Unlocking BT Home Hub V1 *Upgrade at your own risk*

[andyh1108]

ahh, so now BT have finally decided to give the FULL code for 6.2.2.6, will this mean those clever little chappies out there will be able to run rampant over the code and give us a home hub worth having <g> ...... or is that a double negative .......... like anyone would ever own up to having one

[sportq]

ahh, so now BT have finally decided to give the FULL code for 6.2.2.6

Originally Posted by andyh1108

I've downloaded the code and had a browse. It does not look complete to me - although maybe all the GPL code is now there.

I don't see any tools to build the firmware image from the linux kernel, uClib, samba and busybox. Also the web admin pages are not there, but i can understand those being missing as they're probably not under any obligation to supply them.

In fact, all that's been added since the 6.1.1.R release is the busybox and uClib config files.

The code is in the same place as before:

http://www.btyahoo.com/broadband/adh...s/gplcode.html

Pete

[NewDayNewID]

The BT Home Hub contains code that is covered by the GNU General Public License (GPL). In accordance with the GPL, BT makes the relevant code available for download below.

To me this means that all the useful BT stuff is non-GPL.

Wow, you guys are wizards !!
I bought a home hub for a (computer illiterate) friend last week, then realised their ISP was Tiscali and mine is BT. Obviously the internet light wouldnt come on, but broadband and wireless lights were fine (and data light when connected via ethernet). My only question is, if i have BT Internet, and a home hub, would it be possible for me to get this unlocked (as a BT user) and then give it to my friend, while using the other 'locked' one myself ?

I know, i know, im retarded for buying it in the first place, but please help !

Thanks so much for all the info ive already got from this thread.

SensiCat

[sportq]

My only question is, if i have BT Internet, and a home hub, would it be possible for me to get this unlocked (as a BT user) and then give it to my friend, while using the other 'locked' one myself ?

SensiCat

Originally Posted by Sensicat

If you did manage this, you would be the first.

Not saying it's not possible, just that nobody else has claimed to have convinced BT to do it.

-Pete

Not saying it's not possible -Pete

Originally Posted by sportq

Thanks pete, Ill soon find out. Ill give them a call tonight and see what i can get out of them, my understanding of routers etc is ok but ill play the dumb card and see if that gets me anywhere, until i get hold of someone who actually knows what they are talking about anyway. Ill let you guys know if my 2nd hub ends up as a doorstop or a fully operational Tiscali router !!! (IMO they are both pretty useless lol, but im with BT, what do i know !!)

[florin_m]

Hi!
I've managed to flash the BT Home hub with the SpeadTouch 7G firmware. It works but not 100%. Seems that after flashing the kernel, the router need to flash one more part(ZZN0AA6.196 size 2.910417). If you connect to ftp you'll find this file in the DL directory also in active directory + 1 file start.cmd (this is inside that file: /active/ZZN0AA6.196).seems is fail as this file has BANT-7 in header. This file starts withSI223QQ0 and not with BLI223QR0 like the other file. Working to hack the header on this one too.
The router works, but without the wifi and the DECT phone.

Phone tricks:
1.press red button to switch phone off.
press power and hold press * on the phone -- factory default.

2.press red button to switch phone off.
press power + "-" left key. Now the phone it will show Test Mode.
Press 5 to UNregister the handset from the HUB
If you press 4 the phone goes in upgrade mode!??! Don't try. I nearly bricked my handset.

That's it for now.
PS. Can you send me that php file to decrypt the file from "archive" folder please?

[marble]

Interesting ... what did you do to get the thing to flash? When you say 'hacking the header', is that more than changing the 'BANT-Z' bit to 'BANT-7'?

I had an attempt at this a while back, but the hub got 90% through flashing and then failed with an error. The hub wasn't bricked it iny way, and I just flashed back the BT firmware.

Once you have flashed this firmware, are you able to telnet into the hub? I suspect if you can telnet in or ftp in, we might be able to do some more clever things (I think if you telnet in, there is a command called 'shell' to get to a Linux shell ... though this is locked in a BT firmware).

Al

[florin_m]

seems in not such command shell. (I've added the output of help all output)
How to call it?
seems wifi works with the 6.1.9.6 firmware but i can't make the DECT working at all
I've opened the router and made a dump of the eeprom (24c64) and i've opened the dect phone and i'll read the eeprom (24c128) and the flash chip. I'll try to read also the flash chip from the router and see what else is inside.
Unfortunately I'm so busy this days, that i hardly have time for researches .

I can telnet it in it no problem.Is fully functional (tested on eclipse adsl and works fine. Only i can't pair the DECT phones to it ) Also i have the serial port connected, but is just like the telnet . On this firmware the serial output starts at 115200 and then when the new firmware starts need to switch to 9600. On bt firmware it stays on 115200 all the time.

Is it possible to get a dmesg?

