Unlocking BT Home Hub V1 *Upgrade at your own risk*

[Hiddenvision]

Does anyone know if the following is possible?

I have two BT HH one is a slave running 6.2.2.6 and a master connected to the internet running 6.2.6.h firmware.

I would like to use the telephone port of the slave for sipgate, in other words an ATA.

1. The slave is set to register on port 5160 and the master forwards port 5160 to the slave

2. RTP port range on the slave set to 54800-54810 and this forwarded from the master

3. The device registers with sipgate as follows

Device type= BT Home Hub
Expire=01.09.2009 17:16h
IP=My.external.IP:51702
sip-id = mysipID

The phone has a dial tone, but when you dial out it just gives a sort bleep

Dial in does not work at all

It looks like a port forward problem but I am stuck, is this config possible or am I wasting my time?

any advice greatly appreciated

Ian

Originally Posted by IanMac

hey Ian,
Um turn off the firewalls in both hubs to check a blockage.
I would disable all the port forwarding too, I have NEVER had to use that.
Though I have never used a Homehub as a Master.!

Disable the SIP in the Master hub.
Route traffic via ETH on slave hub,
did you use the sip providor IP or their domain in the SIP details ?
I found with Sipgate I needed to use the NAME not IP.

I use a homehub for sipgate and have no problems.

The HomeHu connects Via WDS to another slave Wireless hub, connected via another hub to the ADSL modem.
I also have some wireless sipphones and another homehub on the network as well as a speedtouch 716/WL or two.
All seem to work without a hickup..

Takes 10mins to setup a fresh hub and they just work.
But you have to do all the steps and not think your winning half way thru..

The Hub explorer I wrote makes the process easy for getting the basics done.


Hv.

[Hiddenvision]

If all else fails then use a speedtouch 716.
5 to 15 quid on ebay.
No built in cordless phone but a great hub.
WDS on the 716WL, all the tricks..

Hv.

[PsiDOC]

Hi all.
I bought 2 of these on ebay last week - impulse buy including 2 1010 dect phones. Yes the 7G firmware works but I want the 1010's working as well!

So I did some homework.
These can be unlocked. It's not too hard to do but it does require JTAG as we have to dump the rootfs (which is squashfs and read only!) modify 1 file - yes only 1! Then blow the rootfs back to the HH.

Here's where I am with this:
Note: This is still WIP as I have an issue with my JTAG adapter at the moment as it's not giving me reliable hex dumps.
I didn't perfect this routine I am merely applying it to work with the home hub. It was worked out and developed by a talented person called "Sleepdeprived" on the whirlpool.net.au forums. The method I am using is slightly different with slightly different tools.

The 1 stumbling block I have come up against is I can't get the repeatability when dumping the firmware, which I am sure I can sort out soon. That said the rootfs I extracted was pretty much intact and certainly enough to mount and extract the file required and see the locks that have been applied.
Just as an appetiser and to prove I am not talking total bollox here's the list of the username domains the locked BT home hub will allow you to log on to. This was extracted from the file that needs to be modified.

