Guide: Unlocking and Modding Telstra Routers (Technicolor hardware)

[Mussels]

Hi Mussels,

I tried to use Tch-exploit to get root access of my Telstra Smart Modem Gen 3, or Technicolor CorbraXH. Unfortunately, I forgot to remove the SIM when I turn it on and the firmware was updated from 20.4.0319-MR0-RA to the latest 21.4.0439-MR2.1-RA, which I believe is the reason why my root failed. I was stuck at the same 4b step as Goody mentioned,


I followed every step such as setting static IP 58.162.0.1, connected to Red WAN port rather than LAN port, but still failed. Do you know why? Is that because my firmware version is not rootable?

Very likely, what versions work and do not work are all documented in the links above.

 

[Mussels]

Can anyone link a detailed video to downgrade the firmware of the Telstra dja0231. Also what does it mean when “turn off the gateway” and how do I do that?


Could you help me with this process, I am in the same boat as you and need help.

Theres a lot of misunderstanding about what a router is, thanks to telcos screwing with people.

A modem changes one signal type to another - DSL, LTE etc to ethernet.
A router routes that traffic to multiple devices, by splitting the traffic up via DHCP and NAT.
Wifi access point and ethernet switch come after this - all wifi AP's with DHCP are routers, managed switches with DHCP are routers, etc.

These are called a gateway because they have multiple WAN and LAN connections - it may just be their marketing, but with ethernet, DSL and LTE inputs and ethernet and multiple wifi networks out that can all work independently, they needed a name to show it did more than a plain router and modem combination.



As for downgrading the firmware, they have a program to do it for you
Firmware Repository - Hacking Technicolor Gateways (hack-technicolor.readthedocs.io)

Find the latest rootable firmware for your device in the repository


They list the firmwares as type 1/2/3 because the methods to root them changed over time, these gateways we're using here are always type 2 or 3.

Type 3 is the kind you must downgrade first, root, then upgrade to (to have the update and keep root)
Replacing Type 3 - Hacking Technicolor Gateways (hack-technicolor.readthedocs.io)

The software and guide for BootP flashing is here - you send the firmware you want to the router as it powers on, forcing it to up/downgrade
Recovery - Hacking Technicolor Gateways (hack-technicolor.readthedocs.io)

 

[Tikur1]

DJA0231 is a gen 2 router, i've got several of those

20.3.c *432* isn't rootable

You'll need to downgrade to the "20.3.c.0389-MR20-RA" firmware from here:
Firmware Repository - Hacking Technicolor Gateways (hack-technicolor.readthedocs.io)


Theres a guide here
Recovery - Hacking Technicolor Gateways (hack-technicolor.readthedocs.io)
That has instructions on how to use BootP to flash a stock firmware (even older ones) to rollback the unit to 389, which will then work with the rooting program.
You can then use one of several methods to update to 432 and retain root, it just cant be done directly.

Instructions start at "Setting up the Server"

Hello Mussels,
If my DJA0231 is already on the firmware "20.3.c.0389-MR20-RA" I'm assuming it's fine to go straight into "Getting Root Access" steps ...?
Similar to "Goody" back in July my screen has been 'stuck' at 4b for some time.
Not sure how long it is supposed to take to get to 4c -- will just leave it running anyway.

All I'm trying to do is be able to set VLAN = 2 (apparently that is required to use it for TPG NBN on HFC connection)

 

[Mussels]

Hello Mussels,
If my DJA0231 is already on the firmware "20.3.c.0389-MR20-RA" I'm assuming it's fine to go straight into "Getting Root Access" steps ...?
Similar to "Goody" back in July my screen has been 'stuck' at 4b for some time.
Not sure how long it is supposed to take to get to 4c -- will just leave it running anyway.

All I'm trying to do is be able to set VLAN = 2 (apparently that is required to use it for TPG NBN on HFC connection)

If you're stuck on that step, it's one of a few things

1. You're not connected to the red WAN port
2. You didnt static assign the right IP address settings in windows (windows 11 does look different, i use the old interface for this only)
2a. (You didn't close and restart that tool after changing those settings)
3. You didnt press the WPS button when asked
4. You didnt scroll down to see if the text went off the window

It should only take 1-3 minutes after scanning begins, and 1-5 minutes once you press the WPS button

 

[Tikur1]

