Unlocking BT Home Hub V1 *Upgrade at your own risk*

Hi,

Well after not much luck I have upgraded to 6226 firmware - not a good move! Anyone been able to get SuperUser rights on this but not being with BT? First, I couldn't enable remote admin as it said I had no internet! I got around that....

Originally Posted by slime

How did you manage to Get Super User rights? I am trying to unlock the home hub but, like you, I am not with BT.

I wan to enable remote assitance as well but 6.2.2.6 won't let me do that unless I am conencted to BT. Any ideas with this one as well?

Thanks,
Andy

[slime]

I haven't been able to get SuperUser rights - The hub now thinks I am "connected" so it let me enable RA but I can't connect to the URL it gives me (like https://192.168.1.254:51003/ - seen on here http://www.homehubblog.com/getting-root-the-easy-way/ that you have to connect to the internet address so I am using my external IP address with port 51003 forwarded to the local IP address of the hub but that doesn't work either. I guess the hub knows that 192.169 is local and not WAN!!!

AAAARRRGGGHHHHHH - may need to find someone on BT Broadband just to get a SuperUser account added!

[AdamG]

Yeah, I know the exact problem your referring to, I believe the http daemon listening on that port will only bind to the Internet interface, and unless you can gain access to that like you said creating a super user is impossible, you can downgrade and create one if you dont mind using the older firmware, and I believe you can make the hub phone ring on landline calls with the older firmwares as well with the following command,

voice fxoport config incfxodest=all

I havent tested it but it should work. I have a about 4 firmware versions for the homehub now if you need them.

AAAARRRGGGHHHHHH - may need to find someone on BT Broadband just to get a SuperUser account added!

Originally Posted by slime

I have now got SuperUser rights, in fact it is the only rights I have. A lot of messing about, and annoyingly, cannot remeber exactly what I did. Do know I did it through telnet, then removed all user profiles (mlp roles), then exited telnet. Next time I access the hub by telnet and was prompted for user name and password I just pressed enter. It can be done, I did it, but through trial and error.

However, even with SuperUser rights I cannot manually enter my IP address, I can enter username and passowrd for my ISP but without the IP address it will not connect.

Andy

[studioeng]

I have now got SuperUser rights, in fact it is the only rights I have. A lot of messing about, and annoyingly, cannot remeber exactly what I did. Do know I did it through telnet, then removed all user profiles (mlp roles), then exited telnet. Next time I access the hub by telnet and was prompted for user name and password I just pressed enter. It can be done, I did it, but through trial and error.

However, even with SuperUser rights I cannot manually enter my IP address, I can enter username and passowrd for my ISP but without the IP address it will not connect.

Andy

Originally Posted by AndyRP2001

What firmware version are you using ?? the older 611R is not locked as much as you can change user stuffs, but since 6226, you can no longer edit these.

So still no joy with the HHH (HomeHub Hack) then ?? I've been away for awhile and I've just read through to do some catch up; any joy with the 7G firmware working properly??

Hi everybody,

For the people who are not with a BT ISP and want Superuser Access
use "bt_test@startupdomain" as your broadband username do not enter a password then connect, this will connect to the BT adsl test account and enable adsl, then it will allow you to enable remote assistance and you can access your hub with https://api.home

login with the tech account and password given. then backup your configuration, edit the user.ini, and restore the user.ini file back

Ian

Hi everybody,

For the people who are not with a BT ISP and want Superuser Access
use "bt_test@startupdomain" as your broadband username do not enter a password then connect, this will connect to the BT adsl test account and enable adsl, then it will allow you to enable remote assistance and you can access your hub with https://api.home

login with the tech account and password given. then backup your configuration, edit the user.ini, and restore the user.ini file back

Ian

Originally Posted by IanC

Oh, sorry the account should be
"bt_test_user@startup_domain"
if https://api.home does not resolv try https://192.168.1.254

IanC

[slime]

@IanC,

Thanks - where do i put that info into the hub? I notice that on 6226 firmware the space to enter the username/password has gone? Can I do this from Telnet?

Thanks,
Slime.

What firmware version are you using ?? the older 611R is not locked as much as you can change user stuffs, but since 6226, you can no longer edit these.

So still no joy with the HHH (HomeHub Hack) then ?? I've been away for awhile and I've just read through to do some catch up; any joy with the 7G firmware working properly??

