Unlocking BT Home Hub V1 *Upgrade at your own risk*

[jarviser]

.... so I do hope someone can find a way of unlocking it with the relevant firmware. I'd hate to think it wasn't possible.

Originally Posted by Ceefax

It would be nice if BT published a recovery tool for their own V2 hub firmware. If you brick it currently, it stays bricked.

[Chirag88]

Hello there, i wan wondering whether anyone could help me i need to forward a port and need to access my bt homehub advanced configuration but it says

A username and password are being requested by http://192.168.1.254. The site says: "SpeedTouch"

whats the username and password? i'd really appreciate some help

[jarviser]

see http://www.jarviser.co.uk/jarviser/howto1.html#type4

Hello All,
First I would like to thank you 4 guide to unlocking BT hub It really works. I'm happy to say that I've unlocked it succesfully.

But now i econtered a new problem;/

After inserting a broadband cable i tried to connect to internet. Couldn't do it...I've put in correct user name and password to my talktalk line.
There was a message saying that "couldn't establish internet connection: Disconnected by user"
I've tried to change settings with connection setup: I tried routed PPP connection and bridge conection. Nothing...same problem...
Should I change any other settings?

Sorry bout my english and my noob questions but I am not a pro in hub using and network making
I would be very thankfull for easy guide how to resolve the problem.


Regards

eQuInoX

[Landlord]

Hi all
Just wondering if anyone had any ideas yet on unlocking Home hub 2.0 yet.

Cheers

Hi folks,

I bought unlocked BT Home Hub from Ebay.
I have just joined Talk Talk and want to use this for WiFi.
I called Talk Talk because i can get connected to it but cannot load any pages.
They said i needed to call BT for know how on changing the modem settings.
I have settings that require entering......but dont know how to edit them.

How do i adjust home hub settings??

Any Ideas???

Stuarty

[jarviser]

It would help if you can list the changes that need to be made, then someone can help you .

Also confirm the firmware that is loaded on the hub. Does it say BT or Speedtouch at the top when you look at http://192.168.1.254 in your browser?
Whichever firmware is in there does it say which version of the software anywhere on the page?
Which hub? V1?

Just because hubs are sold as "unlocked" does not necessarily mean much on ebay. There are sharks swimming!

[Aerovision]

I have just attempted to re-read the whole 70 odd pages and am still completely confused!!!

I have bought a BT Home Hub 1.5 (brand new, thru' eBay) and I want to use instead of my knackered BT Wireless Network 1250. I use Virgin Net (now Virgin Media) for my Broadband access (BT phone line, not cable), and my e-mail addresses all end in virgin,net.

Please could someone provide me with step by step instructions as to how to achieve this, if it is even possible? I was told that the BT Home Hub was the dog's ******** - hence the reason that I bought it.

Please feel free to private e-mail me at: hot.air@virgin.net if you can help me. Many thanks in anticipation.

Regards,
Ian

[Wheel_nut]

Aerovision,

Sorry to bring you bad news but the V1.5 HH has not yet been cracked. The discussion in this forum refers to the original V1.00 HH which works with a modified version of the Speedtouch 9G Firmware.

WOOHOO!
I followed the instructions from 2-3 posts and finally got it working!
[Full thanks to Iron Duke for the info about editting the firmware file in a hex editor]

I ran into problems with the updates and so to avoid problems for other people, here is my step-by-step HOWTO for flashing a BT Homehub (HH) to 6.1.9.6

• You need to download a couple of files before you start since you need to do the flash update while offline (right click each link > Save As)
  Speedtouch Update Wizard 4.4.2.1
  6.1.6.9 firmware file
  Hexedit
  
• Unzip the Speedtouch Update Wizard to somewhere on your hard drive.
  
• Run the HexEdit.exe file. It will ask for a file to open, so tell it to open the ZZMYAA6.196.bli file.
  
