Unlocking BT Home Hub V1 *Upgrade at your own risk*

**WARNING** Carrying out any of the upgrades to the hub mentioned in the following pages, is done at your own risk.

The Scream! and contributors, hold no responsibility if something goes wrong.


Hi all,

Just wondering if anyone has any more info about this.

Ive got a spare Bt Home Hub from parents and want to use it with a non BT ISP, is this possible yet?

Thanks in advance

NJ

https://the-scream.co.uk/forums/t22658.html?

Apparently,, when the setup wizard asks for an activation code, using
522P-22P4-A222-22AT-F24N
or
5225-2374-WG62-22AS-BJ7P
will let you set it up manually..

you can also apparently telnet in to it : https://the-scream.co.uk/forums/t21966.html?

and the web admin page is - userid and password admin & admin

I've been playing around with this for a couple of days now, but with no real success in unlocking it.

I tried flushing and then setting up a new ppp interface through the telnet interface, but even here the router will only accept usernames that end with "@btinternet.com", so it looks like the only way forward would be to change the firmware.

When telnetting in, in the "software" program group, there is a program called "download" - when you run this, you are prompted for the following parameters:
filetype; url; username; password; filesize; targetfilename

After entering these parameters, the router waits about 15 seconds, and then restarts, presumably to try and download a new firmware image using the values you specified.

Since this router is in actual fact a Speedtouch 780 (i think! someone on google groups seemed pretty convinced of the fact *shrug*), i obtained a firmware image, and hosted it on a ftp server on my machine. I tried the following parameters:
filetype=bin; url=192.168.1.xxx; username=xxx; password=xxx; filesize=2822395; targetfilename=ST780_6172UK.bin

The router rebooted, and then just came back online with exactly the same firmware as earlier (use the "software version" program to check this, ZZJMAA6.11K was reported), so either the parameters were wrong (the only one i was unsure of was the filetype), or this has been locked down as well to only use a certain url etc. regardless of what is entered.

The only other option to change firmware i could find any mention of for Speedtouch routers was "expert mode", although i could not find how to enter this mode on this router - on other Speedtouches, you either just log in to telnet as "expert", and you're presented with a challenge string, or you log in as normal, and use "td prompt" - neither of these approaches worked. Once in expert mode however, it should be possible to upload a new firmware image to the router via ftp to the "dl" directory, and then tell the router to use this new image.

Hopefully someone with more knowledge of these things than me can take this further.

The BT home hub is a Speedtouch 7G in fact and not a speedtouch 780WL, firmware for the speedtouch 7G can be obtained from http://www.thomsontelecompartner.com/en/index.php, though you need to get an account with them.

I had a bit of time to play with it last night.

Telneting into the default IP address (192.168.1.254) I found the command line is much the same as other Alcatel/Thomson Speedtouch devices. The command that would unlock it is:

ppp ifconfig intf=Internet user= password=

..but it immediately fails with the error that it can't save the username.

So I tried deleting the "Internet" interface and creating my own, same problem. The "btbroadband.com" user must be hardwired into the firmware. There doesn't seem to be a way to dump the current firmware image any place.

I also tried deleting all the preinstalled users accounts so that I could get in with the highest privilege as described here: / but it made no difference either.

The only possibility to unlock this and make it useful with other ISP's is to get hold of the standard Speedtouch 7G SIP firmware.

The commands to upload the firmware seem available and not locked, all that is needed is the firmware image on a nearby webserver.

-P

the bt home hub, what model number do you have?
is the white one looks like the television add with the spotty sales boy?
if so you may be able to use a manual setup in windows, depends on your knowledge of what cable type you use, ethernet is hard but worth it, usb is a sheep, you say it dose.

the bt home hub, what model number do you have?
is the white one looks like the television add with the spotty sales boy?
if so you may be able to use a manual setup in windows, depends on your knowledge of what cable type you use, ethernet is hard but worth it, usb is a sheep, you say it dose.

Originally Posted by Icarus1701

It's the white one, which I now know for sure is based on the Speedtouch 7G

The Windows setup is even more restricted that the web interface and the telnet CLI interface.

I'd really like to get hold of the unrestricted firmware, without that it's a useless brick to me.

-P

can i change my bt home hub server ip?

