Photograph of BT voyager 205 router

The "Other Voyager Router" page.


The main page started getting a lot of non-205 action, particularly folk looking for ways to unlock the BT Voyager 2091 router to use with another ISP. Then it turns out that BT are adding this "capability" to other routers in their range. We know the 220, 210, and 2500 have been similarly nobbled, and perhaps others.

Here is a place, then, to share what we know so far. As we learn things, I will endeavour to put the information up here where you can easily get at it. Please note, I do not personally offer support or advice for these routers, simply provide a space where efforts to understand and hack these beasts can be coordinated. And a place to grab the hacked firmwares, of course.

What we know so far..

BT has started putting ISP-Locks on their routers. For a company that claims to be evironmentally friendly, this surely-criminal practice aims to create a mountain hardware that's soul function will be to pollute the environment. Our grandchildren will not thanks us.

While these devices are highly capable, they will be superceded, and unless we can bypass this insane "feature", discarding these perfectly functional units wil be the only option.

The BT Voyager 205 is not locked to any particular ISP, and when I eventually upgrade it, I will either pass it on to someone who needs it, or perhaps investigate turning the thing into an effects pedal. Hmm. What about the others..

210V ISP Unlocked!

The BT Voyager 210 has been cracked!
An unlocked firmware is available..

Check out the archive for an unlocked firmware.

The original email..
I added "_BB" to a file cfe-voyager210_roi-v301z_a2pb018c1
I downloaded from

https://www.voyager.bt.com/firmware_upgrades/btvoyager-one-click-fw-update

I calculated CRC32 on bytes 0-235 and put it in 4 bytes 236-239
I am using voyager 210 with non BT ISP !!!!!!!!!!
it is also uploaded to your blog ftp !!!!!!!

host it and let's see feedback from ppl with 210 !!!!!!!!!
please keep my name private !!!!!!!
And there you have it. If it works, or doesn't, leave feedback, below.

220V ISP Unlocked!

The BT Voyager 220 has been cracked!
An unlocked firmware is available..

An unlocked firmware is available in the archive. There's also a copy of the original Pre-Lock v1.6 firmware, courtesy of Mark Eldon, which should take your 220V back to a time when BT had a clue. As well as firmwares for the 220, there's also this cute JavaScript hack..

Big thanks and full credits go to C1 (lost1e (at) hotmail (dot) com) for the following, extremely cute hack. In his own words, roughly..

I just bypassed the domainLock on a new BT voyager [220V] that I was trying to get working on Eclipse for a friend.

No need to mess about with firmware or process lists, the solution really is incredibly simple thanks to a little JavaScript magic :)

1. Navigate (using Internet Explorer, FireFox is untested) to this URL:
http://192.168.1.1/connect.html (replace IP with whatever your voyager is)
The purpose of this is to make the connect page the only frame - other frames screw up the JavaScript below.

2. Open Notepad, and type in the following text exactly as it appears:
javascript:function C1() { if (domainLock == 1) { domainLock = 0; } } C1();
(the above must be all on 1 line).

3. You will notice that the connect page in your router refreshes every 10-20 seconds or so. After the next refresh, immediately copy and paste the text in step 2 into the URL bar of Internet Explorer and hit ENTER.

4. It will seem to you like nothing has happened - but now just enter (or preferably paste) your new ISP details in and hit connect - no more annoying "unsupported broadband service" message smilie for :D You must do all of this before the next refresh happens - so have everything ready in notepad for quick pasting.

IMPORTANT NOTE: This worked for me *AFTER* I had actually set up my new ISP (Eclipse) in the router's Telnet CLI - you will have to do this first. WAN settings are always VPI:0 VCI:38 PPPoATM, VCMUX encapsulation, and most other stuff can be left as default except your new ISP details. The above 4 steps simply allow you to CONNECT with your new ISP details AFTER the details are saved in the router.

This new hack has been confirmed to work with the Voyager 220V. But not other ISP-locked BT Voyager routers like the Voyager 210. If you have such a device, feel free to give it a try and leave feedback below!

Note: even the older Voyager 220 is still locked into BT's VOIP service, and at the time of writing, no way to unlock this aspect of its functionality is known. If you know better, please get down to the commment form!

BT Voyager 2091 UNLOCKED!

The BT Voyager 2091 has been cracked!
An unlocked firmware is available..

Apart from a rare and early release, all versions of the BT Voyager 2091 are "ISP-Locked", that is, BT has locked it so you can't use them with another ISP. More recently, 2091 users have unlocked it..

Extra big packet of Jube Jubes to Alessio for figuring out how to turn a Dynalink 1050W firmware into a working BT Voyager 2091 firmware (with a little help from SkayaWiki ), in his own words..

Hi,
I tried to put the Dynalink 1050W <https://www.dynalink.com.au/firmware.htm?prod=RTA1025W> firmware in my BT voyager 2091 Wireless router - they both use the BCM6348 Chipset (check the brochure https://www.dynalink.com.au/modemsadsl_cur.htm?prod=RTA1025W).