• You'll have a black window with white text. Using your arrow keys, move along the first line until you're highlighting the 5 of the second 51

  42 4c 49 32 32 33 51 51 30
  
  Change it to 52 by typing over it.
  
  42 4c 49 32 32 33 51 52 30

  Now go down the page to where it says BANT-7 on the right (line 130)

  9c f3 ab f8 08 06 42 41 4e 54 2d 37 
  
  Change it to 5a by typing over it.
  
  9c f3 ab f8 08 06 42 41 4e 54 2d 5a

  Click on "File" and choose "Save As". Save the file somewhere on your hard drive, but change the .bli on the end to .bin
  
• Go to Start > Control Panel > Network Connections > Local Area Connection -(rightclick)- Properties
• Click on "Internet Protocol (TCP/IP)" to highlight it, then click on the "Properties" button.
• Click on the "Use the following IP address" option and enter the following in the boxes.

  IP address:      192.168.1.1
  Subnet Mask:     255.255.255.0
  Default Gateway: 192.168.1.254

  Click "OK" then "OK".
• Connect the HH to your desktop PC with the yellow ended CAT5 cable.
• Plug in the power of the HH.
• Go to the folder you unzipped the Speedtouch Update Wizard to.
• Doubleclick on upgradeST.exe
• Click on "Next"
• Let the wizard detect your HH. When you click on "Next" you will be asked for the login of the router.
  Login: admin
  Pass: admin
• Click on the "Have Disk" button, and find the ZZMYAA6.196.bin file that you created earlier. That's the .bin file, NOT the .bli file.
  You'll know if you editted it correctly earlier because it will say 6.1.6.9 for the version, and 2.0.0 for the config. If it doesn't say those figures, you need to go back and re-edit the file in HexEdit as you've got something slightly wrong somewhere.
• Click "Next".
• This is your final chance to chicken out before you start the update. If you're ready, click "Next" and let the update run.
• If all goes well, you will see the firmware being uploaded to the router and then being installed on the router.
• Ignore the error message at the end because the wizard is lying to you.
• Close the wizard.
• Go to Start > Run ... and type telnet 192.168.1.254 then click "OK".
• Login using the same login details as before...
  Login: admin
  Pass: admin
• Look at the text, and if you see 'Speedtouch 7G' and 6.1.6.9 in the top right corner then you have SUCCESSFULLY updated the firmware of your HH and can now proudly call it a 7G.
• Type exit to leave telnet.
• Start > Control Panel > Network Connections > Local Area Connection -(rightclick)- Properties
• Click on "Internet Protocol (TCP/IP)" to highlight it, then click on the "Properties" button.
• Click on the "Obtain an IP address automatically" option and then click "OK" and "OK" again.
• Plug in the phone line into the 'broadband' socket of the router.
• Open your browser and type in http://192.168.1.254
  Login: admin
  Pass: admin
• Click on Speedtouch on the blue menu on the left.
• Click on the "Set Up" link under 'Pick a task...'
• Click the "Next" button on the popup window
• Select Routed PPP then click "Next"
• Select 0.38 from the list for VPI/VCI
• Select PPP over ATM (PPPoA) for 'Connection Type'
• Enter the username and password for your ISP broadband login. Click "Next"

I think it is self-explanatory from that point on. That basically means that you've got Internet capability.

Have a look around the menus. You've got far more options available to you.
Oh yeah, I got my wifi working on WPA-PSK without the slightest problem.
I don't have a hub phone so I can't comment about that side of things.

Have fun boys and girls!