[ixulai]

Is it possible to get a dmesg?

Originally Posted by Anonymous

debug dmesg

debug dmesg

Originally Posted by ixulai

Sorry - I retired my homehub for a sparc64 running OpenBSD/pf. I was just interested in seeing what it's running, and someone pasting a dmesg would be fantastic.
Thanks

[ixulai]

Sorry - I retired my homehub for a sparc64 running OpenBSD/pf. I was just interested in seeing what it's running, and someone pasting a dmesg would be fantastic.
Thanks

Originally Posted by Anonymous

Ah, sorry. Check out http://mikenelis.net/bthomehub/
There is a link to the dmesg output there (Boot log link)

[cjsharky]

Is my thinking way below the required level or would there be any mileage in examining the IPChains info contained in the FTP dumps? It seems fairly obvious to me at least that there would need to be an entry there to allow the remote management techs (I.E. the ones who can remote on and 'unlock' the router) in. Altering this to point to the LAN IF and port scanning before and after might reveal some useful info? Also, has anyone done any investigation of the URL, username/password combos in the various files from the FTP dump?

Hi
Can anyone tell me how I disable samba/smb on the homehub? Until I can replace the POS I'm using it as a glorified ADSL modem and want to disable as much as possible (the netbios probes from the hub every 2 minutes are really polluting my logs).
Any help on disabling samba would be much appreciated.
Thanks

[Zenith]

Hi!
I've managed to flash the BT Home hub with the SpeadTouch 7G firmware. It works but not 100%. Seems that after flashing the kernel, the router need to flash one more part(ZZN0AA6.196 size 2.910417). If you connect to ftp you'll find this file in the DL directory also in active directory + 1 file start.cmd (this is inside that file: /active/ZZN0AA6.196).seems is fail as this file has BANT-7 in header. This file starts withSI223QQ0 and not with BLI223QR0 like the other file. Working to hack the header on this one too.
The router works, but without the wifi and the DECT phone.

Originally Posted by florin_m

florin_m, are you able to provide a step-by-step "howto" of how you got the HH to operate as an unlocked router please?
Wifi would be handy so if you've got that going, could you also "howto" that as well.
I can live without the phone tbh.

[vstar]

cjsharky - I doubt it! Is there any solid evidence that BT have actually unlocked one yet? I would guess that the units are 'locked' due to the firmware being written in such a way that it will only accept BT user ids.
I really doubt that they can be 'unlocked' by BT staff, after all why would they do that? Why lock it in the first place then?
Have any other of their units ever been unlocked by them? Not that I've read, it's all been down to reflashing standard firmware into them.
We need to keep hacking the BANT firmware until we get it to work...

I second Zeniths call - Any chance of a 'how-to' from florin_m???

Hi Everybody,
I have a BT Home hub that i got cheap on ebay, that has 6.2.2.6 installed. I am with another provider and I have managed to get the voip working via another router. this is how I done it.

1) telnet into the home hub with a account with superuser privs.
2) go into IP and use rtadd to add a route to 0.0.0.0 using your default gateway on your other router using the LocalNetwork option - delete any other 0.0.0.0 routes.
3) go into DNS CLIENT and then add a external dns server.
4) Disable dns Spoofing within the CONFIG of DNS SERVER - you might want to add tracing for debugging later.
5) go into DNS SERVER ROUTE and add a route to the external dns server on the local Network.
6) go into VOICE and change the Interface in config to Local Network.
7) go into SYSTEM and change the defaultconnection to Local Network.
8) check the home hub is allowed access to the internet through your other routers firewall port 5060 for voip.

This allows the Voip to register ok.

Top tip try using Ctrl +Q within the telnet session. debugging

hope this is of some help

[florin_m]

Hi guys,
Not had time to do anything this days as i just moved house .
I'm travelling also from Friday till 16. When I'll back , I'll resume. I have a idea how to fix the dect too.Seems the dect is looking for a special DECT id (that's why other Dect phone not working with the bt home hub and also the dect phone not working with other dect stations). I've extracted all firmware and eeprom needed to reflash the dect handset with the generic one too . When i'm back i'll try to make sure all ok. Then my work is complete.

Hi Everybody,
I have a BT Home hub that i got cheap on ebay, that has 6.2.2.6 installed. I am with another provider and I have managed to get the voip working via another router. this is how I done it.

1) telnet into the home hub with a account with superuser privs.
2) go into IP and use rtadd to add a route to 0.0.0.0 using your default gateway on your other router using the LocalNetwork option - delete any other 0.0.0.0 routes.
3) go into DNS CLIENT and then add a external dns server.
4) Disable dns Spoofing within the CONFIG of DNS SERVER - you might want to add tracing for debugging later.
5) go into DNS SERVER ROUTE and add a route to the external dns server on the local Network.
6) go into VOICE and change the Interface in config to Local Network.
7) go into SYSTEM and change the defaultconnection to Local Network.
8) check the home hub is allowed access to the internet through your other routers firewall port 5060 for voip.

