@burakkucat
A couple of approaches come to mind. One would be to write a program (this could be as simple as a shell script) that monitors for the existence of the downloaded update file. When that file appears, and as long as it continues to exist, loop and make a copy of it. At one point I had worked out what the file gets named when BTAgent downloads it. I'll look into that and post back.
Another approach would be to run your WAN/PPPoE connection through a hub or LAN tap, and do a full packet capture, for days, or more likely, weeks. Tcpdump has options for chunking and compressing the capture. Analyze the capture in wireshark every few days to see what is going on between your HH3b and the mothership. Even if you don't see a firmware downloaded, you may see SOAP chatter that contains valuable intelligence.
@howlingwolf
At the risk of discouraging you, I suspect BTAgent has substantial dependencies on the BT hardware. At the very least, I think it will want to pull configuration information from NVRAM.
If you do want to pursue this, I'd download a ready-built Debian MIPS QEMU image. Copy the BT's root filesystem into a subdirectory of your Debian QEMU system. Then chroot into the BT root filesystem to run BTAgent.