Unlocking BT Home Hub V1 *Upgrade at your own risk*

[fruit tool]

I thought this might be helpfull to somebody so...

If anyone flashed the bootloader wrong on one of these things you probably killed the thing and it wouldnt let you flash to it again. Well i figured out how to get it to flash again. This should work with other badly flashed bcm6348 based routers ive seen on the net also.

The home hub illuminates two leds very dimly when this happens, can't remember which ones. Its either wireless + broadband or broadband + internet.

DONT TRY THIS UNLESS YOU KNOW FOR CERTAIN THAT A BAD BOOT BLOCK IS STOPPING YOU FROM RECOVERING YOUR ROUTER.

The Problem.
If i erased the flash (so its empty) then reset the router the cpu initialized and was happy to write to the flash again.
But if the boot portion of the flash has bad data in it the cpu will lock up instantly not giving a chance to reflash.

So i read the datasheet on the s29gl064m flash that this thing uses. and figured that pin#37 (count along from the dot in the corner and back up the other side or pin#12 down away from the cpu on the bottom side) was it's supply voltage pin. Now with a small blade i lifted the pin away from the board not too much though or it might have snapped off, just enough to break contact with the board. The pin is very thin so i had to be very careful.

I plugged the router in and started the jtag flash tool for erase. (hairy dairy maids wrt56g or tornado jtag flash tool google for it). I wont tell you how to use this tool because the way i see it, if you can figure out what im telling you to do here you can figure out how to use these tools. Anyway just as the jtag tool says its initializing the cpu push that pin on the flash chip back down on the board with somthing non conductive (not metal, a plastic toothpick is perfect). Be carefull though not to bend it too much or it will snap off. you might need to do it a couple of times to get the timing right but like i say be very careful. when its erased solder the pin back down and go ahead and flash your bootloader back to the router.

Im not brilliant at grammar so if you need clarification or anything then just inbox me.

Have fun.

s29gl064m datasheet:
http://www.spansion.com/datasheets/s29gl-m_00_b8_e.pdf

I can not open window to go to Internet, any time i open the window it says:
""(Your DSL connection is down.
Verify if your SpeedTouch is correctly connected to your DSL line. For more information consult your documentation.
Please close this window and try again.)""
so i don't know what to do and i don't know what is DSL?

Well, that homehub that had been donated to me by some people has come into play today as my regular wireless router died. And I'm discovering what a useful little piece of kit it is alongside my normal hub and cable modem.

So, I've got the v1 - knocked down to 6.2.2.6, done the superuser hack, preventing upgrades, routeinternally to use as an AP and VOIP working via PBXes! lovely setup... all I want now is for my PSTN calls to be the default, and to use 5 for VOIP when I choose to.

I can't find this specific info anywhere - can someone help? There's reference on homehubhacks to PSTN breakout for a speedtouch but I don't want to go experimenting as I've already flashed and reflashed about 7 times.

Also, is there a way to log out of the web interface - once I'm in that's it! I want to go back in as the superuser to extract my voice.ini out.

Thanks in advance!

Hi
Well I am no PC whiz but after many frustrating hours and resources I have managed to flash a BT Home Hub I was given and can now access the internet using Firefox and Chrome BUT not IE7 which means I cannot use my Windows Live (MSN, etc).

Can anyone help me out what I should be doing to sort this - I gather that it can be overcome but seem to be unable to find how.

Thanks

Is there any solution for BT Home Hub 2 ??

[btsimonh]

I've got a linux prompt on the homehub v1.5

Need help with squashfs to proceed.

See:
http://forums.modem-help.co.uk/viewtopic.php?t=2695
or
http://homehubhacks.co.uk/index.php?n=HHH.Firmware

pm or reply if you can help with the bt hh squashfs filesystem, can't create a valid one at the moment (can extract, but can't create).

s

[Hiddenvision]

Hey to all,

Cor this thread is still churning replies.

Just a quick note for people trying to get the Homehub working as a Main Router and as a SIP phone at the same time.

FORGET IT.

For the cost of a simple DSL hub it is not worth the bother.

SIMPLE solution.

1: FLASH your hub to 6.2.2.6
2: Plug in a wire from your Main router to the Homehub,
or if your Main router supports WDS use that
3: Configue the SIP details,
4: Start using the product.

The Home hub is OLD.
Although it is still a good platform for SIP,DECT,network USB and print.
The newer hubs given to you for free by most providors are NEWER and should have better firewalls and faster, more stable chipsets.