This allows the Voip to register ok.

Top tip try using Ctrl +Q within the telnet session. debugging

hope this is of some help

Originally Posted by IanC

Would you be able to give the exact commands you used as I would be intrested in doing this, I want to use my Netgear router as the ADSL Modem and have the HomeHub just as a VOIP gateway,

Regards

Okay guys I have been following this thread for a while now and there still seems to be no firmware to unlock this router. I found this on the web and I don't know whether this works or not as my hub has not arrived from ebay yet

Intitally I started off with the first section as posted by Spanna elsewhere, that didn't work directly so I've followed spanna's instructions with those I then found worked. Can't see any reason why this modem won't work with pretty much any network. You may need settings off your ISP. Also connact 2wire tech support who are helpful, if a bit slow



Connected BT1800HG router with network cable supplied from network port on PC to network port 1 on the router.



Connected Router to phone socket using telephone cable supplied and filter



opened internet explorer went to tools-internet options-connections and changed it to Never dial

connection



then in the address bar type in gateway.2wire.net



this brought up the 2wire menu.



On the screen was a button that said "setup wizard" click on that and it askes for an activation code, 522P-22P4-A222-22AT-F24N is PPPOA (UK standard) and works for many ISP (Internet service providers)



Then it asked for a user name and password which you must enter and then the main computer should then access the internet



This is known to work with Tiscali and Bulldog, other ISPs might need different setting, but try these first.



For other wireless computers install you Wireless card/usb etc as needed Started the config software that had been installed found the option to set WEP security and input the required code - This is found on the bottom of the router. The number above the the bar code is the serial number and the number below the bar code is the WEP code. (There were 2 options for inputting the WEP code Hexadecimal and Ascii )





For Onetel see codes below. If the first instructions don’t work, call your ISP and get the vpi vci and ask if they use pppoa, then insert as required.





Use 5225-2374-WG62-22AS-BJ7P for the key code this is a manual set up key code



Go to Advanced set up

vpi 0 (for onetel other ISPs may differ)

vci 38 (for onetel other ISPs may differ)pppoa choose that (unless your ISP uses one of the other options)



Then there is a drop down menu near that area, try each of these in turn until you get a connection.



Of course you must put in your user name and password as required

[AdamG]

The BT1800HG isnt the BT HomeHub

[AdamG]

Hi Everybody,
I have a BT Home hub that i got cheap on ebay, that has 6.2.2.6 installed. I am with another provider and I have managed to get the voip working via another router. this is how I done it.

1) telnet into the home hub with a account with superuser privs.
2) go into IP and use rtadd to add a route to 0.0.0.0 using your default gateway on your other router using the LocalNetwork option - delete any other 0.0.0.0 routes.
3) go into DNS CLIENT and then add a external dns server.
4) Disable dns Spoofing within the CONFIG of DNS SERVER - you might want to add tracing for debugging later.
5) go into DNS SERVER ROUTE and add a route to the external dns server on the local Network.
6) go into VOICE and change the Interface in config to Local Network.
7) go into SYSTEM and change the defaultconnection to Local Network.
8) check the home hub is allowed access to the internet through your other routers firewall port 5060 for voip.

This allows the Voip to register ok.

Top tip try using Ctrl +Q within the telnet session. debugging

hope this is of some help

Originally Posted by IanC

I managed to get this to work as well, the exact commands for anybody else intrested in doing this are below.

:ip rtadd dst=0.0.0.0 gateway=192.168.1.1 intf=LocalNetwork
:dns client dnsadd addr=192.168.1.1
:dns server config WANDownSpoofing=disabled
:dns server route add dns=192.168.1.1 intf=LocalNetwork
:voice config intf=LocalNetwork
:system config defaultconnection=LocalNetwork
:config save filename=user

Obviously you will need to change 192.168.1.1 to the IP of your router and make sure you have the correct IP subnets, hope this helps.

[AdamG]

Got it working now telephony wasnt enabled lol.

[slime]

Thanks for the info - will try tomorrow.

A couple of quick q's for you guys though...
1) Does the "phone" light show lit up now?
2) Are you also on latest f/w as I still have 6.1.1.R?

Thanks,
Slime.

[Alex Atkin]

Interesting. I know I wouldnt mind losing the use of the supplied DECT handset so long as normal DECT handsets could be used for at least basic functionality (ie making phone calls). Personally all I want is to replace the router with a combined router a DECT base station to save space. VoIP would be a nice bonus but not essential.

Is all the above doable now? I was under the impression DECT didnt work because of missing firmware for that part of the router. Was this disproved and instead its the ID problem, merely that the base station no longer accepts the handset (or the other way around)?