Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[ben1066]

Do we know where the UART port is? I'm happy to take my iron to my HH3, it's worthless until I can have OpenWRT on it, at least to me

[asbokid]

Do we know where the UART port is? I'm happy to take my iron to my HH3, it's worthless until I can have OpenWRT on it, at least to me

We should distinguish between the HomeHub 3.0a and the 3.0b here.. They are completely different devices in virtually identical cases.

If you are referring to the Broadcom-based HH3.0b, then neither a UART nor a JTAG interface have been found to date.

The thinking is that the NAND device was flashed with a networked bootloader before it was fitted to the HH3.0b board.

This 'factory' bootloader was used to download a firmware image to the device over ethernet. That image contained a 'production' bootloader with networking either disabled or nobbled. The new image was burnt to flash, overwriting the old 'factory' bootloader.

And only then was the device shipped.

cheers, a

[burakkucat]

Unlocking should not be a problem. It from what I can glean off the internet it's an openrg esque firmware so should be like the 2B / 3A unlock.
The hard part will be getting access to a cli. I am 99% sure that BT closed the simlink loophole we use to get access on the 2B and 3A from the initial firmware upwards so it may be hardware on the console port to unlock initially.

Ah, that is useful to know. I shall have to give my HH3B some serious consideration, when time permits. Hmm . . .

[bbnovice]

Hi:

Just an update ref my HH3 (Type B).

I never permanently implemented the "workaround" solution posted on other forums regrading stealthing the open ports 161 and 4567.

Today doing my usual ad hoc security checks of firewall and virus software I noted that port 4567 is now stealthed. And the "workaround" for port 161 now does not work. I've now tried it several times.

I cannot explain this and certainly do not like it. I think I will take my ebay 2Wire purchase out of its packaging and fire it up......... 

   

[burakkucat]

Just an update ref my HH3 (Type B).

I never permanently implemented the "workaround" solution posted on other forums regrading stealthing the open ports 161 and 4567.

If you are able, please post the link(s) that are implied in the above. 

[bbnovice]

Just an update ref my HH3 (Type B).

I never permanently implemented the "workaround" solution posted on other forums regrading stealthing the open ports 161 and 4567.

If you are able, please post the link(s) that are implied in the above. 

There is a link earlier in this thread. But here it is again (I'm afraid its 10 pages long)

http://community.bt.com/t5/Other-BB-Queries/port-161-open-on-home-hub-3/td-p/133207

[burakkucat]

Thank you, BBN.

I shall have to examine that link once again for, as I recall, it did not cover the Type B HH3.0. 

[Blackeagle]

b*cat, thought you were on TT ?  Is it merely curiosity (cats are renowned for it) or do you have another reason for your interest in the HH3 ?

B*eagle is curious now ! 

[burakkucat]

b*cat, thought you were on TT ?  Is it merely curiosity (cats are renowned for it) or do you have another reason for your interest in the HH3 ?

B*eagle is curious now ! 

Correct, correct and -- er -- correct! 

I have an interest is various modem/router devices (I have been using a 2Wire 2700HG[V|-B] with my TT line for the past year) and have a collection of the devices in my grotto.

Prior to the 2Wire, I was using a Netgear DG834Gv5 and prior to that, the TT supplied Huawei SmartAX MT880.

At the tail-end of last year, I obtained an eBay bargain of one (essentially) unused BT HH3.0B (plus the correct PSU), one (essentially) unused Huawei HG612, Type 3B (plus the correct PSU), one well-used original-type Huawei HG612 (with no PSU) and one well used PSU for a BT HH3.0A for the total sum of £18-00. 

Along with certain other regular members of this forum, I am an associate of the modem hacking maestro himself, Asbokid [1][2] (a.k.a. Asbokat. It is only after you notice that the surface of the butter is now really smooth do you realise why the cat was sitting on top of the fridge!    ).

PsiDoc's site [3] has the subtitle "Poking BT with a stick...  Then running away!". That humour appeals to me. 

