Unlocking BT Home Hub V1 *Upgrade at your own risk*

[ramrod]

Yes similar problem with the router requiring you to type in the serial number into the web admin then it would flash okay.

You need to do a factory reset
Open the web browser to 192.168.1.254
it shows a new picture of the back of the HH requesting the serial number and ask you to set the admin password.
Now you can reflash as per normal

Originally Posted by moog

hi there, the password with picture refers to later/current BT firmware and not 6226, ive done several resets with no luck...

[ramrod]

Has anyone managed to unlock the new home hub V1.5?

[a18041967]

Well I've read the various post and have managed to upgrade my HH to the unlocked firmware and back to the BT firmware, so far so good.

What I have tried is loading the hacked firmware, I then managed to configure the HH so that it would connect to Plus.NET and configured my SIP account. This all worked and I then saved the configuration, and then reverted back to the BT firmware. I managed to load the configuration all worked expect the PPPoE connection to Plus.NET.

Probably like most here I have a choice, use the hacked firmware and the HUB Phone does not register. Or use the BT firmware but I'm unable to connect to Plus.NET.

I'm not sure if I've missed anything but I'd prefer to use the hacked firmware, has anyone found a way to get the Hub Phone to work.

Or is there a way to enable PPPoA?

Is the phone registration issue due to either the hacked firmware not having support for phones and therefore will never work, or something similar to the wrong identification string, ie the phone cannot see the correct base station. Is there any way to update the phones firmware using the hacked HH firmware, then the two devices would be insync and then hopefully connect.

[a18041967]

Following on from the last post, I have reflashed back to the hacked firmware, PPPoA & SIP all registering and connecting OK. Because I want to use the VoIP features and the Hub Phone does not work I've connect a standard phone to the Hub and changed the SIP port settings from ALL tp Phone1. But.... the calls still use the PSTN line is this another problem, or am missing something, my goal is to use standard handset to may VoIP/SIP calls using the HH.

Can somebody please please tell me what I am doing wrong before I go completely insane !

I have tried to flash the 7G file onto a brand new V1.5 HomeHub, but no matter which way I try it it FAILS ( can it even be hacked ? )
I can 'recover' it from a failed flash no problem and have re-flashed it back down to 6.2.2 6 numerous times no problem ?..........so I know my kit and s/w is ok AND hopefully so are my procedures
I initially tried it at the original 6.2.6.c level but it just gave me an 'authentication error' ?
I have since downloaded the updater / firmware / hex editer from various host sites and followed all the steps ( to the best of my knowledge ) using no firewall or virus s/w and with static IP address etc etc but I just cant seem to get it cracked !!
I have been trying to downgrade it from 6.2.2 to 6.1.1 but that ( and any other firmware I try ) will appear to load but the Hub never 'recovers' and when the loading reaches 100% I get an error message saying installation failed during discovery ?
Please help

[ramrod]

have u seen my post (955) on page 64, are you seeing the same message? im having the same problem with a v1.5. i can load bt firmware fine including 6226 but cant get the 7g flash to fully complete without an error...seems it cant be done or can it??

I paid a fortune for BT internet for 18 months now to find out the homehub is locked and I cant use it with aol. I am not a computer whizz so all this is confusing me can someone please help me configure it.

[ramrod]

I paid a fortune for BT internet for 18 months now to find out the homehub is locked and I cant use it with aol. I am not a computer whizz so all this is confusing me can someone please help me configure it.

Originally Posted by honey

take a look here http://www.homehubhacks.co.uk/index....reToSpeedTouch

[Ben Dover]

have u seen my post (955) on page 64, are you seeing the same message? im having the same problem with a v1.5. i can load bt firmware fine including 6226 but cant get the 7g flash to fully complete without an error...seems it cant be done or can it??

Originally Posted by ramrod

Hi RR

Yes thats exactly what I get too
I'm following the instructions ( as per the link in your last post ) to the letter
and have tried all the different files / updaters / button restart sequences and just get the same result.
I've actually tried renaming the 1.1m and 1.1r files to match those in the 'recovery' packages and that almost has more success ( fails too though )
I've given up for now or it's going to get stood on quite soon

[a18041967]

Two further observations / problems with the Unlocked Home Hub.

1. DNS Settings, I have configured the DHCP range and need the primary DNS server to be my internal server, not the IP address of the HH. No matter how I configure this the primary IP address is always the HH address followed by my prefered. This is not good.

