| View previous topic :: View next topic |
| Author |
Message |
Alex Kemp
Site Admin
Joined: 30 Jun 2004
Posts: 2858
Location: Nottingham, England
|
 Posted: Mon Oct 12, 2009 5:45 am Post subject: BT Home Hub v1 unlocked, 100% working using CANT-A F/W |
 |
|
PsiDOC contacted me Fri Oct 09, 2009 5:22 am by PM with the Subject line above. After some clarification, I discovered that:- The inspiration came from a thread in the Alcatel forum.
- All the files were sourced from this site.
- The final genius that allowed TG790 firmware to be loaded was PsiDOC's own.
I got all the files together across the weekend, and wrote the readme. The file is being processed right now & will be available in a few hours:
This is the enclosed readme: | Code: | Converting the BT Home Hub to a Thomson TG790 (almost)
---------------------------------------------
Warning beforehand:
------------------
Following the advice in this archive may destroy your computer equipment.
Your wife may divorce you, your parents disown you & your staff despise you.
You have been warned.
Tested with:
-----------
BT HOME HUB V1: Black edition
Serial No: CP0722FHUMS PCB No: E150630 94V-0
Method:
------
1 Install JTAG on Motherboard.
2 Construct cable for computer port.
Look at Schematics/ for pictures, more assistance with both items above.
3 Load brjtag software bundle (Binaries/).
4 Dump BT-HH CFE. Copy + re-name after.
Command used:
brjtag -backup:custom /window:1F400000 /start:1F400000 /length:0040000
5 Paste &h1FF20-&h20250 from CFE/CFE_CANT-A.bin to BT-HH CFE at same location.
See Utilities/HxD.exe (hex editor).
6 Restore BT-HH amended CFE to router.
Command used:
brjtag -flash:custom /window:1F400000 /start:1F400000 /length:0040000 /bypass /forcealign
(should take approx 100 seconds)
(brjtag will not recognise the BT flash-chip, hence custom commands)
(At this stage the HH will still boot the standard firmware, but show up as `CANT-A' on details page)
7 Either: i)Load Thomson Firmware (needs to be modified - see `Firmware (modded)/' directory)
ii)Load BT Firmware (also needs to be modified, see below)
Notes:
-----
a JTAG pin-assignment:
Parallel Port - Signal - Connection
-----------------------------------
13 - TDO - TP32
2 - TDI - TP33
4 - TMS - TP34
3 - TCK - TP35
20 - ground
25 - ground
(see Schematics/jtag-hairydairymaid.png for resistors used)
b The BT CFE checks new firmware for a signature in the header: specifically,
&h06 and &h07 which need to be `51' and `52' resp.. Thus, the first 9 bytes of
CANT-A firmware need to modified from:
42 4C 49 32 32 33 55 31 30
to: 42 4C 49 32 32 33 51 52 30
Thomson firmware in `Firmware (modded)/' is ready-modified for use.
c The amended BT CFE will check new firmware for a `CANT-A' string in the header.
Thus, the 6 bytes at &h136 need to read `CANT-A'. BT firmware reads `BANT-Z'.
The following is from BT r6.2.6.H firmware file ZZK3BP626H.bli; change
from: 00000130 AF 82 6F 6D 08 06 42 41 4E 54 2D 5A 09 0D 53 70 ¯‚om..BANT-Z..Sp
to: 00000130 AF 82 6F 6D 08 06 43 41 4E 54 2D 41 09 0D 53 70 ¯‚om..CANT-A..Sp
(Tested with 6.2.2.6 and 6.2.6.H)
d The lights on the front are re-arranged as per using ST-7G f/w r6.1.9.6
e The hub phones will not work on FXO (landline) port. VoIP is fine (tested on SIPGATE)
(virtual FXO adapter different?).
f CFE/CFE_CANT-A.bin originally obtained from ST-7G using stjtag.exe, then bytes
'flipped' to be readable (brjtag auto-alters byte order to suit viewing platform;
stjtag does not).
BT-HH Versions
--------------
The BT Home Hubs have been produced in 3 versions so far:
1) v1 BANT-Z - originally white, also in black `limited edition'.
No dedicated reset/restart button.
Equivalent Thomson product is BANT-7 ST-7G / DV7213 / ST-790
2) v1.5 BANT-Z (?) - originally white, also in black `limited edition'.
Dedicated reset/restart button.
Equivalent Thomson product is CANT-A ST-7G / DV7213 / TG-790
3) v2.0a CANT-2 - only in black
Equivalent Thomson product is unknown.
All the hard work above achieved by PsiDOC.
See also http://forums.modem-help.co.uk/viewtopic.php?t=3677
Compilation by Alex Kemp.
------------------------
Copyright (c) Modem-Help, Ltd.
12 October 2009 |
Finally, for those wanting some extra help on soldering the JTAG or using the software to dump the CFE, look at these Alcatel/Thomson forum links:
2009-12-01 Edit by Alex Kemp
Edit reason: PsiDoc has found that original 0.01% error caused by home wiring
_________________
Alex Kemp
Last edited by Alex Kemp on Tue Dec 01, 2009 5:34 am; edited 1 time in total |
|
| Back to top |
|
 |
PsiDOC
V.34
Joined: 06 Dec 2008
Posts: 31
Location: Wales
|
| Posted: Mon Oct 12, 2009 8:57 pm Post subject: |
|
|
Thank you Alex. If anyone has any questions please post them here or pm me.