Originally Posted by studioeng

I managed to install the 6.1.1 firmware using the Speedtouch firmware tool. This let me select which firmware to install.

@IanC,

Thanks - where do i put that info into the hub? I notice that on 6226 firmware the space to enter the username/password has gone? Can I do this from Telnet?

Thanks,
Slime.

Originally Posted by slime

Hi Slime

If you go to http://192.168.1.254/cgi/b/is/_pppoa...be=1&l0=4&l1=2
this should take you to the Internet configuration page
You can access this also by telnet,
menu
ifconfig
on the intf field press return and type Internet
then cursor down to the user and press return and type the username

Once enter press type to select ok

Ian

[slime]

Hi IanC,

Thanks again but none of this works for 6.2.2.6 - or at least not for me - as I do not yet have SuperUser rights. Catch22! Need SuperUser rights, but can't get SuperUser rights as can't login to RA even if I can enable it!

Can someone please put the file needed to re-flash back to 6.1.1.R up somewhere - maybe somewhere like Rapidshare?

I had a little more luck with the R firmware but don't have it anywhere - got M on the hub CD but as I am not with BT the hub never updates itself and even if it could it would probably go back to 6.2.2.6!!!

Thanks,
Slime.

[slime]

Should have also said that I can enable RA, change the RA port, make it unsecure (rather than requiring a SSL connection) but just can't seem to connect to it to be able to enter the tech user account and password

Is there anyway to fool the hub into thinking that I am connecting from the Internet (WAN) interface rather than the eth (LAN) interface?

Cheers,
Slime.

Should have also said that I can enable RA, change the RA port, make it unsecure (rather than requiring a SSL connection) but just can't seem to connect to it to be able to enter the tech user account and password

Is there anyway to fool the hub into thinking that I am connecting from the Internet (WAN) interface rather than the eth (LAN) interface?

Cheers,
Slime.

Originally Posted by slime

I now have SuperUser access and can access the root of the home hub. I did this by forcing the firmware back to 6.1.1.M using the Speedtouch updater I downloaded from https://m8s-rates/com/speedtouch. I also got a number of different firmwares from there to try as well but cannot remember exactly where I got the 6.1.1.M from.

Once the 6.1.1.M firmware was installed I connected to the home hub by telnet and entered 'mlp role list' to display the roles set up; should show about 5 roles from admin, tech, SuperUser etc etc. I then typed 'mlp role flush' to clear all of the roles; there are know no roes set up and I think it is asecurity flaw that the standard admin log in can do this. I then quit the telnet connection and started it again; at this point there are no access roles / rights so when prompted to enter username and password I just pressed enter twice to skip through.

Andy

Sorry link should be:

http://m8s-rates.com/speedtouch/routers/

Andy

I've flashed my home hub with Speedtouch 7G firmware from m8s-rates.
The first step is to hack the header of the firmware file so that "BANT-7" reads "BANT-Z" and the "BLI223QQO" reads "BLI223QRO".
Once thats done use the speedtouch updater from m8s-rates to upload the file.
When i did it it said it had failed but when i telnet'ed into the box it said Thomson 6.1.9.6.
When accessing the router at 192.168.1.254 the router is definitely a speedtouch 7G.
Now for the problems; Wireless works and it allows a non-bt isp but it won't connect. It keeps saying that the DSl cannot synchronise. If someone else can flash their router and test this I can see if it is just me or whether this is a general problem with this firmware.
Does anyone have a copy of an earlier 7G firmware so I can flash it again? maybe see if that enables the DSL.
Hope this helps.

I've flashed my home hub with Speedtouch 7G firmware from m8s-rates.
The first step is to hack the header of the firmware file so that "BANT-7" reads "BANT-Z" and the "BLI223QQO" reads "BLI223QRO".
Once thats done use the speedtouch updater from m8s-rates to upload the file.
When i did it it said it had failed but when i telnet'ed into the box it said Thomson 6.1.9.6.
When accessing the router at 192.168.1.254 the router is definitely a speedtouch 7G.
Now for the problems; Wireless works and it allows a non-bt isp but it won't connect. It keeps saying that the DSl cannot synchronise. If someone else can flash their router and test this I can see if it is just me or whether this is a general problem with this firmware.
Does anyone have a copy of an earlier 7G firmware so I can flash it again? maybe see if that enables the DSL.
Hope this helps.