2. HH Phone, I know this does not work, but it also appears not to charge with this firmware.

[Austin_KW]

Two further observations / problems with the Unlocked Home Hub.

1. DNS Settings, I have configured the DHCP range and need the primary DNS server to be my internal server, not the IP address of the HH. No matter how I configure this the primary IP address is always the HH address followed by my prefered. This is not good.

2. HH Phone, I know this does not work, but it also appears not to charge with this firmware.

Originally Posted by a18041967

Can not help with the phone
For the DNS, you can telnet in and use the command line to set the DNS or go to http://192.168.1.254/cgi/b/bandr/?ce...BACKUP_RESTORE and "Backup configuration now"
Then edit the user.ini file and change the dnss section; The following is mine for the opendns servers, just substitute your own addresses. Then restore the edited file. You may want to change the intf for an internal device (I think it is called LocalNetwork)

[ dnss.ini ]

config domain=lan timeout=15 suppress=0 state=enabled trace=disabled syslog=disabled WANDownSpoofing=enabled WDSpoofedIP=198.18.1.0

host add name=speedtouch addr=0.0.0.0 ttl=1200

host add name=dsldevice addr=0.0.0.0 ttl=1200

route add dns=208.67.222.222 src=0.0.0.0/0 domain="" metric=1 intf=Internet

route add dns=208.67.220.220 src=0.0.0.0/0 domain="" metric=2 intf=Internet

[ramrod]

Hi RR

Yes thats exactly what I get too
I'm following the instructions ( as per the link in your last post ) to the letter
and have tried all the different files / updaters / button restart sequences and just get the same result.
I've actually tried renaming the 1.1m and 1.1r files to match those in the 'recovery' packages and that almost has more success ( fails too though )
I've given up for now or it's going to get stood on quite soon

Originally Posted by Ben Dover

ive scoured the net and cant find any mention of the 1.5 being unlocked....

[moog]

Reboot in wrong mode seems to be an issue with some hubs, I'm in the Midlands anyone with the problem near me, I think it would be worth while to get a fix sorted and remote connections are going to be a pig.

[moog]

Two further observations / problems with the Unlocked Home Hub.

1. DNS Settings, I have configured the DHCP range and need the primary DNS server to be my internal server, not the IP address of the HH. No matter how I configure this the primary IP address is always the HH address followed by my prefered. This is not good.

2. HH Phone, I know this does not work, but it also appears not to charge with this firmware.

Originally Posted by a18041967

Point 1
DNS settings if your running either a 2000 or 2003 domain then it would be worth running the DHCP on THE PDC as well otherwise you will have to add each machine to the domain manually and loads of other problems due to schema not being availible to domain computers. You just need to specify the default gateway as being the HH otherwise the PDC will need routing and remote access and another network card too

Point 2
There does seem to be a problem with the HH handsets not charging I ended up with three of the bugas for this reason. Strangely they all started to charge properly after they were wiggled in the socket until they lit up whilst speaking to BT UK support. Dont know if it was the way I wiggle or a plan to get the handset to fail if you moved from BT

As an after thought I remember reading on a HH forum about someone who got BT to remotely unlock their router for other ISPs there was a requirement for it to be still connected to BT at the time and there was some speculation that this is what the KR_UST command did. This post was about a year ago and so when I left BT I asked for the same service but was told they didn't know how to do it. I believe that after the contract is over any kit is yours and hence it would be reasonable to expect to be able to use the kit as you like. So has anyone got any information on the remote unlock of HH by BT so as to be able to retain lastest firmware and handsets with out 7G firmware. I have got mine piggyback on another router at the moment but it would be nice to have the HH with telnet and unlock for none BT ISPs

[moog]

Londonmadness, the Home Hub hasn't been cracked yet, so there's no chance anyone on this forum can help you!

To everyone that's working on unlocking the Home Hub:
I've tried all ways to get back to the page on the BT web site where you can pay to get the Home Hub unlocked, but can't find it. It doesn't really matter now anyway, as i've contacted BT once again about this mysterious page, and got an e-mail back from a member of the support team saying she wasn't sure on where i'd been to get that page, but it is possible to have the Home Hub unlocked remotely by a BT technician for a fee of £45. I was told to phone up BT for more information about this. There's only one small problem with unlocking the Home Hub this way though; you've got to have BT Broadband active on your line.

