Unlocking BT Home Hub V1 *Upgrade at your own risk*

[Ben Dover]

I have got the files for flashing for th home hub from hubhacks but it finds the hub starts flashing and then fails about 20% in. Anyone got some suggestions.

Thanks

Originally Posted by Blade007

I think I used the the 6.2.2.6 f/w from the link to the zip file here,
http://www.homehubhacks.co.uk/index.php?n=HHH.Firmware
I didnt have to 'button' it into program mode at all, just ran the recovery tool while the lights were green and it went off and did it's thing !

[ramrod]

I think I used the the 6.2.2.6 f/w from the link to the zip file here,
http://www.homehubhacks.co.uk/index.php?n=HHH.Firmware
I didnt have to 'button' it into program mode at all, just ran the recovery tool while the lights were green and it went off and did it's thing !

Originally Posted by Ben Dover

have you unlocked the v1.5?

[Ben Dover]

I'm just about to try loading that version of firmware that Wheel_nut put on here yesterday. I dont hold out much hope though
Succesfully got PCanywhere working over the internet through my router today though, so maybe things are looking up

[Ben Dover]

Ah what a surprise...........it didn't work !
I hex edited the QRO bit and the Bant-z and then I tried it while the box was still at 6.2.6c - but I got the 'authorisation failed' again. I then 'recovered' it to 6.2.2 ( which is never a problem ? ) and I then get 'failed..........device booted in wrong mode'
You can see it's going to fail right away as the upgrade light flashes much quicker than when in recovery mode ( unless thats a red herring )

[a18041967]

Some interesting findings...

I have been trying to hack my Home Hub V1.0 and had all the problems and successes that other people have experienced.

Today I managed to get hold of a new Home Hub V1.5 and this shipped with firmware V6.2.6b and this worked in exactly the same way as the V1.0, it would accept any other userid or password. I didn't try hacking this in anyway, instead I tried upgrading it to the latest V6.2.6e and suddenly there's a surprise it now accepts my plus.net account details and works perfectly.

There's a few things to note:

* I'm not sure if only plus.net accounts are accepted, plus.net are now part of BT, someone may have to try other ISP details.

* DHCP seems to have improved, my DNS settings are retained and are now correct.

* Telnet is not enabled.

* The remote admin (tech) account is no longer available, this is disappointing.

* I've not found a way to change the SIP / Home Hub settings, these were done using the tech account & telnet.

So in summary if someone can load 6.2.6e it maybe a way to use the hub with other ISP's

[moog]

6.2.6e firmware here
http://static.btopenworld.com/broadb...overy_626E.zip

Shame about the lack of telnet as it might be that you have a cleared simlock file

on the router under 6.2.2 that connects to plusnet can you run
ppp
simlock
it should list the domains that the router will connect to via ADSL

[a18041967]

6.2.6e firmware here
http://static.btopenworld.com/broadb...overy_626E.zip

Shame about the lack of telnet as it might be that you have a cleared simlock file

on the router under 6.2.2 that connects to plusnet can you run
ppp
simlock
it should list the domains that the router will connect to via ADSL

Originally Posted by moog

Not sure what / how to check the ppp simlock, my V1.0 hub would not connect to plus.net with the standard firmware, worked OK with the hacked.

The V1.5 Hub had V6.2.6.b firmware and the remote access menu was still available, but this didn't support other ISP's.

It would be interesting to find and test V6.2.6c & d to see if either of these are unlocked and still have the remote access menu.

[Wheel_nut]

Has anybody tried the BT 6.2.6.e Firmware on a HH V1.0? It would be interesting to know whether this works with other ISPs.

[Ben Dover]

just recovered my V1.5 to the latest BT 6.2.6.E firmware

Recovery was successful ( with a non fatal error "failed to authenticate" .....due to my Tiscali ADSL being disconnected at the time I assume )
I was immediately forced to change the logon password from it's serial number to something new ( Mine is CP0XXXEHXXX ....that's CP zero not the letter o as that's already caught a few folk out on other forums )
I then logged on with user = admin / password = new password
Still cant get it to authenticate my details on my Tiscali ADSL tho' ( shock horror )
It also appears to reset itself completely whilst trying to sign on to the 'wrong' ISP

Ho hum.............Even I've got better things to do on a Friday

[moog]

I was running 6.2.6e prior to ISP move and no it will not accept a domain that is not in the simlock file. You can normally see the simlock file via ": ppp simlock" however since 6.2.2.6 telnet was disabled. Once I have downgraded the firmware (6.2.6e -6.2.2.6) the simlock file has the usual domains see below