Although I think it's you that deserves the thanks. You had the idea. I simply put all the ducks in a row and got it to work.
Now a question for everyone:
Can anyone shed any light on the reason why the FXO port won't work? Is there anything I can do to test it? I know it works on BTHH Firmwares.
If we can crack that final hurdle we then have a fully working solution for the BTHH.
Psi
_________________
To insanity... And beyond! |
|
| Back to top |
|
|
deadly
Joined: 12 Oct 2009
Posts: 5
Location: Bahrain
|
| Posted: Mon Oct 12, 2009 10:43 pm Post subject: |
|
|
1. Does this remove the ISP lock with BT FW as well? (as slock.txt file (simlock) isn't modified to blank)
2. You mean, we have to modify BT Homehub V1.0 's CFE & original FW from BANT-Z to show CANT-A? (Isn't CANT-A only for BT Homehub v1.5?)
Lastly, I think it will of great help to those with BTHH v1.5 to unlock their hub to any ISP rather than those with BTHHv1.0
Thanks for the great work! |
|
| Back to top |
|
|
deadly
Joined: 12 Oct 2009
Posts: 5
Location: Bahrain
|
| Posted: Tue Oct 13, 2009 2:37 am Post subject: |
|
|
| PsiDOC wrote: | Thank you Alex. If anyone has any questions please post them here or pm me.
Although I think it's you that deserves the thanks. You had the idea. I simply put all the ducks in a row and got it to work.
Now a question for everyone:
Can anyone shed any light on the reason why the FXO port won't work? Is there anything I can do to test it? I know it works on BTHH Firmwares.
If we can crack that final hurdle we then have a fully working solution for the BTHH.
Psi |
Have you tried ZZN1AA6.2T2 firmware (modded) on unlocked BThh? |
|
| Back to top |
|
|
PsiDOC
V.34
Joined: 06 Dec 2008
Posts: 31
Location: Wales
|
| Posted: Tue Oct 13, 2009 7:18 am Post subject: |
|
|
Deadly in answer to all your questions:
1: No it doesn't remove the ISP lock with the BT firmware. The mods to the CFE were to make the CANT-A firmware load and run. If you revert back to the BT F/W it's as it was.
With regards to the slock.txt file I know where it is but all efforts to mod it have been in vain as it is in a read only archfs file block in the read only squashfs file system which in Version 6.2.2.6 has inbuilt corruption to stop you unpacking it!
2: Yes we're basically modding the CFE to CANT-A.
I did this mod on a BTHH V1.0 Black edition so yes it does work with the 1.0 and works well. This should work with the 1.5's as well seeing as the firmwares for the 1.5 and the 1.0 are compatable back to 6.2.2.6. Granted it is unconfirmed as of yet as I don't have a 1.5 to test however if some kind soul out there would like to try. (Just remember to keep a backup of the original unedited CFE to flash back to just in case).
3: The ZZN1AA6.2T2 is for the BANT-7. If I could get a bant-7 CFE dump then yes I could get that firmware working. Alas I don't have the CFE and have searched all over for it.
If you know of one or indeed if anyone else has the BANT-7 CFE please let me know as I'd love to try it.
Finally thanks for the comments. It's nice to be appreciated.
Psi
_________________
To insanity... And beyond! |
|
| Back to top |
|
|
deadly
Joined: 12 Oct 2009
Posts: 5
Location: Bahrain
|
| Posted: Wed Nov 04, 2009 4:12 am Post subject: |
|
|
| PsiDOC wrote: | Thank you Alex. If anyone has any questions please post them here or pm me.
Although I think it's you that deserves the thanks. You had the idea. I simply put all the ducks in a row and got it to work.
Now a question for everyone:
Can anyone shed any light on the reason why the FXO port won't work? Is there anything I can do to test it? I know it works on BTHH Firmwares.
If we can crack that final hurdle we then have a fully working solution for the BTHH.
Psi |
Hi Psi
I tried your method step by step with one of my Hub 1.0 (as mentioned on psidoc.com/homehub/). I tried both modded firmwares ZZGKAA7.417 & ZZGQAA6.2T2.
With ZZGKAA7.417 firmware, I got the PSTN/ FXO port working with default setting. Yes FXO port is working with me, dial tone is there (when the Telephony service is disabled or the sip service is unregistered). I can make & receive call via normal pstn line. I used a normal phone connected via Phone jack at the back of the hub (as I don't have dect phone to try).
With ZZGQAA6.2T2 firmware, the FXO port doesn't work.. no dial tone.. Only FXS port i.e. sip service is working.
Hope this helps.
I had noticed that with ZZGKAA7.417 firmware the Bthub is very slow at restarting.
Thanks a lot for your hard work... |
|
| Back to top |
|
|
PsiDOC
V.34
Joined: 06 Dec 2008
Posts: 31
Location: Wales
|
| Posted: Thu Nov 12, 2009 5:27 pm Post subject: |
|
|
Deadly.