Originally Posted by Iron Duke

Been keeping an eye on all this for a while as I managed to pick one of these up for a pound :P Using your method I can confirm my Home Hub now has 7G firmware and can now connect to tiscali and I can browse the internet, only problem i have is it is only working over a wired connection, wireless does not seem to be working, going to have more of a play now and se what happens

[slime]

Great stuff - would like to try but which files do I use?

Here's what i found on the m8s rates site under 7G:
BANT-7_R619WWmgcp_up..> 12-Oct-2006 03:42 7.8M
BANT-7_R619WWsip_upg..> 12-Oct-2006 03:44 8.1M
ZZMYAA6.196.bli 12-Oct-2006 03:44 5.3M
ZZN1AA6.196.bli

Which files do I need and which/where is the updater tool?

Also - how do you "hack" the firmware to read as per instructions?

Thanks guys

[curtis82]

Been keeping an eye on all this for a while as I managed to pick one of these up for a pound :P Using your method I can confirm my Home Hub now has 7G firmware and can now connect to tiscali and I can browse the internet, only problem i have is it is only working over a wired connection, wireless does not seem to be working, going to have more of a play now and se what happens

Originally Posted by Home Hubber

Stupid me the wireless does work, the light just doesnt thats all. The phone light does flash a lot mind so maybe they are just mixed up.

I can't find where I downloaded the updater from but it is a speedtouch updater, not the BT one.
According to the updater both the ZZMYAA6.196.bli and the ZZN1AA6.196.bli are the same, I ended up flashing with both and they both gave firmware version 6.1.9.6.
To hack the header open the file in a text editor (I used hexedit for windows and linux) and change these two parts:

1. BLI223QQ0 is chaged to BLI223QRO
2. BANT-7 is changed to BANT-Z

If you don't do this the updater will refuse to flash the file.
Run the flasher and it should get to 100% then fail - check the telnet login to the router and it should now say 6.1.9.6 Thomson.

You can now enter your ISP details and it will work (well, it works for other people but not me)
Can any other AOL users let me know if this works? I think I may have a problem connecting to their network, it still says it cannot synchronise - whatever that means.

Sorry, BLI223QRO should read BLI223QR0, either way just change the middle Q to an R

[quote=Iron Duke;200538]I can't find where I downloaded the updater from but it is a speedtouch updater, not the BT one.
According to the updater both the ZZMYAA6.196.bli and the ZZN1AA6.196.bli are the same, I ended up flashing with both and they both gave firmware version 6.1.9.6.
To hack the header open the file in a text editor (I used hexedit for windows and linux) and change these two parts:

1. BLI223QQ0 is chaged to BLI223QRO
2. BANT-7 is changed to BANT-Z

QUOTE]


I can confirm this has worked for me. I used the Speedtouch updater from m8srates.com and hexedit to change the boot log of the firmware. The update went straight through. Had no issues getting a DSL connection but I did have a DNS issue but after a reboot everything is working and I am now conencted through my Home Hub 7G.

Andy

[adriandaz]

I can't find where I downloaded the updater from but it is a speedtouch updater, not the BT one.
According to the updater both the ZZMYAA6.196.bli and the ZZN1AA6.196.bli are the same, I ended up flashing with both and they both gave firmware version 6.1.9.6.
To hack the header open the file in a text editor (I used hexedit for windows and linux) and change these two parts:

1. BLI223QQ0 is chaged to BLI223QRO
2. BANT-7 is changed to BANT-Z

If you don't do this the updater will refuse to flash the file.
Run the flasher and it should get to 100% then fail - check the telnet login to the router and it should now say 6.1.9.6 Thomson.

You can now enter your ISP details and it will work (well, it works for other people but not me)
Can any other AOL users let me know if this works? I think I may have a problem connecting to their network, it still says it cannot synchronise - whatever that means.

Originally Posted by Iron Duke

Hello, please can you tell me where BANT-7 is located in the file, as I couldn't find it at the top where BLI223QQ0 was.

cheers,

Just keep looking down through the jumble of characters until you see someting like "Speedtouch 7G BANT-7" it's pretty close to the top of the header.

