Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[kitz]

Thanks for the update Zach and good luck at the conference.

[goral]

HI
I just little bit confused.
Do I need root BT HUb 3.0b to get WDS (wireless distribution system)?
Can anybody explain me in steps how to do it?
Thanks.

[zcutlip]

HI
I just little bit confused.
Do I need root BT HUb 3.0b to get WDS (wireless distribution system)?
Can anybody explain me in steps how to do it?
Thanks.

The exploit that I released earlier this year for the Home Hub 3.0b does not unlock the device, per se, nor does it enable any additional configuration capability.  It is of interest to those concerned with further researching the device in pursuit of an actual unlock.  I had thought one would come relatively easily once we had root, but it has turned out to be quite challenging.

Zach

[zaph0d]

http://docs.google.com/file/d/0B6wW18mYskvBY2FZalRBUzRwR2M/edit

Thank you!

Everyone here who put effort into this stuff and maintains it is the bomb.

Props
asbokid- rock on.

[p4r4d0x86]

Hi,

Is there someone who saved the picture of the Olympus MA-USB1 asbokid hack ?
I tried to mod my MA-USB1 without success (media not found)

Thanks
Nico

I saw your post on the BT hub 3.0 nand dump using a sm/xD card reader. Can I ask where you did buy that spesific modell?  Thanks for posting all the info and pictures, it helps me on my project!:)

Hi toffit,

The Genesys Logic GL827 card reader?   It was 99p from ebay. The seller is in sunny Smethwick, iirc.  Anywhere near you?

modified USB reader for SM/XD cards (Genesys Logic GL827 controller)  (click to enlarge)

That card reader is not however the best choice for NAND hacking since it needs modifying.  It is hardwired for xD-Picture cards. The GL827 controller uses (active low) lines to detect a xD-Picture and a SmartMedia card (signals XD_CDZ on pin 1 and SM_CDZ on pin 2.  So these need swapping.  See GL827 Datasheet here [1] )

The GL827 also handles automatically the Error Correction Code specified in the xD and SM card standards.  However, the embedded device (BT Home Hub or whatever), will almost certainly use a different ECC algorithm in its own NAND driver. So while the GL827 is fine for dumping the NAND contents, it is probably no good for re-flashing new data into the NAND (since there is no control over the ECC contents).

Currently, just experimenting with a different (obsolete) card reader for NAND hacking - the Olympus MAUSB-10.

Olympus MAUSB-10
(click for full size)


Olympus MAUSB-10
(click for full size)


Olympus MAUSB-10
(click for full size)

The MAUSB-10 is based on the 'Alauda' NAND controller IC, believed to be from RATOC Systems of Japan.

RG85550 a.k.a Alauda' NAND controller
(click for full size)

Daniel Drake discovered that the Alauda IC supports raw access to the whole NAND page [2]. Allowing arbitrary data to be written to the main area and the spare (out of band) area used for ECC.  Which makes it a much more useful NAND controller.  Potentially putting it in the same category as a $2000 commercial NAND flash programmer. [3]

Daniel's Linux kernel device driver for the Alauda is broken today (and no longer maintained) but cory1492 has generously released his ported code that runs in userspace using the libusb library.  It works well in both Linux and BillyGatesWare.  [4]

Once this is working as intended (testing at the moment with another board) it can be documented properly.

cheers, a

[1] http://www.genesyslogic.com/manage/upfile/12021817731.pdf
[2] http://www.reactivated.net/weblog/archives/2005/08/alauda-mausb-10/
[3] http://www.xeltek.com/Nand-Flash-Programming/
[4] http://www.xboxhacker.org/index.php?topic=15596

[insidejob]

Interesting thread. I were searching for circuit board photos that lead me to this thread.

I bought myself a cheap home hub 3 for my own reasons and may work better than the new versions. I have HH3 version B as everyone seems to believe this is better.

Anyway I were looking at a photo of the wireless chip but I can't see it at all on my version and seems I have a different motherboard. Mine says version.A but I dont believe it has anything to do with the revision A. Cant find the wireless chip on the board.

[ejs]

I'm assuming the photo you posted is an example of the wireless chip on a 3A, and not a photo from your own 3B.

The wireless chips will be different. For the 3B, according to the openwrt wiki it's integrated in the main Broadcom SoC.

[insidejob]

Hi ejs. Yes it were an example from here. https://gadgetcat.wordpress.com/2011/02/19/home-hub-3-disassembly/

I must admit I thought it would be the same but didn't take any notice to start with, of what hub version this person were disassembling.

My hub says type B and have taken a quick photo of the main side to show you. As I can't see the wireless chip on it. Not unless I am not looking hard enough or for the wrong example, as above.

[insidejob]

So anyone know where or what the wireless chip is then in this home hub v3 B? Hope the photo above is OK for you.

[ejs]

For the 3B, according to the openwrt wiki it's integrated in the main Broadcom SoC.

The SoC being the main chip, under the silver heatsink. There is no wireless chip as such, the wireless functions are within the main chip that also does lots of other things.

[Vido]

Does anyone have pdf from this link http://www.lantiq.com/uploads/tx_abzlantiqproducts/PB-e-0016-v1_lres.pdf TNX ?