Speedtouch 780WL firmware flash - incompatible?

Hi All,

I've got a 780WL that I'm trying to update the firmware on.

It was ISP locked by KPN so I'm having to go into this via bootp

I can get to the point where I select the firmware it the wizard wont accept it and claims it is incompatible

I've tried all the versions of the firmware I can find for the 780WL (and a few other models on the off chance)

The only thing I can see that seems difference is the device name on my board is reported as Speedtouch while the firmware is for model Speedtouch 780 - though I'm not sure if the wizard would be coded to enforce that or not....

Anyone know if there is a way I can modify the firmware to work with this, get a working firmware version or force the wizard to accept the firmware I am giving it and override its check?

Here is the device details from the wizard:

Device name: SpeedTouch
Serial number: 0626JTRAS
Mode: Kernel mode
Physical address: 00-14-7F-51-77-BA
Firmware version: 6.2.11.8.0
TP version: ?
Board type: BANT-R
Chip version: 0x1
Bootloader version: 1.0.6
Info: Kernel mode requested by push button.
Others:
name=SpeedTouch [0626JTRAS]
-device_id=0626JTRAS
-device_name=SpeedTouch
_board_name=BANT-R
_bootl_flags=64
_bootl_request_button=1
_bootloader_version=1.0.6
_build=6.2.11.8.0
_iftype=ETH
_macaddr=00-14-7F-51-77-BA
_prod_id=0
_variant_id=KP
_version_bootloader=1.0.6
_version_sea=0x1
mdap_version=1.1

Thanks

Simon

Oh if someone also has a working speedtouch 780WL and wouldn't mind putting it into bootp mode and loading the wizard to get these device details for comparison (something I would be very grateful for)

you get the box into bootp mode by holding down the reset button for about 20 seconds (after about 12 the power light goes red and it will do a factory reset but if you hold it until it goes orange it skips the factory reset and goes into the bootp mode)

Thanks

Simon

As you mentioned your Speedtouch 780WL has special firmware. In the Netherlands it is known as KPN's Experiabox (KPN=dutch BT; there is an other grey Experiabox made by Siemens!).
It is possible to upload modified firmware to the box, but this firmware will not be installed. I have been told that this is probably caused by a slightly altered
bootloader that rejects the newly loaded firmware.
With a jtag cable it should be possible to rewrite the bootsectors of the flash with the "standard" bootloader.
To do so you have to read the flash memory of a "generic" ST780 and write those data to an Experiabox with a jtag-cable or a serial connection.
This is all beyound my knowledge, so I hope I understood it correctly.
As I have an Experiabox/ST780 I am also very interested in converting it to a "generic" ST780WL.

I suspect I know someone with the hardware to update this... failing that I could put one together myself but not sure I have the time.

However what I would need is the image to write to the flash... unless the firmware binary supplied can be written as is, but then as you say it probably doesn't cover the boot loader.

I've been in touch with the speedtouch support and they are frankly useless

If only I had gotten the box in the uk I would already have started a legal case against them under fitness for purpose....

if you hear of a flash image that anyone has uploaded I'd love to hear about it and will happily give its a try.

Tel alternative for me I think will be to take a large hammer to this box then mail it to their customer support department marked as returned for disposal under WEEE regulations

Don't blame Alcatel Speedtouch for this problem. Alcatel Speedtouch does NOT sell KPN's Experiabox.
Also, KPN does NOT sell their Experiabox/ST780; KPN gives the Experiabox only on loan! So, there shouldn't be any Experiabox on the second hand market (e.g. on e-Bay)!
If you know someone who is able to read the flash memory of a generic ST780 and to write the red flash memory data to your Experiabox/ST780, I think, the problem would be solved. However, for that exercise you kneed to have a "generic" ST780. If you are interested in buying a "generic" ST780, you can find them on <> for about ? 60.= (excl. shipping). Be aware that there are two hardware variants, one for POTS (780WL) and one for ISDN (780(i)WL).
If you can not read dutch, I can send you one for the mentioned price.

Alcatel are equally to blame since they allow their box to be modified in this way, most likely they perform the modification and dont offer a way to return it to original state.

They do have the required binaries to do so, but have chosen not to release them.

The experia box is mine from when I lived in holland, when I cancelled my contract I did ask KPN if I needed to do anything else but they said no, that was it.

I'm not that interested in buying one, if I were to actually spend money I'd buy a much better model, I just dont like throwing away something which could be made to be useful.