I can Highly recommend the Sky(netgear) DG934.
This has WDS (once flashed).
The Speedtouch 716 is also a nice easy modem to configure and it also has VOIP.

The 716 also has WDS or was it the 718 ? I have both but I forget what one was wireless.


But seriously, stop tryng to reverse engineere the poor OLD homehub.
Save your time and effort, just use it as a slave hub and be done with it.

Use all the time you save in working out a cure for cancer or a solution for cooking "beans on toast" in a toaster without making a mess.

Actually that last one is now solved, how about global cooling.?

I hope this does not offend but I figured that someone had to be a little direct about this !!!


Hv.

[Hiddenvision]

Boris, you do not want to be a super user. you are best to be a RooT.
Make sure you delete ALL the other accounts.

Is there any solution for BT Home Hub 2 ?? or do i haved to put in the bin

[Hiddenvision]

No soloution.

you can send it to me. I will recycle it. :-)

Seriously, I will look at it and see what can be done.!

Hv.

[Dimension]

Hi,

I have a V1 Home Hub that is unlocked however when I plug in the power the Internet and Broadbank lights flash on real quick then all 5 lights flash on for a second then go off again.

If I hold the Wireless Association button down when I turn it on the lights stay on for 6 seconds then turn off. If I plug in an ethernet cable into ethernet 1 the Data light comes on and the computer tries to configure an IP address but fails.

Has anyone else had this happen to them? Is it fixable?

[Hiddenvision]

Sounds like something is corrupted.
Simple reflash should fix it up,
If not then it sounds like it has gone boom...!!

Try getting into safe/boot upgrade mode
Hold gray button, unplug power, apply power keep button held for 5 secs.
All lights should be on (I think)
Then connect to Eth1, fix IP on your PC to 192.168.1.55
Do restore to 6.2.2.6

Hope that hekps.

Hv.

[HARDCORE69]

guys wake up there has to be a way if we edit or mod anything what this router taking so long end of the day when bt sends out home hub v3 then there will be a unlocking home hub v2 lol

[Hiddenvision]

No worries hardcore,

just so you know the V1 hub (white) is about as opened as it is ever going to be.

You can edit and mod quite a lot on it.
but I guess we shall wait for your results as you seem very confident.

Perhaps you are talking about the V1.5/V2 units.?

Hv.

[HARDCORE69]

I was thinking of unlocking the home-hub v2 myself its just that the difficult of it really good security i mean netgear can be unlocked anyday i quess the home-hub just likes to be alone but il find a way to work and then tell everyone

[Hiddenvision]

Sweet, let us know how you go...

Hv.

[Dimension]

Sounds like something is corrupted.
Simple reflash should fix it up,
If not then it sounds like it has gone boom...!!

Try getting into safe/boot upgrade mode
Hold gray button, unplug power, apply power keep button held for 5 secs.
All lights should be on (I think)
Then connect to Eth1, fix IP on your PC to 192.168.1.55
Do restore to 6.2.2.6

Hope that hekps.

Hv.

Originally Posted by Hiddenvision

I set my ip to 192.168.1.55, mask to 255.255.255.0 and gateway to 192.168.1.254.

Tried to browse to 192.168.1.254 but it couldn't resolve. I did get the 5 lights come on though when I held the wireless button down. Then when I connected to ethernet 1 it lit up. Whats the process of restoring to 6.2.2.6?

If I can't browse to the gateway, is it stuffed?

[Hiddenvision]

Once you set your IP (correct as you typed)

Then put the hub into Boot mode.

Power the Hub, let it settle down (+30 seconds) then the following.
With power in, Hold Button,Remove power, keep button held, apply power, keep button held for about 5 to 7 seconds more.
Remove the plug from the HUB to disconnect power do not simply turn off mains.

Then connect PC directly to the hub via Eth1.

Run the firmware Recovery Tool, should find the hub with ease,
If it fails to find it then either you are doing something wrong, or the hub is stuffed.

Default Un/Pw will either be admin/admin or admin/#serialnumber#
Perhaps that last one is wrong, so long since I tried.

Then select the 6.2.2.6 firmware , or any of your choice.
should pass thru the upgrade with no hickups.
It may fail at the end (updating/restore user settings) but that is fine.

Then the hub should kick into life.
Lastly do the Restore default settings trick by holding down button for +15 seconds

If you have problem and are in london I am happy to do it for you.
If the hub is stuffed then I have some if required (10 quid + post ready to go).


