Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[LegendaryAced]

Hi all,

I have a Huawei MT992 for G.fast with a TT WiFi Hub. I have the suspicion that my line does not sync at the max 160/30 profile anymore and I would like to confirm that. I also want to see the line stats and all the goodies I used to be able to see with its VDSL 'parent' the Echolife HG612.

Could someone help me with the unlocking process? I believe it should be the same, but I would need a suitable firmware for this.

Regards,
LegendaryAced

[j0hn]

Have you tried the firmware recovery procedure that worked for the HG612 to see if that page even loads?

I don't think we've even seen images of the circuit board and I don't know what your technical knowledge is like or if you have ever had experience with USB TTL serial adapters?

As it stands this device can't be unlocked and if a software recovery page can't be reached the device will likely need opened.

I have an eBay saved search for MT992 but nothing has come up for months.

[burakkucat]

Welcome to the Kitz forum. 

The Huawei MT992 is a rare beastie and they do not appear to be easily obtained. To date, I have not read any details of one being "forensically" examined and unlocked.

If a locking method, similar to that with the HG612 has been used, then it will require a complete image of the flash contents to be extracted, decompressed, the ACL adjusted to restore access from the Ethernet port before being re-compressed and uploaded back to the device's flash memory.

A simple, preliminary, test that you could do would be to start with the MT992 in total isolation -- no connections to either the DSL or LAN ports -- then press & keep pressed the reset button whilst connecting the power with your other hand. Keep the reset button held for at least 30 second from the time you applied the power. Note any changes that occur with the LEDs. Finally release the reset button and leave the MT992 alone for, say, five minutes. Having allowed the device time to "settle", now connect an Ethernet patch lead to the LAN port and connect the other end to a computer. Configure the computer's LAN port to have an IPv4 address in each of the private, non-routable, addresses in turn. (At this point the one experiment has been multiplied to three.) I'd start by using 192.168.0.100 as the computer's IPv4 address. Now perform a full nmap sweep on 192.168.0.0/16 . . . if two addresses are found to be responsive (one will be the computer at 192.168.0.100) then congratulations, you have probably found the IPv4 address of the boot-loader's firmware update page. 

[Or everything could go horribly wrong and the MT992 emits purple smoke . . . never to operate again. ((Q) Why purple? (A) It's the official Openreach colour.)    ]

Edit: I see j0hn's fingers were faster than my paws . . .

[LegendaryAced]

Thank you both for the responses.

I am a software developer and I understand most of the things you both describe. Unfortunately, these steps involve disconnecting the MT992 from the line causing further disconnects that might put a (further?) cap in my speeds by syncing (even?) lower. I'll see what I can do, and possibly try it with only one disconnect, but I want to give it some time before I try again.

Even if I find the boot-loaders firmware update page, how do I extract a copy of the firmware?

[j0hn]

Ultimately a device will need opened, and a USB TTL serial adapter will need connected to the pins on the devices circuit board to obtain the necessary dump of the firmware.

If the bootloader firmware recovery page doesn't exist it may mean that EVERY device wanting unlocked will need opened up and serial pins connected.
Like needs done with the ECI VDSL2 modems.

If the firmware recovery page exists then you can be semi-confident in the future that someone else will do the hard work and unlocking may be easier.

[fergie]

Just migrated to g.fast on BT and managed to talk the OR engineer into giving me an MT992 modem.

Any news on getting one of these unlocked or otherwise getting access to stats?  Happy to do some digging with some guidance, but probably not if involves cracking the thing open as would rather not have to revert back to Smart Hub!

[j0hn]

Nope. Still locked down.

[burakkucat]

Just migrated to g.fast on BT and managed to talk the OR engineer into giving me an MT992 modem.

Any news on getting one of these unlocked or otherwise getting access to stats?  Happy to do some digging with some guidance, . . .

If you could perform the experiment, as detailed in paragraph four of my initial reply (#2 above), please, that would be a (non-invasive) start. 

[impurepuritan]

If you could perform the experiment, as detailed in paragraph four of my initial reply (#2 above), please, that would be a (non-invasive) start. 

Hello Burakkucat, Sorry for resurrecting a very old thread as my first post. I just found this thread on google. I have an MT992 and i have just attempted the steps you mentioned. I believe the IP address of the MT992 is 192.168.1.1 much as it is for the HG612. However i'm unable to get to any UI at that IP.

I don't know if you have given up on this model as it's been some years now but I am a Sysadm and may be able to provide further information with some instruction?

[burakkucat]

Hello Burakkucat, Sorry for resurrecting a very old thread as my first post.

Welcome to the kitz forum. 

I have an MT992

Deployed for a G.Fast service?

i have just attempted the steps you mentioned. I believe the IP address of the MT992 is 192.168.1.1 much as it is for the HG612. However i'm unable to get to any UI at that IP.

In that case, physically opening up the device and making connections to the innards will probably be the only way forward. Is it worth doing? Only if you enjoy the intellectual challenge and have the time to spare.

I don't know if you have given up on this model as it's been some years now . . .

To be utterly honest, it is not something that really interests me, I was just making some suggestions for those who might have been prepared to give it a go.