Hi,
Just to say, Im a member of the Thomson Communication partner network and just to test, I downloaded the firmware for the 7G, the 780 and the 712 models, none of which are the right versions for re-flashing a homehub back to open settings. My guess is that Thomson just made the hardware and the boot-loader and BT did the rest.

Mat

Hi,
Just to say, Im a member of the Thomson Communication partner network and just to test, I downloaded the firmware for the 7G, the 780 and the 712 models, none of which are the right versions for re-flashing a homehub back to open settings. My guess is that Thomson just made the hardware and the boot-loader and BT did the rest.

Mat

Originally Posted by Mat.

It might be like the Sky locked firmware netgears, if you try and upload a vanilla firmware it rejects it, you need to use netgears recovery tool to force a re-flash, and then all is peachy

Dont suppose theres anything like that for the Thomsons ? (its meant for recovery routers that have failed to flash properly and are inaccessible by the normal routes)

Hi,

I have been playing with the home hub,

It seems you can 'backup' the configuration and edit and 'restore' it and thats how i gave myself more privileges than the Tech support account.

Haven't tried it on another ISP tho.

Hi,

I have been playing with the home hub,

It seems you can 'backup' the configuration and edit and 'restore' it and thats how i gave myself more privileges than the Tech support account.

Haven't tried it on another ISP tho.

Originally Posted by m456465

How did you backup the config? I think thats been tried before and the system rejects the file if the username and password dont equal something about BT? (anyone clarify this?)

Ive not seen a 'Force Reflash' app like the one netgear produces, so Cant comment, will keep my eyes open thought.

Hi Mat, I've been given one of these lubberly looking boxes by a friend & hope to get it working on my mother's TalkTalk connection. I'm sure the hardware IS the same as the 7G & I reckon I know a way of flashing it... any chance of posting the firmware somewhere & i'll report back if I work it out??

]-[

the chipset in this router is a broadcom bcm6348
found in Dynalink ADSL2+ or Belkin 7633. I wonder if you can upgrade firmware from these

I opened the router BT HOME HUB and found it made by broadcom

good luck

tucup

the chipset in this router is a broadcom bcm6348
found in Dynalink ADSL2+ or Belkin 7633. I wonder if you can upgrade firmware from these

I opened the router BT HOME HUB and found it made by broadcom

good luck

tucup

Originally Posted by tucup

The chips on the board may be Broadcom and it may be contract manufactured by Broadcom (if they do such a thing) but it's definately a Thomson product.

-P

I reckon I know a way of flashing it... any chance of posting the firmware somewhere & i'll report back if I work it out??

]-[

Originally Posted by hunta2097

hunta2097,

PM me, I can help you out.

sportq

Hi,
I seem to be having success with the Home Hub - it doesn't really seem to be locked down at all! I got SuperUser rights using the config backup/restore method and have even got the Hub working with FWD instead of BT's VOIP service. I'm keeping track of what I am doing at www.homehubblog.com ... the info I post is a bit brief (I've never been any good at creating massive user-friendly guides).

Anyway, I'm currently trying to get DynDNS working on it, but haven't succeeded yet ... it doesn't look like there's anything stopping it, but I haven't played with all the settings yet.

Al

Hi,
I seem to be having success with the Home Hub - it doesn't really seem to be locked down at all! I got SuperUser rights using the config backup/restore method and have even got the Hub working with FWD instead of BT's VOIP service.
Al

Originally Posted by Al_N

Try getting another ISP registered though!

It lets you enter the details but the says it can't set the username. This happens even if you flush the builtin users privs and login as superuser. It's a start, but unless we can get other ISP's to work it's just a (rather large) SIP ATA with a DECT base station built in.

I've tried flashing the Speedtouch 7G firmware (BANT-7 hardware type) but it rejects it. Seems the header is in cleartext but the firmware payload is encrypted, I tried modifying the product header in the file to be BANT-Z, still no joy. Same result if you put the hub into BOOTP firmware upgrade mode, which is one way to bypass the checks on other devices with locked firmware.

Good luck with your hacking though. Keep us posted if you get any further as there are a few of us working on this.

sportq

Hi,
Ah, I haven't tried with another ISP yet. I managed to modify the username using the config backup/restore method ... whether this has any effect on what it uses to authenticate, I don't know.

Having played with some of the other functions (DynDNS), the settings are there, but nothing seems to happen on the router's end. I suspect the firmware is crippled in some way?