------------------------------------------------------------------------

______ BT Home Hub
___/_____/\
/ /\\ 6.2.2.6
_____/__ / \\
_/ /\_____/___ \ Copyright (c) 1999-2006, THOMSON
// / \ /\ \
_______//_______/ \ / _\/______
/ / \ \ / / / /\
__/ / \ \ / / / / _\__
/ / / \_______\/ / / / / /\
/_/______/___________________/ /________/ /___/ \
\ \ \ ___________ \ \ \ \ \ /
\_\ \ / /\ \ \ \ \___\/
\ \/ / \ \ \ \ /
\_____/ / \ \ \________\/
/__________/ \ \ /
\ _____ \ /_____\/
\ / /\ \ /___\/
/____/ \ \ /
\ \ /___\/
\____\/

------------------------------------------------------------------------
_{Moog}=>pp simlock
List of allowed isp domaines.
@hg0.btclick.com
@hg1.btclick.com
@hg2.btclick.com
@hg3.btclick.com
@hg4.btclick.com
@hg5.btclick.com
@hg6.btclick.com
@hg7.btclick.com
@hg8.btclick.com
@hg9.btclick.com
@hg10.btclick.com
@hg11.btclick.com
@hg12.btclick.com
@hg13.btclick.com
@hg14.btclick.com
@hg15.btclick.com
@hg16.btclick.com
@hg17.btclick.com
@hg18.btclick.com
@hg19.btclick.com
@hg20.btclick.com
@hg21.btclick.com
@hg22.btclick.com
@hg23.btclick.com
@hg24.btclick.com
@hg25.btclick.com
@hg26.btclick.com
@hg27.btclick.com
@hg28.btclick.com
@hg29.btclick.com
@hg30.btclick.com
@hg31.btclick.com
@hg32.btclick.com
@hg33.btclick.com
@hg34.btclick.com
@hg35.btclick.com
@hg39.btclick.com
@hg40.btclick.com
@hg42.btclick.com
@hg43.btclick.com
@hg44.btclick.com
@hg45.btclick.com
@hg46.btclick.com
@hg47.btclick.com
@hg48.btclick.com
@hg49.btclick.com
@hg50.btclick.com
@hg51.btclick.com
@hg52.btclick.com
@hg53.btclick.com
@hg54.btclick.com
@hg55.btclick.com
@hg57.btclick.com
@hg58.btclick.com
@hg60.btclick.com
@hg61.btclick.com
@hg0.btinternet.com
@hg1.btinternet.com
@hg2.btinternet.com
@hg3.btinternet.com
@hg4.btinternet.com
@hg5.btinternet.com
@hg6.btinternet.com
@hg7.btinternet.com
@hg8.btinternet.com
@hg9.btinternet.com
@hg10.btinternet.com
@hg11.btinternet.com
@hg12.btinternet.com
@hg13.btinternet.com
@hg14.btinternet.com
@hg15.btinternet.com
@hg16.btinternet.com
@hg17.btinternet.com
@hg18.btinternet.com
@hg19.btinternet.com
@hg20.btinternet.com
@hg21.btinternet.com
@hg22.btinternet.com
@hg23.btinternet.com
@hg24.btinternet.com
@hg25.btinternet.com
@hg26.btinternet.com
@hg27.btinternet.com
@hg28.btinternet.com
@hg53.btinternet.com
@hg54.btinternet.com
@hg55.btinternet.com
@hg56.btinternet.com
@hg60.btinternet.com
@hg62.btinternet.com
@hg63.btinternet.com
@hg64.btinternet.com
@hg65.btinternet.com
@hg95.btinternet.com
@hg96.btinternet.com
@hg97.btinternet.com
@hg98.btinternet.com
@hg99.btinternet.com
@btbroadband.com
@btinternet.com
@btclick.com
@teleworker
@speedtest_domain
@startup_domain
@dataone
@touchtelindia.net
@redcare.btclick.com
@t0_btopenworld.com
@t1_btopenworld.com
@t2_btopenworld.com
@t3_btopenworld.com
@t4_btopenworld.com
@t5_btopenworld.com
@t6_btopenworld.com
@t7_btopenworld.com
@t8_btopenworld.com
@t9_btopenworld.com
@service.btclick.com
@rtman.btretail.net
@qosa-btbroadband.com
@airtelbroadband.in
@rednet
@fast
@skynet
@fti
@XS4ALL
@local

[moog]

Yeah I got th 1000th post in, sad thing is I have read it all

[Memfis]

This thread has beaten 'The "new" Is There a 'Longest thread Record?' thread designed to be the longest thread

here are some sources so you can download the Thomson 7G firmware

www.inaudible.co.uk/temp/st7g/ - but of course you don’t know where he got his images….

download.modem-help.co.uk/ - nor where they got theirs.

mirror.opensourcehub.com/pub/speedtouch/routers/ - a fantastic resource from “m8s, ikitty & chick”, but again not an official Thomson site.