@hg0.btclick.com
@hg1.btclick.com
@hg2.btclick.com
@hg3.btclick.com
@hg4.btclick.com
@hg5.btclick.com
@hg6.btclick.com
@hg7.btclick.com
@hg8.btclick.com
@hg9.btclick.com
@hg10.btclick.com
@hg11.btclick.com
@hg12.btclick.com
@hg13.btclick.com
@hg14.btclick.com
@hg15.btclick.com
@hg16.btclick.com
@hg17.btclick.com
@hg18.btclick.com
@hg19.btclick.com
@hg20.btclick.com
@hg21.btclick.com
@hg22.btclick.com
@hg23.btclick.com
@hg24.btclick.com
@hg25.btclick.com
@hg26.btclick.com
@hg27.btclick.com
@hg28.btclick.com
@hg29.btclick.com
@hg30.btclick.com
@hg31.btclick.com
@hg32.btclick.com
@hg33.btclick.com
@hg34.btclick.com
@hg35.btclick.com
@hg39.btclick.com
@hg40.btclick.com
@hg42.btclick.com
@hg43.btclick.com
@hg44.btclick.com
@hg45.btclick.com
@hg46.btclick.com
@hg47.btclick.com
@hg48.btclick.com
@hg49.btclick.com
@hg50.btclick.com
@hg51.btclick.com
@hg52.btclick.com
@hg53.btclick.com
@hg54.btclick.com
@hg55.btclick.com
@hg57.btclick.com
@hg58.btclick.com
@hg60.btclick.com
@hg61.btclick.com
@hg0.btinternet.com
@hg1.btinternet.com
@hg2.btinternet.com
@hg3.btinternet.com
@hg4.btinternet.com
@hg5.btinternet.com
@hg6.btinternet.com
@hg7.btinternet.com
@hg8.btinternet.com
@hg9.btinternet.com
@hg10.btinternet.com
@hg11.btinternet.com
@hg12.btinternet.com
@hg13.btinternet.com
@hg14.btinternet.com
@hg15.btinternet.com
@hg16.btinternet.com
@hg17.btinternet.com
@hg18.btinternet.com
@hg19.btinternet.com
@hg20.btinternet.com
@hg21.btinternet.com
@hg22.btinternet.com
@hg23.btinternet.com
@hg24.btinternet.com
@hg25.btinternet.com
@hg26.btinternet.com
@hg27.btinternet.com
@hg28.btinternet.com
@hg53.btinternet.com
@hg54.btinternet.com
@hg55.btinternet.com
@hg56.btinternet.com
@hg60.btinternet.com
@hg62.btinternet.com
@hg63.btinternet.com
@hg64.btinternet.com
@hg65.btinternet.com
@hg95.btinternet.com
@hg96.btinternet.com
@hg97.btinternet.com
@hg98.btinternet.com
@hg99.btinternet.com
@btbroadband.com
@btinternet.com
@btclick.com
@teleworker
@speedtest_domain
@startup_domain
@dataone
@touchtelindia.net
@redcare.btclick.com
@t0_btopenworld.com
@t1_btopenworld.com
@t2_btopenworld.com
@t3_btopenworld.com
@t4_btopenworld.com
@t5_btopenworld.com
@t6_btopenworld.com
@t7_btopenworld.com
@t8_btopenworld.com
@t9_btopenworld.com
@service.btclick.com
@rtman.btretail.net
@qosa-btbroadband.com
@airtelbroadband.in
@rednet
@fast
@skynet
@fti
@XS4ALL
@local

As soon as I get my JTAG problem fixed I'll wrap this up and write a how to.
Take Care.

Psi

Which file needs changing to unlock, I haven't seen any of those user id's

[PsiDOC]

The slock.txt file. The trick is finding it!

Psi

[tassidar_87]

Hello i have sucessfully hacked the homehub but i cant get it to connect to the internet.

I have a talktalk conection and the speedtouch software is successfully installed on it. I entered my talktalk interent details to the router but i am however still unable to connect it the internet.

Anyone ablt to help?

Hi
I hack my HH yesterday and I got talk talk and i have to change the VCI - 38 and it work but can't establish wireless connection.

It's done, i have to change the channel from auto to 11 and wireless connection works

[Tomallcroft]

hi i have just today got a bt home hub number 1. i have managed to get it unlocked and get the speedtouch 7g firmwear onto it. the problem i am having is connecting to the internet on my pc that i set it up on. i have an xbox 360 which connects fine and runs like a dream but both my laptop and desktop cant find the internet or wont connect to the router. please help ( will need like screenies or good exsplernation as not done much in network side of pcs) thanks tom

[btsimonh]

For root access + linux prompt, follow the instructions at the bottom of this page:
http://www.homehubhacks.co.uk/index.php?n=HHH.Firmware

this should let you do anything you want in terms of config - they left a BIG hole, and all you need is a usb stick + a little linux experience

[PsiDOC]

For root access + linux prompt, follow the instructions at the bottom of this page:
http://www.homehubhacks.co.uk/index.php?n=HHH.Firmware

this should let you do anything you want in terms of config - they left a BIG hole, and all you need is a usb stick + a little linux experience

Originally Posted by btsimonh

Simon,
Can I pick your brains via pm? I have followed your work over on modem-help. Did you ever get past the &h 400000 issue using the DD command? Also I have a possible couple of ideas that need to be bounced off someone with experience of the hh.

Ta.
Psi

[PsiDOC]

No matter sorted it now. Home Hub unlocked and Dect phones working.

Ta anyway.

Psi

[gebookz]

No matter sorted it now. Home Hub unlocked and Dect phones working.

Ta anyway.

Psi

Originally Posted by PsiDOC

Good news!

Did you manage to remove the ISP lock from the original firmware & flash it back to the hub?

Looking for details..

[PsiDOC]

No. Been trying that for weeks. Sadly the original 6.2.2.6 firmware has inbuilt corruption that stops any rebuilt firmware from loading - sneaky buggers!
I modded the CFE (bootloader) to accept the CANT-A firmware (Later version ST-7G). It all works fine except for the lights are muddled up as documented using the 6.1.9.6 7G firmware here and I cannot get the landline (FXO) to run on either the hub phones or the phone port. Looks like an FXO layer issue but I don't know how to trouble shoot it.
The hub phones register and work fine on VOIP - tested on sipgate. Just the FXO issue to fix. Any assistance /knowledge with this would be appreciated.

