BT HomeHub 5A Router UART Access Hack

Introduction: BT HomeHub 5A Router UART Access Hack

The BT HomeHub 5a is a pretty decent router, once you crack it open, wire into the UART interface and reflash the firmware with something like OpenWRT / LEDE.

But getting into the darn thing is not trivial and I decided to make it easier to access the UART port in the future.

This Instructable isn't about the re-flashing process, which is documented elsewhere, this is just how to get into the clamshell and leave things accessible and not too ugly afterwards.

Step 1: Getting Into the Case

The plastic case can be tricky to open, if you haven't got a mental map of where the various clips are placed, and how to open them without damage.

James Finnie posted a Youtube video on the process he went through, which I followed, so you should definitely watch that too.

In these photos I've marked the locations around the case where you need to focus.

Step 2: Start at the Very Beginning...

Begin by sliding a thin plastic strip into the top of the case, angled down and towards the back. This will release four clips along the top edge. Leave something in there to stop them snapping closed again while you do the top corners.

Step 3: Top Corners

A metal spudger is just the thing to slide under the top edge of the case and lever up, releasing the top corners. The whole top edge is now free and you can retrieve your plastic wedges.

Step 4: Danger, Will Robinson.

This is the step that will definitely result in at least one broken tab, unless you're luckier than me.

Place the spudger into the gap between the front and back mouldings, at right angles to the back of the router.

You need to press it in firmly and try to pull the front moulding of the case forwards around the back moulding, pulling the back moulding out towards the side which will release the clip inside.

There may be a foolproof way that ensures the clips never break - I've not found such a method.

Repeat on the other side.

Step 5: Success! Failure...

See the results of my ham-fisted efforts. Can you manage 4 intact clips? If so, congratulations.

Step 6: Prepare the UART Connector!

This is a standard 10-pin 0.1 inch pitch stacking female header, commonly used for Arduino shields.

Yank out pins 2, 3, 5, 6, 8 and 9, leaving only 1, 4, 7 and 10 and some mightily useful open holes, more on those later. Solder on some wires and ensure no exposed metalwork will short out inside the case.

Step 7: Drill, Baby, Drill!

Very carefully and by HAND (because the logic board is waiting just below for your power drill to slip!) drill 3mm holes at the front-most part of the upper ventilation grille (slots numbers 1, 3, 5 and 7 counting from the left) as you look from the back of the router.

Step 8: Get Knotted

Use some monofilament nylon fishing line looped through ventilation slots 1,2 and 6,7.

Pass the line through the 10-pin header at holes 2, 3 and 8, 9.

Ensure the header is pulled up to the inside of the case, slide a matching header in to make sure you can connect to it, then knot and/or hot glue to your satisfaction.

Step 9: Wire It Up

Other guides are available (e.g. the Serial section of the OpenWRT page) for connecting the 4 wires (Tx, Rx, GND and BOOT_SEL).

Of course I was rash and foolish, and created a solder bridge with the black GND wire near C369 that stopped the router from booting. So I had to go back and clean that up.

Don't be like me, take the easier route pointed out by Bill and others (and now in the main image for this step).

Solder to the GND pin of the WPS switch (above and to the right) instead!!

Step 10: The UART Grappling Hook of Doom

This bodge is my own invention - can you tell?

It gives me a way to attach the UART connection to the FTDI board and then to the USB cable to my Mac, in a way that hangs reasonably comfortably on the HomeHub.

Soldering the header for the FTDI board at a jaunty angle gives room for the UGHD to hug the case of the HomeHub. Those with OCD who insist on right angles between connector and board will be disappointed when it doesn't fit ;-)

The pins leading down into the router need to be quite sturdy, and long, to make it into the hidden connector. I salvaged some long pins from a male to male 0.1 inch header strip, you might find a better source.

The reset button on top gives an easy way to interrupt the boot sequence which is necessary when first installing the OpenWRT / LEDE firmware, but less important thereafter. But after refreshing 6 of these HomeHubs I'm really happy I included that reset switch in preference to shorting out bare wires.

The circuit diagram, a strip board layout and a Fritzing.org design are attached... but it's not complicated, only swapping the order of the pins from input to output and having the (normally open) momentary switch between GND and BOOT_SEL.

Step 11: Show Your Working

A label to remind me which way round things go, and so I know which HomeHubs I have modded and which are virgo intacta. The nice thing about this hack is that it's hard to see if you don't know it's there.

Now you can get on with actually flashing the firmware and use the HomeHub for things BT never intended!

Step 12: And We're Done.

Thanks for reading, please comment if this works for you, or if you're able to suggest improvements!

Be the First to Share

    Recommendations

    • For the Home Contest

      For the Home Contest
    • Game Design: Student Design Challenge

      Game Design: Student Design Challenge
    • Big and Small Contest

      Big and Small Contest

    5 Comments

    0
    fgermain
    fgermain

    10 months ago

    Thanks for sharing! I unfortunately managed to break three side tabs. But I got the last one just fine!

    0
    arslanone
    arslanone

    2 years ago on Step 12

    Hey man,

    Thanks very much for this. And also for taking the scenic route -- things to NOT do. I'll try this soon, and update.

    0
    Shoaib Afzal
    Shoaib Afzal

    4 years ago

    You did a splendid job
    do you have any idea to unlock a BTHub 6-type A ?

    0
    michthom
    michthom

    Reply 4 years ago

    Thanks - but this was the easy bit - hacking the electronics is far harder and I copied all of mine from other people. I did take my HH6 apart and poked and prodded various pads with my oscilloscope but with little success - it seemed to be much harder to crack but perhaps someone will figure out the secrets in time?

    0
    DIY Hacks and How Tos

    Nice hack. I might have to try this with my router to see if it would work.