Fully trusted images from approved Thomson sites proved to be difficult to find. Thomson does not seem to provide much support directly to the public, preferring to leave partner sites around the world to provide documentation, support and software. I found the Thomson partner sites below of most use:

download.routerspt.com/ - provides a range of images for various Thomson routers

http://www.thomsontelecompartner.com...ways/products/
product-detail.php?id=118 - these guys provide a good range of both software and documentation. I have used them for details about the ST780WL. Unfortunately, it looks as if you now have to register as a Thomson Partner in order to gain access to the site.

www.speedtouch.nl/documents.html - the site is in dutch, but the referenced documentation (which is extensive) is available in english.

and of course the UK based site

courtesy of

http://baldric.net/reflashing-the-bt...om-a-linux-pc/
(don'y worry about the Linux bit)

JTAG question:

Is there any details about using JTAG with the HH? All I've managed to find is moog & fruittool's comments on page 53 here.

It's my first attempt at attaching a JTAG (before I move onto more expensive toys!), and I dont seem to be having much luck

I'm using the circuit from http://www.aibohack.com/zipit/serial.htm and I have no idea if it works!! Am I right in thinking that once the cable is attached I should get at least something, over a serial console? Or am I missing a step?
Moog/fruittool, could you briefly run through what you did and at what baud rates?

Thanks in advance.

[moog]

JTAG question:

Is there any details about using JTAG with the HH? All I've managed to find is moog & fruittool's comments on page 53 here.

It's my first attempt at attaching a JTAG (before I move onto more expensive toys!), and I dont seem to be having much luck

I'm using the circuit from http://www.aibohack.com/zipit/serial.htm and I have no idea if it works!! Am I right in thinking that once the cable is attached I should get at least something, over a serial console? Or am I missing a step?
Moog/fruittool, could you briefly run through what you did and at what baud rates?

Thanks in advance.

Originally Posted by Denver

I understand that the baud rates depend upon the firmware already installed, from memory BT use 11500:n:1 and thomson use 9600:n:1 see post #99 http://www.the-scream.co.uk/forums/t22917-7.html that being no parity and one stop bit. Here is the software that "fruit tool" was using for the JTAG http://rapidshare.com/files/91720916...ag_flasher.rar however you might be better using some info from this 585 JTAG site http://forums.whirlpool.net.au/forum...s.cfm?t=896070 as they have a later version of hairymaid's util.

Just to confirm we are on the same page the serial circuit you have should will give potential access to CFE and what you would get via telnet but not JTAG. The JTAG lead just requires some resisters in series to drop the voltage down see Hairy maid PNG picture and PDF in "fruit tool" BTHH_jtag_flasher rar.

Thanks Moog, everything makes a lot more sense now.

So the JTAG is the 5 little pads in the center of the board. Which one is which? I presume that the one outside the printed white box is GND? Do the others follow on in the same order as written in jtag-hairydairymaid.png? Did you find this by trial and error or is there some way of working it out?

Thanks for your patient explanations!

[moog]

Thanks Moog, everything makes a lot more sense now.

So the JTAG is the 5 little pads in the center of the board. Which one is which? I presume that the one outside the printed white box is GND? Do the others follow on in the same order as written in jtag-hairydairymaid.png? Did you find this by trial and error or is there some way of working it out?

Thanks for your patient explanations!

Originally Posted by Denver

"5 little pads" Ha you wish, no P3 is JTAG, found between P2 serial port ( four holes on side of board) and PCMCIA connector

See post 186,187 this forum http://www.the-scream.co.uk/forums/t22917-13.html?

parallel port - signal - connection
18 - TDO - TP32
2 - TDI - TP33
4 - TMS - TP34
3 - TCK - TP35
20 - ground
25 - ground


Close up picture http://rapidshare.com/files/91817089/P1010053.JPG

However mine is not working at the moment so worth checking your own connections

[abrown0007]

Moog

How did you manage to downgrade from 6.2.6e as when i try it says authentication failed

[moog]

Had to reset back to factory defaults then type in the serial number of back of router then it would flash. Pain in the AR5E really

Hi there - been trying to downgrade my 6.2.6B homehub to the Thomson 7G hub so that I can use it with pipex... sorry for being slow, but I gather I have to downgrade it to 6226 first, then downgrade again to 7G.

Does anyone have a working link to 6226? I've downloaded it from previous links but it keeps saying the application failed to start because qt-mt322.dll was not found. (it is right there in the folder) - do I need to do anything extra to make that application run?

So I haven't even managed to downgrade to 6226, not to mention the second downgrade...