Originally Posted by Olozzj

here is the remote unlocking reference

[moog]

Some more things found were:

:debug exec commands

^@^@^@^@Execute a 'Trace & Debug' command. For qualified personnel only.^@^@^@^@dmesg^@^@^@Show the Linux kernel messages. For qualifies personnel only.^@^@^@Quoted 'Trace & Debug' command string^@^@^@Execute a 'Trace & Debug' command. For qualified personnel only.^@^@^@Switch to 'Trace & Debug' prompt. For qualified personnel only.^@Switch to Linux shell. For qualified personnel only.^@^@^@^@alg vpn^@ip dt^@^@^@ip lt^@^@^@ip ct^@^@^@ip +t^@^@^@ip -t^@^@^@sea bstats^@^@sea istats^@^@sea pstats^@^@sea clear^@^@^@sea sq^@^@eth stats^@^@^@eth clear^@^@^@eth trace^@^@^@eth tlen^@^@^@^@sachem get_config^@^@^@sachem get_state^@^@^@^@sachem activate_performance^@sachem deactivate_performance^@^@^@sachem get_data^@sachem do^@^@^@tdsl LOVTest^@^@^@^@tdsl LOVTestL1^@^@tdsl LOVTestL2^@^@tdsl LCLTest^@^@^@^@tdsl custoData barometer^@^@^@^@tdsl getData all^@^@^@^@atm otrace^@^@atm sxt^@atm stt^@atm svt^@atm tvc^@atm tlen^@^@^@^@atml stats^@^@atml pstats^@atml gstats^@atml istats^@atml dstats^@atml clear^@^@pptp ctrace^@pptp dtrace^@dbg spt^@dbg rvt^@dbg fvt^@dbg spo^@dbg cpuload^@err stats^@^@^@edm ctrl ^@^@^@edm sit^@edm situation^@^@^@edm start^@^@^@edm stop^@^@^@^@edm otherrxf^@^@^@^@edm getli^@^@^@edm ss^@^@edm setstats^@^@^@^@edm rs^@^@edm resetstats^@^@edm gs^@^@edm getstats^@^@^@^@edm sa^@^@edm setaddr^@mdap trace^@^@mdap search^@voip trace^@^@voip ss^@vdsp fxooffhook^@vdsp tracecodec^@vdsp hci^@^@^@^@voip info^@^@^@vdsp info^@^@^@voip siploglevel^@^@^@^@voip addfilter^@^@voip delfilter^@^@usbhost devs^@^@^@^@usbhost pos^@wld spool^@^@^@wld ssrom^@^@^@wld wlifdata^@^@^@^@wld poolinfo^@^@^@^@wld macevents^@^@^@wld cmacevents^@^@kru st^@^@^M
=====================DISCLAIMER=================== ===^M
Access to expert commands is intended for qualified ^M
personnel only. ^M
==================END=OF=DISCLAIMER=============== ===^M

Its all abit messy as ive taken if from the code directly, the interesting one would be "kru st" purely because it killed my router for a bit until i rebooted.

This command cannot be found anywhere else on the net, ive searched some of the other commands and came up with a list from someone else relating to the old speedtouches.

They can also be found here: http://members.lycos.nl/epias/st510/text/510cli.txt

Originally Posted by zero-x

KR_ust reference

[moog]

Pepsi you want to check this out for all the undocumented commands including Wireless Quality and levels

http://forums.whirlpool.net.au/forum...fm/813746.html

Seem there are still some brains working on the issue

[Ben Dover]

Best of luck lads, I'm off
I only started delving into this as my Bro had swiped my BT Voyager ( to get Wire-less) and gave me his wired D-Link DSL-504 in return . That was all fine till I noticed problems accessing certain sites ( Driver agent and Photobucket to name 2 ) I couldn't see why the D-Link was effectively blocking those while the Voyager had been fine so thought I'd just quickly set up the HomeHub to prove it was deffo the router
Anyway, having abandoned the HH, I managed to resurrect a dead 2700HGV by using the 'hack' also posted on here
( had 3 red leds on solid straight from power up ) ..........but, once set up, it did exactly the same on the websites concerned.
Well at the end of the day the problem seems to just be my MTU settings and the whole HH escapade has just been a frustrating and needless ( if thought provoking ) diversion !
MY PC ( XP sp2 ) is set at 1500 but the D-Link, and the 2700HGV I assume, have defaulted to 1492.
I'm not going to enquire further cos my head is 'nipping' but if I simply tweak the PC to 1492 ..........I'm off and running ??
The HH is now going to be reflashed with the latest BT f/w and thrown through the bro's lounge window
Cheers anyway guys...........it's been emotional

[Blade007]

Not sure if this is in the correct place but I have a home hub and can longer use my work cisco VPN since the update to the home hub not long ago. I have been sent this passage from someone but does any one no how to get this working again.