Now that is a turn up for the books and thank you for replying. If the FXO works on the phone port then it should work on DECT. Which home hub did you do reflash? V1 white V1 black or V1.5?
Did you use the CFE.bin supplied in the package or did you modify your own?
If you did your own any chance of a copy of it to see how different it is from the ones I have?
Always amazes me how far these things travel. That's one in Aus and one in Bahrain I know of now!
Psi
_________________
To insanity... And beyond! |
|
| Back to top |
|
|
deadly
Joined: 12 Oct 2009
Posts: 5
Location: Bahrain
|
| Posted: Fri Nov 13, 2009 5:33 am Post subject: |
|
|
Which home hub did you do reflash?
BT home Hub V1 (white)
Did you use the CFE.bin supplied in the package or did you modify your own?
Yes I used the supplied CFE. |
|
| Back to top |
|
|
PsiDOC
V.34
Joined: 06 Dec 2008
Posts: 31
Location: Wales
|
| Posted: Fri Nov 13, 2009 3:52 pm Post subject: |
|
|
Ah the White V1. That is the only one I haven't done! Have done 2 black V1's and 2 White V1.5's using this method.
Wonder if anyone else has had success with the white V1?
Psi
_________________
To insanity... And beyond! |
|
| Back to top |
|
|
wakaru
Joined: 09 Nov 2009
Posts: 6
|
| Posted: Wed Nov 18, 2009 5:37 pm Post subject: |
|
|
I've managed to flash:
* White BT HH v1.0 (Currently on 6.2.29.2 Firmware version)
* White BT HH v1.5 (Currently on 7.4.1.7 Firmware version)
I've used the CFE.bin supplied in the package for both.
I intend to do a few trials on both HH (swapping firmwares as well) to find possible changes in behaviours (mainly for the FXO line).
I've kept a backup of the old CFE from both, though I guess those will be of no use for anybody. |
|
| Back to top |
|
|
PsiDOC
V.34
Joined: 06 Dec 2008
Posts: 31
Location: Wales
|
| Posted: Fri Nov 20, 2009 11:12 am Post subject: |
|
|
Wakaru,
Please do have a play with them. You may hit on an idea that we haven't and all ideas are apprecated.
With regards the cfes you have backed up I always keep a copy of the original files till I am 100% happy with the unit. That way I can revert back to stock in the event of any problems.
Psi
_________________
To insanity... And beyond! |
|
| Back to top |
|
|
wakaru
Joined: 09 Nov 2009
Posts: 6
|
| Posted: Sat Nov 21, 2009 11:56 pm Post subject: |
|
|
I will keep the CFE backups just in case then. Thanks very much for the advice.
I will post my findings whenever I finish experimenting with them.
I would also like to know something. Does the CFE get replaced after every upgrade/downgrade? What I would like to know is that if I were to install the official BT Firmware through the BT HH Recovery Util (I am assuming that I can), Would be able to return to 6.2.29.2 or 7.4.1.7 Firmware using the ST Firmware Recovery software or would I have to use the JTAG again to reflash the CFE?
Thanks. |
|
| Back to top |
|
|
PsiDOC
V.34
Joined: 06 Dec 2008
Posts: 31
Location: Wales
|
| Posted: Mon Nov 30, 2009 8:05 pm Post subject: |
|
|
Alex.
After reports by others that the FXO port works without any settings editing I have had another look at this.
I can quite safely say the FXO port is working straight off the bat after perfroming the mod and setting up for internet and pairing the hub phone.
The only reason I can think of for not getting a dialtone was the dodgy phone wiring in my house that I have now replaced.
I think we can now put this to bed as 100% working.
Would you kindly edit the title to reflect this.
Thanks.
Psi
_________________
To insanity... And beyond! |
|
| Back to top |
|
|
Alex Kemp
Site Admin
Joined: 30 Jun 2004
Posts: 2858
Location: Nottingham, England
|
| Posted: Tue Dec 01, 2009 5:35 am Post subject: edit done |
|
|
| PsiDOC wrote: | I think we can now put this to bed as 100% working.
Would you kindly edit the title to reflect this. |
Sorted.
_________________
Alex Kemp |
|
| Back to top |
|
|
deadly
Joined: 12 Oct 2009
Posts: 5
Location: Bahrain
|
| Posted: Tue Dec 01, 2009 10:29 pm Post subject: |
|
|
| PsiDOC wrote: | Alex.
After reports by others that the FXO port works without any settings editing I have had another look at this.
I can quite safely say the FXO port is working straight off the bat after perfroming the mod and setting up for internet and pairing the hub phone.
The only reason I can think of for not getting a dialtone was the dodgy phone wiring in my house that I have now replaced.
I think we can now put this to bed as 100% working.
Would you kindly edit the title to reflect this.
Thanks.
Psi |
Nice to hear that you sorted out the problem with the FXO port.
On another Bt hub, I did a hard reset by holding the Wireless Association key for 15~20 seconds after flashing modded firmware and got the FXO port working...
Cheers |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