My firewalls are off and i've connected the ethernet cord correctly...

My computer is new and I haven't installed any software that bt gave with the homehub - presumably i dont have to do this?

sorry for basic questions.. computers not my forte and i've spent hours trying to figure this out!! thanks!!

[Ben Dover]

Hi there - been trying to downgrade my 6.2.6B homehub to the Thomson 7G hub so that I can use it with pipex... sorry for being slow, but I gather I have to downgrade it to 6226 first, then downgrade again to 7G.

Does anyone have a working link to 6226? I've downloaded it from previous links but it keeps saying the application failed to start because qt-mt322.dll was not found. (it is right there in the folder) - do I need to do anything extra to make that application run?

So I haven't even managed to downgrade to 6226, not to mention the second downgrade...

My firewalls are off and i've connected the ethernet cord correctly...

My computer is new and I haven't installed any software that bt gave with the homehub - presumably i dont have to do this?

sorry for basic questions.. computers not my forte and i've spent hours trying to figure this out!! thanks!!

Originally Posted by Guest James

Morning

I used the recovery files and firmware in the zip file from here
http://www.homehubhacks.co.uk/index.php?n=HHH.Firmware
scroll down to the firmware 'grid' and select 6.2.2.6 from the left hand column
Not sure now if I tried the 1.m and r files ( I imagine so though )
I cant get any of the 'upgrade' files to work and can only get the box to respond successfully by using this 'recovery' procedure ........where it will happily upgrade or downgrade to BT firmware every time !

[abrown0007]

I have tried various downgrades with BT recovery but right at the end it say authentication failed. I do not have it connected to ADSL line as i plan to use this a bridge. Just cannot understand why it keeps failing.

Any ideas would be appreciated

Alan

[Ben Dover]

I have tried various downgrades with BT recovery but right at the end it say authentication failed. I do not have it connected to ADSL line as i plan to use this a bridge. Just cannot understand why it keeps failing.

Any ideas would be appreciated

Alan

Originally Posted by abrown0007

Your not getting the same error as I mentioned on post No 999 are you ??..........cos thats the ADSL failing and not
the upgrade ( teaching granny to suck eggs maybe .........blush )

I've just recovered mine back to 6.2.2.6 using the zip file off that page I mentioned a couple of posts ago ?
I screwed it up this morning by trying to load the .11m firmware off the same page ....just for a laugh
You must use the 'recovery' installer to do it ...........cos I cant get any of
the 'upgrade' installer packages to work at all !!
I take it you are getting 99% of it going ok, so your physical connections and IP settings must be ok ?

Silly question - but how do you use recovery instead of upgrade? all the exe files from the link you sent indictae that it's for upgrade...

Silly question - but how do you use recovery instead of upgrade? all the exe files from the link you sent indictae that it's for upgrade...

Originally Posted by Guest James

actually got the recovery process started but the bt firmware recovery tool just stalls... doesn;t seem to do anything.. is that normal?

[Ben Dover]

When you unzip that zipfile you should end up with a folder called
"BTHHrecover_Win_v55 with 6226" just open that up and double click on the BT logo 'start recovery'.............click next once that opens and it should then 'discover' the HH and carry out the whole recovery itself without any input from yourself !
is your hub in a 'working' state just now or locked up in some weird mode ?
you may have to get it in to 'upgrade mode' to start the recovery - which, unless it's really sick, can usually be achieved by just pressing in and holding the wireless association button until the 'power' LED starts to flash slowly...........release the button run the recovery file as quick as you can at this point and it should 'discover' the HH and then begin the recovery itself
I assume you are set up with a static IP address etc etc

Cheers
Alan ( as well )

Is there a version of the downgrade to 6.2.2.6 tht will work wif macs.. cant find one online... thanks

Hi there,

I have a BT Home Hub and would like to set up my home network as follows:

I have one router that can work as a bridge to receive wireless signal and it will through an Ethernet port pass the data to my BT Home Hub which will then act as a wireless router.

Is this possible?

Many thanks.

[Austin_KW]

To use a home hub as a wireless access point and switch, all you need do is to disable dhcp on the lan setting of the home hub.

If you want to be able to manage the home hub you may have to change the lan IP address of the home hub. Just make sure it has a unique address on the same subnet as your router.

[moog]

Flash software BT
http://rapidshare.com/files/93028088...overy_626C.zip
http://rapidshare.com/files/93026821...overy_6226.zip

Flash images HH to 7G
http://rapidshare.com/files/93027622/ZZMYAA6.196.bli
http://rapidshare.com/files/93027416/ZZN1AA6.196.bli

Flash your home Hub howto
http://rapidshare.com/files/93027131..._A_New_ISP.rar