Originally Posted by Zenith

Hi there!
After a long search and testing i finally got my hub decteded and followed most of your instructions but i get hold on where i click next to chooes the .bin file that i created, its asking for password. i inserteded admin and for the password "my own password". it went through and choose .bin and ticked yes i am sure. when i clicked next i quickly received a message "wizard was unable to upgrade" because Authentication failed" so i reset my hub and when i put admin/admin nothing worked. so i went through firefox and i see a message change password. please enter serial number / new password / conform password. i put a new pass and went back to wizard. i loged in but when i clicked "yes i am sure" clicked next. still same message. pleaseeeeeeeeeee help its killing me. thank you thank you

p.s

these are the info i thought u may need:

Version 6.2.6H
tp: v2
board: BANT-Z (QR)

[jarviser]

That set of instructions is a little old now. If you are getting the Serial Number request you are on 6.2.6.x firmware (which you stated) which needs to be downgraded to 6.2.2.6 first, then the Speedtouch downgrade afterwards.
Wheelnut created a method that I wrote up in the link below which is relatively foolproof and requires no further hex editing.
http://www.jarviser.co.uk/jarviser/hubunlocking.html

[7cfm]

I have been trying to downgrade my V1 home hub to a pre 6.2.2.6 firmware. I started out with 6.2.2.H and have downgraded to 6.2.2.6 without a problem (I also had an experiment with 6.1.6.9 without any issues). When I try to downgrade to 6.1.1.m (using the original bt recovery tool or wheelnuts download kit) or 6.1.1.R (using wheelnuts kit) the process falls over at the last hurdle and leaves the hub unusable. After going through the upgrade process it appears to be unable to find the router on the network to put it in a usable state. I have tried the usual advice odf disabling AV & firewall, upgrade files are in c drive folder, static IP address configured and I am using ethernet port 1.

Has any-one else had this problem? Any advice please?

[Wheel_nut]

7cfm,

The Firmware file in my kit has been edited to match the Board ID of the BT HH. I don't know where you got the 6.1.1.x Firmware files but it is almost certain that the Board ID doesn't match the HH and this is the cause of the failure to boot.

[7cfm]

Wheelnut,

Thanks for your reply. I downloaded your kit from a couple of links earlier in the thread, one was hosted and the other was on rapidshare. The BT recovery kit for 6.1.1.m was downloaded from a btopenworld link (sorry I'm not at home so don't have the links here).

I was hoping that the generic BT recovery kit would have worked, but no joy.

Bearing in mind that the 6.1.1.x firmware files need to match the board id of the individual router (I think I've got that right?) is there any way for me to downgrade to 6.1.1.x?

[7cfm]

I've re read the post and realised that we are probably talking at cross purposes.

I have a standard version 1 BT Home hub that I need to downgrade to a firmware prior to 6.2.2.6, the reason is that I would like to use the DMT SNR tweak and also have the ability to ring in and out of dect phones on both bt broadband talk and my landline (this can be done with firmware prior to 6.2.2.6 with some slight modification).

I am able to flash more modern firmware to the hub:-

6.2.2.6 located at http://static.btopenworld.com/broadb...overy_6226.zip
6.1.6.9 (modified speedtouch) works from http://cid-ce6b6417cef6b9bc.skydrive...ockhomehub.zip (Jarviser)
6.2.6.h from http://www.btopenworld.com/broadband..._firmware.html

I am unable to flash to older firmware prior to 6.2.2.6:-

6.1.1.m located at http://static.btopenworld.com/broadb...b_firmware.zip
6.1.1.m and 6.1.1.r located at http://static.btopenworld.com/broadb...b_firmware.zip (Wheel_nut post 708)

The downgrades always fail at the very end at "The operational mode is being initialized" or

The device is not responding during discovery!
Check the device is connected correctly and up and running
Kernel mode requested by push button

I hope that all makes some sort of sense, I'm pulling my hair out trying to figure out why it won't downgrade, any suggestions would be much appreciated.

[7cfm]

The HH I was trying to downgrade was about 6 months old, I managed to get a 2 year old one and it downgraded perfectly. They seem to have done something to the more recent V1 HH to prevent downgrading to 6.1.1.x firmwares. The good news is that the ISP unlocked firmware still works on the newer hub.

[Wheel_nut]

7cfm,

Well done in discovering that anomaly. May I ask why you want to downgrade to V6.1.1.x Firmware?

