhome for free, iv tried using the bt upgrade tool to upgrade to the speedtouch firmware but it keeps saying teh router has stopped responding and fails, iv tried over 100 times but cant get anywhere I want to use this with sky broadband can anyone help point me in teh right direction?

Originally Posted by Psyion

Turn off your security sofware; firewall, antivirus etc as it can effect the transfer timing.

[pepsi_max2k]

you set a static ip /subnet on your pc didnt you? 192.168.1.100 / 255.255.255.0 ?

[moog]

I was having a look at 6.2.6c and whilst all the functions still seem to be there telnet is just disabled.
Should be simply a matter of backup restore config to re enable but admin account doesnt have the rights. Anyone got an idea what the root user and password is since 6.2.6c?

A while back someone had connected a TTL serial port, can you still get CLI access since 6.2.6c this might give us the username at least

[pepsi_max2k]

>> Should be simply a matter of backup restore config to re enable but admin account doesnt have the rights.

does ftp upload not work? and is it the tech user you need to get the password for? i think there used to be a 1234 password the overwrote anything else.

edit:
user: tech
password: 12345678
? meh no wait they deleted the tech account didn't they... ah well. that would mean there is no super user account left? just admin, BT_Basic_GUI_User and mayber Administrator?

maybe some of the exploits still work? http://www.gnucitizen.org/blog/bt-ho...-bt-home-hub-4 like double slash auth bypass.

[moog]

no the tech details were a big part of exploit if you want to see what I mean try

http://192.168.1.254/cgi/b/bandr//

it asks for username and password but will not accept admin account need the root account details. The web content is still there but not accessible with admin account

[moog]

I wondering if console access is still availible since 6.2.6c via serial cable and if this is enough to enable telnet/FTP or up access rights for admin account



Serial port pinout (P2)

1 = GND 2 =TX 3=RX 4=3.3V

DB9 pin 2 Receive
DB9 pin 3 Transmit
DB9 pin 5 Base Signal ground

Both picture and pin outs availible from http://www.homehubhacks.co.uk/index.php?n=HHH.Hardware

[pepsi_max2k]

Has everyone else got a bug where, when voice profile port is set to FXS, picking up the fxs port phone on an incoming pstn call just hangs up the call straight away? It doesn't happen when I have it set to COMMON, but then the telephony stats list every other device as missing a call when it's answered by fxs.