Let us know how you go....

Hv.

[Hiddenvision]

Before the process above do this
With power on press and hold button for 15-20 seconds.
This will reset all details to default...
Then do the above process.

After update, use Telnet or my Homehub explorer to quickly add new RooT user account and change all (most) of the required settings.

Delete all other user accounts after you created (disconnected and reconnected back into) your RooT one.

Once you have done one then changing all the settings takes about 30 seconds.
If you can leave your IP range as 192.168.1.x it makes for a much quicker edit.

Once it is all working then make any tweeks via user.ini or via CLI interface.


Hv.

[Hiddenvision]

Just to confirm the lights.
I just plugged in a fresh one and tried.

If you get into boot mode correctly then the hub will do this

Power on shows all 5 lights.
Then they all go OFF (normally once you have entered boot mode correctly after the 5-7 seconds)
Then 1 (far right) light will come on when you connect cable to PC.

If the hub starts to Click and all the lights flicker and flash then you are not in boot mode.
Simply RETRY.

If the BT restore tool fails then use the speedtouch one.

Hope that helps.

Hv.

[Dimension]

Ok here's where I'm up to:

I go into the correct boot mode, downloaded and ran the BT firmware. Here is my log:

Starting with options: serialFilter=* buildImageName=
Starting device search.
Found device with serial: SpeedTouch [0644EHNLZ]
Starting build check.
Using build image: C:/Documents and Settings/Ben/Desktop/New Folder/RecoveryTool/../BThubSW/ZZK3BP626H.bli
Starting upgrade.
Discovering device.
Starting actual upgrade.
ERROR: Finishing upgrade failed ()
End.

It detected in and then started the upgrade and installing the fireware. When it reached 100% I got the "Finishing upgrade failed" message. It never asked for a username or password.

Now when I turn the Hub on I get 5 solid lights straight away. I don't seem to be able to browse to the IP or telnet to it though?

Any thoughts?

[Hiddenvision]

Use 6.2.2.6c or E
C I think,
I shall PM you with the link so you do not have to look thru the messages again.

They are all funny words to me .
I just see a nice pretty screen, telling me how long I got till I have to put down my coffee .

I thought you were using linux till I saw the path.

Hv.

[Hiddenvision]

Ah yes the log file !

Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch BTHH [HAPPYHARRY!@#]
Starting build check.
Using build image: www:/btuncooked/dumdun/inyago/6226_.bli
Starting upgrade.
Discovering device.
Starting actual upgrade.
ERROR: Upgrade failed (Unexpected MDAP discovery)
End.

Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch BTHH [HAPPYHARRY!@#]
Starting build check.
Using build image: www:/btuncooked/dumdun/inyago/6226_.bli
Starting upgrade.
Discovering device.
Starting actual upgrade.
Upgrade finished.
Renewing interface.
Authenticating with user name = admin and password = admin
End.

Certain names have been changed to protect the short sighted....
..




Actully here are some more as they may how people how many different ways it fan fail...


Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch BTHH [HAPPYHARRY!@#]
Authenticating with user name = admin and password = admin
WARNING: Authentication failed.
End.

Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
WARNING: No device found.
End.


Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch BTHH [HAPPYHARRY!@#]
Authenticating with user name = admin and password = admin
WARNING: Authentication canceled.
End.

Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch [HAPPYHARRY!@#]
Starting build check.
Using build image: www:/btuncooked/dumdun/inyago/6226_.bli
Starting upgrade.
Discovering device.
Starting actual upgrade.
ERROR: Upgrade failed (File error during image file transfer)
End.


Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch BTHH [HAPPYHARRY!@#]
Starting build check.
Using build image: www:/btuncooked/dumdun/inyago/6226_.bli
Starting upgrade.
Discovering device.
ERROR: Device disappeared.
End.



Yer yer, even people that have done it before get failures,
Don't give up...

Must check ETH1, FIXED IP, NOTHING ELSE CONNECTED

With the obvious knowledge of the default username and password
anyone that does not INSTANTLY change their's is not quite the full quid....


..
Hv.

Apparently,, when the setup wizard asks for an activation code, using
522P-22P4-A222-22AT-F24N
or
5225-2374-WG62-22AS-BJ7P
will let you set it up manually..

you can also apparently telnet in to it : http://www.the-scream.co.uk/forums/t21966.html?

and the web admin page is http://192.168.1.254 - userid and password admin & admin

Originally Posted by Ian

I have tried using the setup wizard but anytime I come to "enter userid and password" I entered "admin" "admin" but the hub tells me that the hub is password protected. So I am not able to go any further. Do anyone knows the unlock password for the home home_ Mine is a white one with cordless phone.