So if an item is marked with a BT Group company logo -- be it BT Retail or Openreach -- then I am interested. 

[1] http://huaweihg612hacking.wordpress.com/
[2] http://hackingbtbusinesshub.wordpress.com/
[3] http://www.psidoc.com/

[asbokid]

Ye olde modem fryer at your service!

It seems that no one, as yet, has found UART or JTAG signals on the PCB of the BT HomeHub 3.0b.   It is possible that those signal lines have not been brought out from the CPU. UART and JTAG signals are often omitted for security reasons. Once a PCB has gone beyond the prototyping stage, it is commonplace to remove the tracks for JTAG/UART from the PCB artwork for a production PCB.

That doesn't make it an impossible device to hack. As a last resort, the flash memory IC could be removed from the PCB with a hot air gun. It would then be fitted to a flash prototyping board, allowing its contents to be disassembled.  That task is half done. See photo below.

The ribbon cable was 'donated' by a PCIe extender card (still attached).  The pink USB flash memory card readers cost 99p (delivered!), and the blue flash prototyping boards are 99 cents for two from China.

A strip of header pins needs to be soldered to the prototyping board, the flash IC needs to be hot-air-lifted from the HH3.0b PCB, and the ribbon cable needs splaying and a connector crimped on each of its 20 wires 

I did a dummy run with a genuine XD-Picture card and it's easy to extract (and re-write) the contents of a NAND flash IC using the Linux utility 'dd'.  Error Correction Code (ECC) has to be disabled (since it's proprietary and probably undocumented) but so long as the cabling is kept short (unlike in my effort), there shouldn't be a problem with noise.

EDIT:

This hardware hack method was used and the firmware for the Home Hub 3.0b has been extracted.  More details here. [1]

cheers, a

[1] http://forum.kitz.co.uk/index.php/topic,10161.msg220619.html#msg220619

[asbokid]

Hello beebee!

Today doing my usual ad hoc security checks of firewall and virus software I noted that port 4567 is now stealthed. And the "workaround" for port 161 now does not work. I've now tried it several times.

I cannot explain this and certainly do not like it. I think I will take my ebay 2Wire purchase out of its packaging and fire it up......... 
 

The 2Wires do have their own backdoors for remote management. This takes two forms.  There is periodic 'phone-home' (always on cold boot) and there is also a secure networked service listening for connections on the WAN-side.  Hacks for earlier versions of 2Wire firmware allow these 'features' to be disabled more or less

However, ideally, those backdoors would be removed altogether.  Work is in progress to open up a backdoor in the backdoor (a bit like a cat flap!), using JTAG :-)

In the USA, AT&T supplies 2Wire modems for its VDSL2 service which it markets as U-Verse.   These are high specification modems.  It would be great if they could be coaxed (excuse the pun) into working with Blighty Telecom's FTTC offering.

cheers, a

[bbnovice]

Ok,

I admit defeat. You have all done my head in.

Is there ANY cheap but reliable VDSL router out there I can use without being "hacked" by BT and/or sundry bad people when they feel like it?

I did not seem to have this aggro with ADSL and my old Netgear router or was I living in a fools paradise?     

[Blackeagle]

Depends !!

Are you just after a router to sit behind the BTOR modem, or do you want a combined offering to replace the two ??

In the first instance, any cable router should suffice, in the second, Fritzbox and Draytek make compatible VDSL modem/routers but these are not cheap.  They would however stop BT from access to any info from your kit.  This may be a breach of fibre T&C's though.

[bbnovice]

Hi Blackeagle,

Just looking at the router - don't want to fiddle with the modem.

Does that mean I could use my old DG834 simply as a router with FTTC?

[Blackeagle]

Hi Blackeagle,

Just looking at the router - don't want to fiddle with the modem.

Does that mean I could use my old DG834 simply as a router with FTTC?

No sorry 

Thats an ADSL router not a cable router.  If you have a look here to give you an idea of whats available.  Basically, you want one with a WAN port rather than an ADSL port.  The cable from the FTTC modem plugs into the WAN port.