Psi

I am also looking for a BANT-7 (Early version 7G) CFE dump to try some tests out with. If anyone has one could they please let me have a copy?
TA.

Psi

[drg1]

No matter sorted it now. Home Hub unlocked and Dect phones working.

Ta anyway.

Psi

Originally Posted by PsiDOC

Hello, i'm new to this forum and to playing with home hubs. Last night I unlocked a home hub bought from ebay to make it work on pulsenet. Did work all right but i realized i couldn't make it work on voip (sipgate or sipdiscount). The router registers but cant use the phone port for voip. Cant register dect phone either.

Then read extensively and realized i could only use voip and dect with bt firmware, using another router to connect with internet. Tried but failed to revert unlocked hub back to bt firmware. Then stumbled through your post. Can you guide step by step to make dect phones register to unlocked hub and how to use voip on it.

Your help will be highly appreciated

[PsiDOC]

Hello, i'm new to this forum and to playing with home hubs. Last night I unlocked a home hub bought from ebay to make it work on pulsenet. Did work all right but i realized i couldn't make it work on voip (sipgate or sipdiscount). The router registers but cant use the phone port for voip. Cant register dect phone either.

Originally Posted by drg1

Hi DRG1.
That's exactly the reason why I started tinkering with the home hub.
Ok do you know how to use a JTAG interface for reflashing the bootloader? If not I suggest you read up as you're going to have to use one. The method I have worked out actually puts the router onto the later 7G CANT-A firmware (6.2.19.2 or 7.4.1.7) with almost full functionality.

I am 1/2 way through the detailed how to which I will probably post up on my site. So please bear with me until I do. Until then here's a brief how to courtesy of Alex at Modem-Help who actually gave me the ideas on how to do it:
http://forums.modem-help.co.uk/viewtopic.php?t=3677

Psi

[drg1]

thanx for reply psidoc,

I'm afraid i dont have JTAG skills. i've reverted to bt firmware 6226, cant see backup/restore option in config menu on 192.168.1.254. I am now working to make it work behind another router connected via ethernet.

[drg1]

I am stuck now and need some help. I have connected to Plusnet via their provided router. I then connected the home hub with bt firmware via ethernet and made it work (thanx to homehubhacks.co.uk). Then i used telnet to make home hub register with sipgate but no joy (again as described on homehubhacks website). I made the dect phone work by using a second adsl filter to the first filters 'phone socket' - then connected the adsl of the second filter to HH's adsl port. This makes the dect phone work as a land line cordless phone.

Now what i want is use the home hub to connect to sipgate while being behind the plusnet router. Can anybody help?

[PsiDOC]

I had a fun and games with that as well when I was tinkering.
Just remember your username with sipgate does not need @sipgate.co.uk

Restore to defaults on the router then try this:

Login in on telnet using admin:admin

:script add name = pwn command = "user add name = hackme password = hackme role = root descr = r00t"
:script run name = pwn pars = ""

Exit telnet, then open it again and login using hackme:hackme

Now type in:

voice profile add

And under the headings put in:

SIP_URI = nnnnnnn (this is your 7 digit SIP ID)
[username] = nnnnnnn (replace nnnnnnn with 7 digit SIP ID. Note: No @sipgate.co.uk - it's not needed)
[password] = ******** (enter your password NOT the website password)
[password] = ********
[display name] = (whatever you want as your name or put your phone no.)
[voiceport] = (I use COMMON, you can select using up/down arrows)
[abbr] = (nothing is needed here, but you can put your SIP ID)

Now type:

voice sip config primproxyaddr=217.10.79.23 (Note using the ip address for sipgate and not the URL)
voice sip config primregaddr=217.10.79.23
voice sip config notifier_addr=217.10.79.23
config save filename=user

Now type the following in, replacing the [192.168.1.1] for the IP address of your router that is maintaining you broadband connection.
Also worth noting here make sure your router that is maintaining the BB connection is in the ip address range 192.168.1.1 - 192.168.1.253 if it isn't change it so it is!

:ip rtadd dst=0.0.0.0 gateway=192.168.1.1 intf=LocalNetwork
:dns client dnsadd addr=192.168.1.1
:dns server config WANDownSpoofing=disabled
:dns server route add dns=192.168.1.1 intf=LocalNetwork
:voice config intf=LocalNetwork
:system config defaultconnection=LocalNetwork
:config save filename=user

Now login and tick the box under advanced >> configuration >> telephony and you should be good to go.

HTH.
Psi

[Hiddenvision]

Great work there PSI, I guess you will be cracking on to the Videophone next !!!!

If you use a PC then try the HomeHub explorer I wrote.

I use it every time I need to configure a Hub and the pain is all over in less than a minite.