Hi Simm1701,

I have recently received the speedtouch 780 WL, before this one I had the Siemens Gigaset SX553. With the Siemens I had no problems redirecting data traffic and portforwarding.

After installing the Speedtouch I ran into the same problems you mentioned. I was woundering if you did find a solution to your problem?

Please let me know.

Nope no joy - the box is fairly well buggered by KPN if its an experia box - and no trivial way of reversing it - even if you did have the time and hardware, you'd need a real 780 to get the firmware and bootloader

Mine got shipped back in small pieces to alacatel

You might consider reading how to access files from partner site here
https://the-scream.co.uk/forums/t22917-43.html?

Also once you have the firmware we managed to bypass the wrong firmware problem via changing the bant-7 to band-Z and the three letters after the bliXXX at start of firmware file for a speedtouch 7G / home hub. You will need a hex editor for this also how to on creating a JTAG cable is also availible around page 50 of that same thread.

Here is some firmware for the 780





I have marked the two enties that might need changing to be the same as a working firmware. I would still have a look at the thomson parnter site as to what firmware to use for your router and then download if it is different to the one I posted
Hope this helps

Moog, I tried flashing my 780WL with a firmware in bootp mode, but the firmware already comes with "BANT-R" in it... to what should this be changed to avoid the flash program to block the flash as it sees it as incompatible?
And does the bliXXX thing also need to be changed? If so, to what?

if it already has the correct BANT (board revision) then at the top of the firmware file it will say "BLIxxxYYx" the xxx and x are digits and the YY are alphas the YY needs to match a working firmware build for you machine. The YY I would suggest is what is kicking the flash out as incompatable.

You need either to get a version of the firmware that will flash and copy the above details from this or use a JTAG to get details directly from the flash around 1ff28 from the kernel dump if its like the 7G. Should have the router serial and product identifiers and the installed firmware version. The 7G has a BLI code of BLI223QR0 and from the TJAG dump something like 061004QR23 first numbers are the firmware version, the QR is the YY reference for the 7G board yours will be different

Thanks moog... but I have no idea how to get an original experiabox firmware, nor how to get/use a 'JTAG'.
There must be more people who have tried this?

The latest firmware for the generic Speedtouch 780WL can be downloaded from <>. However, this version was not as stable as the earlier version. More versions can be found on <>.
The firmware can be edited with a hex/dec editor, but it is compressed with properietary algorithm. I have not found a way to decompress it.
These firmware versions can be loaded to a generic Speedtouch and after transfer will be automatically installed.
However, to an Experiabox/Speedtouch the automatic transfer is impossible. After modification the firmware can be loaded on the Experiabox/Speedtouch, but it will not install! The bootloader recognizes that the firmware is not a right version (generic versus KPN/Experiabox).
I have been told that the only way to modify an Experibox to a generic Speedtouch is using a jtag-cable and then:
- read the flash memory form a generic Speedtouch
- write these data to an Experiabox/Speedtouch.
See also <>.

Edit 9th dec 2007:
On <> firmware <<780_Upgrade_R7417_sip>> has been withdramn. Now <<780_Upgrade_R62T2_sip>> is available as the latest upgrade

Anyone figured out how to unlock an O2 version? I have 6.2.27.2 on my router, but am experiencing some problems. There's some mention 7.x may be better (or worse) so I'd like to try.

So I took a look at the "recover.bin" from the O2 recovery CD. It begins
0000000 B L I 2 2 3 Q H 0 nul nul nul nul nul nul nul
4c42 3249 3332 4851 0030 0000 0000 0000
0000020 nul nul nul nul O 2 nul nul nul nul nul nul nul nul nul nul
0000 0000 324f 0000 0000 0000 0000 0000
0000040 ack stx esc stx nul nul nul nul nul nul soh f nul . L /
0206 021b 0000 0000 0000 6601 2e00 af4c
0000060 N Z f enq etx G j r 9 / gs ( B S * b
5a4e 85e6 c783 726a 2f39 281d d3c2 e22a
0000100 Q 4 ack us si ( j vt : . dc4 etb ^ cr [ =
34d1 1f86 280f 8bea aeba 9714 0d5e 3ddb