[Hiddenvision]

Depends on the current version
Just boot it up and surf to the web admin.
Just chec the version.

On the latest version the default password is the serial number or part of it.
The web front end will show you this if it is the latest.


If Not then do a Default reset. Press button for 17 seconds.
Surf to the x.254 page then it will either be admin / admin or admin / serialnumber
Same again if it is the new type it will tell you how to change the default password.


If all that fails then put it in boot mode
Hold buton, remove power, keep button held, insert power, keep button held for another 5 seconds.
Release button and it should pause and be in boot mode, only the Eth(right) light will come on and it will not be clicking .

The do the update with either the BT restore or the speedtouch restore app
Use the 6.2.2.6 that everyone talks about, or whatever speedtouch version you require.

Make sure you connect ..... DIRECTLY ..... to Port Eth1, whatever you are doing...

Hv.

[Hiddenvision]

Ah yes the log file !

Starting with options: serialFilter=* buildImageName=6226_.bli
Starting device search.
Found device with serial: SpeedTouch BTHH [HAPPYHARRY!@#]
Starting build check.
Using build image: www:/btuncooked/dumdun/inyago/6226_.bli
Starting upgrade.
Discovering device.
ERROR: Device disappeared.
End.


..

Originally Posted by Hiddenvision

Took me a week to find it again.........!

Hv.

Does anyone know if the following is possible?

I have two BT HH one is a slave running 6.2.2.6 and a master connected to the internet running 6.2.6.h firmware.

I would like to use the telephone port of the slave for sipgate, in other words an ATA.

1. The slave is set to register on port 5160 and the master forwards port 5160 to the slave

2. RTP port range on the slave set to 54800-54810 and this forwarded from the master

3. The device registers with sipgate as follows

Device type= BT Home Hub
Expire=01.09.2009 17:16h
IP=My.external.IP:51702
sip-id = mysipID

The phone has a dial tone, but when you dial out it just gives a sort bleep

Dial in does not work at all

It looks like a port forward problem but I am stuck, is this config possible or am I wasting my time?

any advice greatly appreciated

Ian

hi there i have a home hub and have just changed to o2 and would like to keep the home hub for the phone.
its a 1.5 byw
ok so heres my story so far...

i have downgraded to 6.2.2.6.
I have the root user account and done the upgrade prevent,

so i have the User.ini dor the hub

after that i discovered a very similar way to extract the user.ini from the o2 box so i have that and i took the ppp.ini part and slapped in the HUB user.ini over the old part. so i plugged it in and had the fingers crossed and no internet
http://rapidshare.com/files/27567735..._hope.rar.html
i have both these ini's uploaded to rapidshare if anyone cares to help?



Thanks for any help..

[robadams]

IanMac -
I only know about Version 1. What you're trying to do is definitely possible, lots of people are running the sort of setup you propose. Have a look at Jarviser's site for instructions.
I don't know about running BT software on the main hub connected to the internet, they might have knackered it for any SIP but their own. I think most people run it as a Speedtouch, but if my suspicions are correct, an early BT version like 6.1.9.6 or prior MIGHT work as well, if you really want the BT software.

[Hiddenvision]

hi there i have a home hub and have just changed to o2 and would like to keep the home hub for the phone.
its a 1.5 byw
ok so heres my story so far...

i have downgraded to 6.2.2.6.
I have the root user account and done the upgrade prevent,

so i have the User.ini dor the hub

after that i discovered a very similar way to extract the user.ini from the o2 box so i have that and i took the ppp.ini part and slapped in the HUB user.ini over the old part. so i plugged it in and had the fingers crossed and no internet
http://rapidshare.com/files/27567735..._hope.rar.html
i have both these ini's uploaded to rapidshare if anyone cares to help?



Thanks for any help..

Originally Posted by bhuthogg

Best way is to keep your O2 hub doing your connection and just use the Homehub as a slave hub serving the SIP and homephone.
I think that the O2 hub has WDS so you can even connect with NO wires.
Just flash the homehub with good 626 (i forget the exact version now) edit the hub to be dhcp and updates off, route via ETH, and bang in your SIP details.
Should take no longer than 20 mins.

Edit : Ahh Hub V1.5 is that the new black one or the older white one. ?

Hv.