[7cfm]

Hi Wheel_nut,

To explain that I need to give you a bit of background, so bare with it....

A couple of weeks ago I put a duff router on my line, by the time I realised it had messed up my broadband line, the SNR went up from 6 to 12 (eventually settling on 15!). I'm a long way from the exchange and the resulting drop in line speed from 2.5 Meg to 1 Meg now means that I'm unable to watch BT Vision on demand content (needs at least 2 meg). So what I need is a router that allows the SNR to be adjusted with a tool like DMT.

There is a complication, I also use BT Broadband talk (voip) and have all my dect handsets set to ring when some-one rings voip or landline, I can also dial out on either VOIP or by pressing 5 on the handset via landline, I don't want to lose this functionality.

The above means that I am restricted to BT Home Hubs for the broadband talk functionality and 6.1.1.x firmware for DMT. There are two other complications I had to consider 1) The home hub auto updates firmware, luckily this feature can be turned off. 2) There was a bug in the 6.1.1.x firmware that prevented the dect phones from ringing when a call was made to the landline, luckily there is also a documented fix for this using fxoport.

In the time its taken me to sort all this out BT have actually reset my SNR target back to 9, but at least I've now got a contingency plan if something similar happens in the future.

[Wheel_nut]

Hi cfm,

OK, I think I understand now. However, it seems that yout only need for DMT is to be able to tweak the SNT Margin.

I have never used MT but I have tweaked the SNR Margin on other Linux (Busybox) based Routers frim the CLI interface. I discovered the facility simply by using the ? (help) facility to list the commands available at each command level. Now, I haven't tried this on the HH because I have never needed to use it.

[robadams]

"They seem to have done something to the more recent V1 HH to prevent downgrading to 6.1.1.x firmwares."

Hi 7CFM, I reckon you could be right. I never got to the bottom of it.

I used to have 2 old V1's, but lost one to another house, so I bought another off an online auction site. It looks very similar to the original but there are subtle differences, the box is ever so slightly different and the LEDs don't have that fuzzy look.

It came with 6.2.2.6 so I set about installing 6.1.1.R, as it was to replace the original. I couldn't get it to work, kept getting the 'not responding during discovery' error.

In the end I used the recovery tool to put 6.2.2.6 back, which is fine for my purposes.

So... Is there an undocumented v1.1 out there?

[jarviser]

7CFM, If the reason for downgrading to prior to 6.2.2.6 is to be able to telnet in tweaks that 6.2.2.6 will not by default allow, is it not possible to do this by first setting up the root ID on 6.2.2.6 then using telnet?
The method has been published many times...

telnet 192.168.1.254 [hit ENTER]
enter the standard name
admin [hit ENTER]
and standard password
admin [hit ENTER]
2. Create a script to set up a root account. At the prompt type each line. Keep typing all in one line, just let the words wrap round, and the second r00t has two zeros. Most cmd windows also let you Copy and Paste...
:script add name = pwn command = "user add name = hubhackxx password = hubhackxx role = root descr = r00t" [hit ENTER]
3. Run the script by typing
:script run name = pwn pars = "" [hit ENTER]
4. finish by typing
exit [hit ENTER]
5. Telnet into the hub again, this time using the new superuser account and password
telnet 192.168.1.254 [hit ENTER]
enter the new superuser name
hubhackxx [hit ENTER]
and new superuser password
hubhackxx [hit ENTER]

6. To prevent BT upgrading again type
cwmp config state=disabled [hit ENTER]
cwmp config periodicInform=disabled [hit ENTER]
config save filename=user [hit ENTER]
exit [hit ENTER]
Use the hubhackxx ID to do any other tweaks required.
Logging into the hub admin menu with the hubhackxx ID will also give a config file backup and restore option in the System section

[billericayboy]

Hi, i have a Home Hub and have moved so have now changed from BT to Tiscali. i have read these postings and am a bit confussed on how to change my settings to connect to Tiscali as i cant connect to the Tiscali Broadband line. i have access to the Advanced Settings which are mentioned here but what do i need to change to connect to tiscali.