Where has the non-BT firmware come from? I'd be interested to have a play.

Al

Hello,

I'm attempting to use a homehub to connect to demon as my ISP, however I'm having absolutely no joy whatsoever, - I can't find any configuration settings that I can change on the hub to allow me to connect to demon. Is it actually possible to connect to any isp other than BT with one of these?
I emailed BT tech support but they just replied with a list of what information I can glean from the router if I want, but no information on how to set it up.

From this (and reading through this post) I suspect that without doing some unlocking this wont be possible.. am I correct?

Thanks for your time
Matthew

Hi,

I managed to get one of these on the cheap. I have managed to alter the behaviour of the status lights. lol. I have also managed to get it working as a Wireless Access Point behind my existing ADSL router. I've managed to remove all the default users and create my own, but obviously this still doesn't allow you to alter the 'important' settings

I haven't been able to use it as a SIP phone though; I have set up a trixbox/freepbx distro and tried to connect it via the ethernet, but it refuses to register. Any help or guidance on that will be greatly appreciated.

If someone would like to pass the 7G firmware onto me, I would be happy to have a play also

Did someone try to use the bt firmware recovery tool to force flash
to the generic ST 7g firmware ?

Btw anyone can pass me the r6.1.9 ?

I have just attempted to flash the HomeHub with the 7G firmware, by force feeding it through the BT firmware upgrader... Through the update, the 'Internet' and 'Broadband' lights are lit but very very dim... The update wizard reaches 100% on installing new software and then fails after some time.

I turned the HomeHub off after about 30 mins, and then back on; and it seemed to load the BT firmware, but with factory defaults.

When I loaded the 7G firmware in the SpeedTouch Upgrade Wizard, it told me it wasnt compatible. I don't know if that was because it was locked to BT or if it was the wrong firmware.

Does anyone know the update settings to use with the CLI/Telnet interface. What the update file should be called when it is copied to the router?

I have just attempted to flash the HomeHub with the 7G firmware, by force feeding it through the BT firmware upgrader... Through the update, the 'Internet' and 'Broadband' lights are lit but very very dim... The update wizard reaches 100% on installing new software and then fails after some time.

I turned the HomeHub off after about 30 mins, and then back on; and it seemed to load the BT firmware, but with factory defaults.

When I loaded the 7G firmware in the SpeedTouch Upgrade Wizard, it told me it wasnt compatible. I don't know if that was because it was locked to BT or if it was the wrong firmware.

Originally Posted by studioeng

Ahh, Ok.
You'll need the Bant-Z firmware, if you open the *.bin file with a Hexeditor
you'll find either BANT-7 or BANT-Z listed.

How is about the firmware from inventel (DV7213) ?
did someone try to signup to their support
(requires Wep and of Product no. of the product/hub) ?
Not sure if it is available on their page however.

Ahh, Ok.
You'll need the Bant-Z firmware, if you open the *.bin file with a Hexeditor
you'll find either BANT-7 or BANT-Z listed.

Originally Posted by Sides

Do you mean I will need to change the value from BANT-7 to BANT-Z or this will tell me what firmware I have? If it is to just see what type, the SpeedTouch Upgrade Wizard tells you which type it is.

Last night I attempted a manual update via the cli/telnet; I set the target filename as upgrade.bin. For about 20mins or so, all the lights on the router flashed, which is said to be upgrading.... After it finished, it was just back to BT firmware again.

So am I safe to assume the HomeHub is set to only accept BT signed firmware, and revert back it upgrading fails!? I will look at the 7G and 11M firmwares under a (hex editor) microscope to locate any differences.

Editing the firmware won't help,
since bant-7 and bant-Z seems to be different (maybe smaller ram ?).
Besides sportq already tried tftp the same firmware i guess,

Since the homehub is actually from inventel,
i suggest asking them to release the source code
just like the case with the wannado livebox.

Adding a jtag connection might be helpful, incase someone bricks his box, btw.

Btw, I don't own a homehube yet and my soldering skills are zero.

Hi

I have put up some pictures and stuff up at



It seems it runs linux! so they have to give up the source code!

Studioeng - how did you get the hub to operate as a Wireless Access Point only? I'm interestred because I would rather keep my 3com adsl/router and just use the hub to extend its range.

If so used, I assume the hub will be no good for VOIP, though?