With far less typing.
hiddenvision.co.uk/homehub


Hv.

[drg1]

Thank you so much PSI.
I did all that but still sipgate wont register, i had initially done it with the URLs for sipgate i deleted that and did it all over again with the IP addresses. Still no joy. I forwarded ports to my router as well. but it just keeps showing a red cross (not registered) against the sipgate number in telephony.
When 2 days back I had flashed the router to speedtouch 7G , it had registered to sipgate but the phone port wasn't working nor could i register the dect phone.
Cant see where I could have gone wrong. I have assigned ip address 192.168.1.175 for the home hub and my router is a thomson speedtouch 585 with the ip 192.168.1.254. the LocalNetwork part of telnet works okay because i can connect to internet, cant just make sipgate work

[drg1]

thanx all, sorted it out, just did a reset on the hub, changed my router to 192.168.1.1 , left hub on 192.168.1.254, did exactly as above instructions and it worked. tried it with sipdiscount using server 'sip.sipdiscount.com' ,that worked too...

Hello i have sucessfully hacked the homehub but i cant get it to connect to the internet.

I have a talktalk conection and the speedtouch software is successfully installed on it. I entered my talktalk interent details to the router but i am however still unable to connect it the internet.

Anyone ablt to help?

Originally Posted by tassidar_87

Have you configured the router to work with Talk Talk. What i mean is changing the VCI and PPoA settings.

http://www.talktalk.co.uk/help/questions/TEC_01_37

I had this problem when getting my hacked V1 to work with Tiscali (with the help of reading most of the posts in this Thread for the hacking bit only)

Note if anyone on Tiscali is having problems getting the Home Hub working on it
Check if you have applied these settings to the router:
http://uk-tiscali.custhelp.com/cgi-b...i=&p_topview=1

[PsiDOC]

The complete how to to unlock the Home Hub properly is now up on my site.

http://www.psidoc.com/homehub/

If you find any errors please let me know.

Psi

Hey guys, I've made an easy GUI tool for Windows that makes it easy to do
- Sipgate/VoIP hack
- Superuser
- RouteInternally
- Stop BT Update

Thought this might be useful for the community. It's written in VB6, and is open source.

http://forum.josephn.net/viewtopic.php?f=28&t=29

@PSIDoc: Your work is much appreciated - thank you! I am considering opening up a spare Homehub and giving it a go. Some comments and questions.

1) Presumably the computer that one's using to flash the CFE _may_ need its BIOS parallel port mode (e.g. EPP) changing in order for this procedure to work? (may be worth mentioning in your document?)

2) It might be nice to include some images and/or text for how to remove the plastic case without breaking it.

3) Is there any alternative way of attaching the JTAG cable to the PCB other than soldering on direct, given that it's only a temporary connection that's required? I don't know whether I trust myself not to make a mess of it and end up breaking the hub completely.

4) With the newer 7.4.1.7 firmware, have you identified any functionality that does not work as expected? Presumably you've tested the VOIP, wireless etc etc.

5) The wires attached to the PCB look, from the second PCB image, like there are three wires (4,6,8) going to the TPx locations and four wires (1,3,5,7) going to the ground line. Is this correct? (Have the images been resized?..the pin out diagram looks quite small and isn't easy to see)

6) This is probably a dumb question, and may well have been explored before .... in order to avoid the JTAG procedure, is there any way to hack the 7.4.1.7 CANT firmware so that it's accepted by the hub regardless of the CFE? (presumably you'd still end up in a situation like with the 6.1.9.6 firmware where the VOIP functionality won't allow DECT phones to be registered?)

[djkprojects]

Hi all

I have tried to unlock my HH v1.0 (white with Wireless Assoc button at the back) according to instructions provided on 26th page of this thread. I've downgraded the software to 6.2.2.6 (had 6.2.6.E before), set up root user and logged into Control Panel. Then on backup config page uploaded user.ini file (according to the instructions).

The problem is that now I can't log in the HH Panel at all. tried using admin/admin admin/serialnumber (CPxxxxx on HH) and all sorts of variations but with no luck. Has the password changed after uploading user.ini?

Thanks

@djkprojects: Can you use the same username/password to successfully login to the hub via telnet? If so, then you could try using a different web browser - I found that IE8 would not let me log in to the control panel, but firefox does.

Version 1 final of the BT Home Hub Modder is out now http://forum.josephn.net/viewtopic.php?f=28&t=36

Let me know if it works for you

[djkprojects]

Hi

I've just tried via telnet but still the same thing "Invalid username/password". The worst thing is that i can't even upgrade the firmware because it also ask for password during the installation process.

Is there any way to get into CP. maybe I should use some thomson default login?

Any ideas guys ?

thanks