[slime]

Thanks all - the SpeedTouch updater is on that m8s-rates sites but go up to root of site and then in folder /utilities/UpgradeWiz and there are 2 to choose from - I used the later version.

Once flashed with modofied 7G firmware, the flash tool then re prompted me to logon (to do final config settings) and I didn't manage it! I now realise that the default is Administrator with a blank password! Then I got in via HTTP but then changed the password - then IE (IE 7.0) would not login but I could using Telnet - so I teleneted it and issued:
:system config digestauth=disabled
and then IE would let me login using Administrator and the password that I just set! I do remember seeing a SpeedTouch article that said if you have login problems with IE 7.0 then this is the setting to change - worked for me so I thought I'd let you know!

Not tried the actual firmware yet - have to do that later - but do we still need to do the mlp flush and then logout and back in to get root and then be able to add a SuperUser? Anyone tried this?

Cheers,
Slime.

[adriandaz]

Just keep looking down through the jumble of characters until you see someting like "Speedtouch 7G BANT-7" it's pretty close to the top of the header.

Originally Posted by Iron Duke

Ah yes, must have missed it in the early hours

The speectouch updater finds the router and tries to upgrade it, but fails to set the router into upgrade mode,

The router setup is defaults with the 6.2.2.6? firmware installed,

thanks,

Ah yes, must have missed it in the early hours

The speectouch updater finds the router and tries to upgrade it, but fails to set the router into upgrade mode,

The router setup is defaults with the 6.2.2.6? firmware installed,

thanks,

Originally Posted by adriandaz

Hi

I had the same problem, but got round it. You need to set up a static IP then run the upgrade. if it fails, press and hold the wireless association button then unplug the hub, while holding the W.A.B.,wait for at least 5 seconds, plug the Hub back in then release the W.A.B. this will set the router into upgrade mode. run the upgrade within 90 seconds. Worked for me.

Thanks all - the SpeedTouch updater is on that m8s-rates sites but go up to root of site and then in folder /utilities/UpgradeWiz and there are 2 to choose from - I used the later version.

Once flashed with modofied 7G firmware, the flash tool then re prompted me to logon (to do final config settings) and I didn't manage it! I now realise that the default is Administrator with a blank password! Then I got in via HTTP but then changed the password - then IE (IE 7.0) would not login but I could using Telnet - so I teleneted it and issued:
:system config digestauth=disabled
and then IE would let me login using Administrator and the password that I just set! I do remember seeing a SpeedTouch article that said if you have login problems with IE 7.0 then this is the setting to change - worked for me so I thought I'd let you know!

Not tried the actual firmware yet - have to do that later - but do we still need to do the mlp flush and then logout and back in to get root and then be able to add a SuperUser? Anyone tried this?

Cheers,
Slime.

Originally Posted by slime

Hi,

I didn't have to setup a super user account. Once the upgrade finished, I logged into the router via web interface. It still had the previous log in details since it backups and restores the config file, so I logged in using admin; admin. You will be able to run the setup from here.

[slime]

Cheers - all up and working...

well except that I still can't get VoIP working! Can't get the hub phone to register with the base station - tried holding in the wireless assoc button for 3 secs but nothing - the phone just says searching base 1 but never registers Held the button in for longer but then the hub reverts back to factory settings! Looking at the 7G PDF it seems the real 7G has another button for putting the base in phone reg mode - any ideas if you can do this via telnet or what I may be doing wrong?

Cheers,
Slime.

Not sure if it was already posted in this topic, but I stumbled on this while searching how to make your landline ring when the hub rings...

http://www.btyahoo.com/broadband/adh...s/gplcode.html

It looks like some open codes for the home hub, as I said, not sure if its any use to you all, but I gave up reading after page 4 - All went over my head!!!

Well crack on, may need to come back if I ever left BT or sold the modem!

Not tried the actual firmware yet - have to do that later - but do we still need to do the mlp flush and then logout and back in to get root and then be able to add a SuperUser? Anyone tried this?

Cheers,
Slime.

Originally Posted by slime

Yes I did that straight away without problem. You don't nee to add a Suoer USer if you flush the mpl. Just issue the command, close telnet and then telnet back in to the router. When prompted for username and password just hit enter and by default you will then have access to the root which is effectively SuperUser.

Andy