If I then compare to the original 7.4.1.7 :
0000000 B L I 2 2 3 Q H 0 nul nul nul nul nul nul nul
4c42 3249 3332 4851 0030 0000 0000 0000
0000020 nul nul nul nul 0 nul nul nul nul nul nul nul nul nul nul nul
0000 0000 0030 0000 0000 0000 0000 0000
0000040 bel eot soh bel nul nul nul nul nul nul soh _ nul / 4 si
0407 0701 0000 0000 0000 5f01 2f00 8fb4
0000060 gs ) } U T S us K a ) ` c : syn M >
a99d d5fd d354 4b9f 29e1 e360 96ba be4d
0000100 cr 3 m y ! q us j sp ; Q \ fs f n p
b38d f96d 7121 ea9f 3b20 dc51 e61c f06e

I notice:
a) The model number is the same
b) "0" in the original, whilst "O2" in the o2 version appears further down
c) The version number is in text from offset 0x40
d) BANT-R is present in both

So I tried fixing up b in my own copy of the firmware. However whilst the o2 recovery tool happily flashed it, the process did not complete. After flash I ended up with just just the power light on along with the INTERNET light red, flashing, and the modem apparently dead.

My guess is the modem refused to load the firmware that had been successfully flashed.

This "trick" appeared to work on the HH... or at least a similar trick.

Ideas?

Ah I missed the ref on p1 about the bootloader. Yeah it's a pain. I wonder what it's checking... could be simple... or could be more complex (encryption ...)

Anyone figured out how to unlock an O2 version? I have 6.2.27.2 on my router, but am experiencing some problems. There's some mention 7.x may be better (or worse) so I'd like to try.

So I took a look at the "recover.bin" from the O2 recovery CD. It begins
0000000 B L I 2 2 3 Q H 0 nul nul nul nul nul nul nul
4c42 3249 3332 4851 0030 0000 0000 0000
0000020 nul nul nul nul O 2 nul nul nul nul nul nul nul nul nul nul
0000 0000 324f 0000 0000 0000 0000 0000
0000040 ack stx esc stx nul nul nul nul nul nul soh f nul . L /
0206 021b 0000 0000 0000 6601 2e00 af4c
0000060 N Z f enq etx G j r 9 / gs ( B S * b
5a4e 85e6 c783 726a 2f39 281d d3c2 e22a
0000100 Q 4 ack us si ( j vt : . dc4 etb ^ cr [ =
34d1 1f86 280f 8bea aeba 9714 0d5e 3ddb

If I then compare to the original 7.4.1.7 :
0000000 B L I 2 2 3 Q H 0 nul nul nul nul nul nul nul
4c42 3249 3332 4851 0030 0000 0000 0000
0000020 nul nul nul nul 0 nul nul nul nul nul nul nul nul nul nul nul
0000 0000 0030 0000 0000 0000 0000 0000
0000040 bel eot soh bel nul nul nul nul nul nul soh _ nul / 4 si
0407 0701 0000 0000 0000 5f01 2f00 8fb4
0000060 gs ) } U T S us K a ) ` c : syn M >
a99d d5fd d354 4b9f 29e1 e360 96ba be4d
0000100 cr 3 m y ! q us j sp ; Q \ fs f n p
b38d f96d 7121 ea9f 3b20 dc51 e61c f06e

I notice:
a) The model number is the same
b) "0" in the original, whilst "O2" in the o2 version appears further down
c) The version number is in text from offset 0x40
d) BANT-R is present in both

So I tried fixing up b in my own copy of the firmware. However whilst the o2 recovery tool happily flashed it, the process did not complete. After flash I ended up with just just the power light on along with the INTERNET light red, flashing, and the modem apparently dead.

My guess is the modem refused to load the firmware that had been successfully flashed.

This "trick" appeared to work on the HH... or at least a similar trick.

Ideas?

Originally Posted by planetf1

You might want to read this http://forums.whirlpool.net.au/forum...m?t=896070&p=4

It doesn't work why are thease telling us it works it Doesn't work and I'm gonna have it removed and the and the web site shut down if they keep putting up softwate that Fk ups

Originally Posted by DJ9

You did not read the whole post.
The mentioned firmware versions are for a "generic" ST780. I did not say that you could use these firmware without (a unknown) modification on a locked ST780.
The bootloader checks the loaded firmware before installing and a locked ST780 rejects these to install.

You did not read the whole post.
The mentioned firmware versions are for a "generic" ST780. I did not say that you could use these firmware without (a unknown) modification on a locked ST780.
The bootloader checks the loaded firmware before installing and a locked ST780 rejects these to install.

Originally Posted by FBFATA1020

Quite right however there is a way, read whirlpool post they have managed to unlock these routers via JTAG see http://forums.whirlpool.net.au/forum...m?t=896070&p=6 and read to the end of thread