This is due to a recent update BT made to all home hubs preventing IPsec NAT-T from working through these devices.

Apparently all the options that were there will still be there but BT have probably hiden from the users but should still be able to access via telnet.

I have also been told the cisco VPN use's UDP-500 UDP-4500 and esp protocol 50 if that helps.

Please could someone help.

Thanks

[Ben Dover]

RE. VPN problems

I've no idea what would be involved in making changes via Telnet........but I
imagine that in the meantime you could do a flash 'recovery' back to the previous 'working' s/w or back to the 6.2.2 firmware that is floating about on this thread somwhere.
Hope that helps

[Ben Dover]

I've also been given mine back by my bro, as BT wont or cant even 'release' it to work on a BT Business Broadband line................BT total broadband lines only it would appear

[Blade007]

If I flash is back is there anyway to stop BT automatically updating it again. BT are a bunch of gits I have now also been told BT have disabled being able to telnet into the device. I have now gone and got a Business hub that I have flashed back to 2wire and it seems to work ok for all I need but would still like to solve this as I have several mates at work that still have the same issue.

BT told me to fix the problem caused by there update I had to signup to the home support service which involes me paying them a monthly subscription fee.

Thanks
Dave

[Blade007]

Just to let you know I have my BT home hub at work on the our BT Business Broadband line so I can test and it is working fine. I am sure i just went to advanced them to internet and deleted out the bthomehub@bt***.com and replaced with out business login name and password and clicked connect and it worked fine.

[Ben Dover]

Hi Blade007

Regarding the re-flash. I'm only regurgitating what I've read on here but I think, once you've flashed it back, you can then change the info in it's version of a 'live update' file, to prevent it from 'phoning home' once a week or whatever to check for the latest updates available for itself on the BT website !
All the info is available in this thread somewhere

As regards the HH working on a BH line ..............I think we had the wrong logon details when we tried it in the first place and just called it a day at that point. My bro subsequently called BT and they said NO it wont work on BusBB but they would happily sell him another 2wire router for £79.99
He said yes so I've got it back now and will be waiting on more info to see if anybody manages to crack the V1.5 beastie

[Wheel_nut]

Some empirical observations:

There is a later version of the ST7G Firmware (ZZN1AA6.2T2.bli) which we have been unable to get to work with the HH. It is possible that this Firmware may work with the V1.5 but it will need the Board ID patched to match that of the V1.5 HH.

The HH Board ID is BANT-7. Do you know the ID of the V1.5 Board?

[Ben Dover]

Some empirical observations:

There is a later version of the ST7G Firmware (ZZN1AA6.2T2.bli) which we have been unable to get to work with the HH. It is possible that this Firmware may work with the V1.5 but it will need the Board ID patched to match that of the V1.5 HH.

The HH Board ID is BANT-7. Do you know the ID of the V1.5 Board?

Originally Posted by Wheel_nut

Mine is BANT-Z

I might give it a try. Where can I find the F/W file Wheel_nut ?

[Wheel_nut]

OK, My confusion. The HH is BANT-Z and the ST7G is BANT-7.

Here is the firmware file. You will have to do the Hexedit before flashing it:
http://rapidshare.com/files/88201535...6.2T2.bli.html

[Ben Dover]

Cheers

I've saved that and will have a look at it tomorrow.

[Blade007]

I have got the files for flashing for th home hub from hubhacks but it finds the hub starts flashing and then fails about 20% in. Anyone got some suggestions.

Thanks

[ramrod]

I have got the files for flashing for th home hub from hubhacks but it finds the hub starts flashing and then fails about 20% in. Anyone got some suggestions.

Thanks

Originally Posted by Blade007

Product Name: BT Home Hub 15

Software Release: 6.2.6.B

Software Variant: BD

Boot Loader Version: 2.0.7

Product Code: 36308970

Board Name: BANT-Z

is this any help?