Many thanks

Richard

[jarviser]

Assuming you now have Speedtouch firmware installed, quoting from the Speedtouch manual...
"You need the following connection details from your Internet Service Provider (ISP):
- Your ISP’s method for connecting to the Internet (for example PPPoE)
- The VPI/VCI (for example 8/35)
- Your user name and password to connect to the Internet
You must have received this information when you subscribed to DSL at your
Internet Service Provider (ISP)"

Continued later....

[7cfm]

"So... Is there an undocumented v1.1 out there?

Originally Posted by robadams

Thats an interesting thought. I have both HH here, to be they look identical to me. Checking the stickers on the back they both have an item code of 027262. The 13 digit bulk numbers differ in the last two characters, the newer HH ends in E5, the older one ends in F3. (I've double checked, it is that way round). It would certainly be useful to be able to identify which HH can be downgraded to 6.1.1.r and which can't before buying a second hand one. Out of interest I tried to downgrade a V1.5 HH from 6226 to 611r, it also failed with "not found during discovery".

[7cfm]

Hi Jarviser, Yes I'd already found your excellent site and have downgraded to 6.2.2.6 and now have access to telnet. Unfortunately DMT is still unable to tweak the snr. DMT is only a front end and I'm trying to find out what the actual CLI commands are for the SNR tweak are so I can try them manually.

The one thing that is missing from your site (if you don't mind me saying) is that if you use 6.2.2.6 as your main router it has a serious security flaw that could allow admin access just by visiting website, even if you've changed the admin password. This can allow some-one to change the DNS settings and redirect you to fraudulant websites. There must be a way of locking down the router to stop this and I'm looking into it. (It could be that disabling cwmp is all that is needed, I just don't know at the moment).

[jarviser]

deleted original post.

Yes I knew about the security flaw but didn't publish it as BT seemed at the time to use it as a reason to upgrade to 6.2.6.x, whereas it's only to flog their FON rubbish. Also, following the GNUcitizen posting, the remote access facility that was used by the scammers seemed to be disabled about 10 minutes after connection by the BT server, so they appeared to cover that one anyway. Don't know if they still disable it remotely nowadays.

[SCONNYUK]

I've tried following the steps on update the firmware (sreen prints below)
I have home hub Software version: 6.2.6.B






Can someone me what im doing wrong?

Originally Posted by earth05

hi, im having the same problem as you in downgrading the home hub, did you get it sorted out ? just id like to get it downgraded thanks in advance

[jarviser]

SCONNYUK, you must downgrade to 6.2.2.6 first. Did you say you are on 6.2.6.B too?. See here

[jarviser]

Hi, i have a Home Hub and have moved so have now changed from BT to Tiscali. i have read these postings and am a bit confussed on how to change my settings to connect to Tiscali as i cant connect to the Tiscali Broadband line. i have access to the Advanced Settings which are mentioned here but what do i need to change to connect to tiscali.

Many thanks

Richard

Originally Posted by billericayboy

Install Speedtouch 7g as here
Browse http://192.168.1.254
In the speedtouch 7g software menu go to
Broadband Connection
Internet Services
View More

Then you will find somewhere to put the Tiscali Username and Password.

[7cfm]

7CFM, If the reason for downgrading to prior to 6.2.2.6 is to be able to telnet in tweaks that 6.2.2.6 will not by default allow, is it not possible to do this by first setting up the root ID on 6.2.2.6 then using telnet?

Originally Posted by jarviser

Thanks for this, it made me go back and retry DMT with 6.2.2.6 and its now working I have no idea what I did wrong the first time.

I've also deleted the default users - tech, admin and Basic with no ill effects, I have no idea if it makes the router more secure but it doesn't seem to do any harm either.