I did this pretty much what I found on https://skaya.enix.org/wiki/FirmwareFormat:

From the Voyager2091 - cfe-voyager2091_btr-v301m-a2pb018c1 I took from the very beginning of the file

36 00 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 56 32 30 39 31 5F 42 42 00 00 00 00 00 00 00 00 31 00

and copied into cfe-rta1025wnz-v328q_a2pb01. The first section of the firmware contains data about the vendor: now the Dynalink 1050w "sounds" like a Voyager 2091.

In the modified Dynalink 1050W firmware, I was not keen on touching the following section which contains size/address of loader/rootfs (this could make your router unusable!)
I calculated the checksum with flipped bits:

bytes 236-239: contains the checksum from byte 0 to byte 255 - the checksum is 43 6C F1 22

byte 216-219: contains the checksum from byte 256 to the end of file - the checksum is 82 12 7F 96

Then I saved the firmware and uploaded to the Voyager via web interface, the upload went fine and the Voyager rebooted, it went up without any problem.

Alessio is on BT himself, so Paulo whipped out his copy of XVI32, did the dirty with the two firmwares files, and successfully connected his 2091 to AOL. The rest, as they say, is history. *g*

Check out the Useful links section below for the file you need. Then follow this simple procedure (adapted from Dan's comment)..



2500V ISP Unlocked!

The BT Voyager 2500 has been cracked!
An unlocked firmware is available..

A firmware in the archive (untested). I have a few of these kicking around. If anyone has problems with any of the firmwares, leave a comment below, and I'll track down one of the others.

Voyager GPL Firmware..

Part of that many Voyager firmwares is GPL, and publicly available; we have recently aquired this. At this early stage, not much hacking as been done. If you want to download the firmware and have a crack at it yourself, the releases (as shipped for free on CD from BT) are available here..

Before you ask a question..

If you have a BT Voyager 205 router, try the main page . This is for the other routers. Feel free to ask questions, give advice, drop information, etc..


previous comments (fourty six pages)   show all comments

hopskip - 13.01.08 7:51 pm

How can I find out the BT Broadband Talk SIP settings on the BT Voyager 2500v?


BlackRussian - 14.01.08 1:58 am

Great fix, thanks guys!

Just bought a second hand 2091 Voyager, the guy hadn't told me it wouldn't work with a non BT line - you saved my bacon!! Brilliant hacking and easy to follow instructions!

Thanks,
BlackRussian


renato - 15.01.08 1:37 pm

hi, how do i know witch is exactly the model of mi router, there are no names or inscriptions, does not have usb or wireless port.


::FrAnTiK:: - 17.01.08 2:29 am

i recently bought a bt voyager 190 modem and understand that i need it unlocked to be able to use it with other isps.
what i need to know is how do i unlock it, i have downloaded the firmware hack from this site but i am sorta stuck now as what to do with it, how do i unlock the modem with this hack, a step by step explanation of the unlocking procedure would be brilliant.
sorry for the noobish question lol!

::FrAnTiK::




mick - 17.01.08 5:27 pm

trying to set an BT voyager 2110 wireless adsl router up to bridge as I need to connect to my office network and it seems i can only do it bridging. had no problems with old Zykel adsl router but only received the 2110 yesterday and cant get it working


Lucas - 22.01.08 5:51 am

Hi there!

I have got same problem as MArtin:

"Solution perfect, but my 2091 is unableto connect to aol. Now is dynalink menu inside, I put login and user name to login screen, and nothing, back tu main menu."

I have tried at least 3 times, did every thing from the begining, reset router few times, set ips, gateway etc. and nothing! can't connect to the aol. it showing me internet connection in 30sec....5sec.... and coming back where my user and pass is.

I have got kwnoladge about computing, network and communication as I'm on Netowrk support course, but can't find solution for this :/

Can any one help? Have any one resolve this problem?

Waiting for help, and thx in advance!


mark - 25.01.08 8:43 pm

Hi. Have just got a 190 uploaded new firmware now unlocked but is there a way of changing the modems mac code ? by useing a programe or telnet ect.
cheerssmiley for :idea:


Mike - 04.02.08 6:46 am

I have uploaded the firmware to my bt 190 modem and I am having problems routing all incoming traffic to my IPCop (firewall) box which it is connected to.

I have disabled uPNP and have setup a port forwarding rule for all traffic on any protocol to be forwarded to this box.

Anytime I try to connect to it I am presented with my modems management page.

If you can help me i would be really grateful

Mike


Si - 06.02.08 6:34 pm

Excellent information, super easy to follow, thanks for giving me the chance to use a piece of hardware that's been lying around, instead of having to bin it.
Cheers
Si


Pookie - 10.02.08 1:35 am

I've been trying to get a bt voyager 220v router to work with my tiscali account. I tried the javascript method, but the quick start menu would just keep coming back to the same menu for login details after going to a connecting... page for a minute or so. Still would not connect to the internet.

So i tried the firmware update. Now the router is continually connecting and disconnecting to my ethernet card. The power light is red all the time, and the phone line light comes on and off without a phone attached (not previously on).
Is the router now 'bricked'/useless?
Can anyone help?


colin - 13.02.08 5:45 am

Hi,
Can someone tell me how to unlock my bt voyager 2500v to work with any isp
Many thanks
Col


next comments (2 pages)

Posting here is disabled at this time.

Welcome to corz.org!

I'm always messing around with the back-end.. See a bug? Wait a minute and try again. Still see a bug? Mail Me!