If you're stuck on that step, it's one of a few things

1. You're not connected to the red WAN port
2. You didnt static assign the right IP address settings in windows (windows 11 does look different, i use the old interface for this only)
2a. (You didn't close and restart that tool after changing those settings)
3. You didnt press the WPS button when asked
4. You didnt scroll down to see if the text went off the window

It should only take 1-3 minutes after scanning begins, and 1-5 minutes once you press the WPS button

Thanks very much!!
I'll give it another crack.
Definitely did #1 and 2 that you mentioned. (I did exactly this --> 3. You need to change your network cards IP address and default gateway to 58.162.0.1 with DNS to 255.255.255.0
.... my initial screen for tch-exploit-win looks just like the image at 4a in the instructions. Only the 'port' (5 digits) after the IPv4 address are different.
Don't think I did 2a ... not sure what "that tool" refers to. Assume it's where I "Change adapter options"

Also, I've tried factory reset via the outside button (to start from scratch) but the "new" adapter options are still saved.
I hope I haven't "bricked" it ...

Edit: For "Use the following DNS server addresses" should 'Preferred' and 'Alternate' be left blank?

 

[Spankmier]

Thanks very much!!
I'll give it another crack.
Definitely did #1 and 2 that you mentioned. (I did exactly this --> 3. You need to change your network cards IP address and default gateway to 58.162.0.1 with DNS to 255.255.255.0
.... my initial screen for tch-exploit-win looks just like the image at 4a in the instructions. Only the 'port' (5 digits) after the IPv4 address are different.
Don't think I did 2a ... not sure what "that tool" refers to. Assume it's where I "Change adapter options"

Also, I've tried factory reset via the outside button (to start from scratch) but the "new" adapter options are still saved.
I hope I haven't "bricked" it ...

Edit: For "Use the following DNS server addresses" should 'Preferred' and 'Alternate' be left blank?

Hi Tikur

I went through the process of unlocking a DJA0231 yesterday and there are a few tricks to be aware of. Resetting your network adaptor for a fresh start is advisable as this resolved my connection issues. You don't need anything in the DNS fields when configuring the static IP, leave it on automatic.

I eventually managed to get tch-exploit to progress by allowing the device to fully boot (verified by plugging into a LAN port and loading the router login page), then unplugging the LAN cable and setting the static IP with the cable unplugged before plugging into the WAN port and starting tch-exploit with admin privileges as soon as I saw the adaptor become active within the settings window (Control Panel\Network and Internet\Network Connections). You also may need to set the connection to private and restart tch-exploit if you are unsuccessful in progressing further.

There's a wealth of additional information on the Whirlpool forums, including the master thread "Technicolor Gateways - Rooting and customisation discussion" which is often responded to by the person who wrote the exploit along with a host of other knowledgeable individuals. Best of luck!

Let me know how you get on

 

[Tikur1]

Hi Tikur

I went through the process of unlocking a DJA0231 yesterday and there are a few tricks to be aware of. Resetting your network adaptor for a fresh start is advisable as this resolved my connection issues. You don't need anything in the DNS fields when configuring the static IP, leave it on automatic.

I eventually managed to get tch-exploit to progress by allowing the device to fully boot (verified by plugging into a LAN port and loading the router login page), then unplugging the LAN cable and setting the static IP with the cable unplugged before plugging into the WAN port and starting tch-exploit with admin privileges as soon as I saw the adaptor become active within the settings window (Control Panel\Network and Internet\Network Connections). You also may need to set the connection to private and restart tch-exploit if you are unsuccessful in progressing further.

There's a wealth of additional information on the Whirlpool forums, including the master thread "Technicolor Gateways - Rooting and customisation discussion" which is often responded to by the person who wrote the exploit along with a host of other knowledgeable individuals. Best of luck!

Let me know how you get on

Hey Spankmier,

I shelved this project for a while when I couldn't get it sorted.
I have a laptop with Windows 10 Pro and a desktop with Windows 11.
Does it matter which system I use? Pretty sure the OP instructions (Mussels) are on Windows 10. I was trying on my laptop previously so I could enable/disable wifi and use the lan cable for connecting to the DJA0231.

I really want to get the DJA0231 working for me (on my TPG internet).
Anyway, I'll try again and also check out the Whirlpool forums you mentioned.

 

[Spankmier]

Hey Spankmier,

I shelved this project for a while when I couldn't get it sorted.
I have a laptop with Windows 10 Pro and a desktop with Windows 11.
Does it matter which system I use? Pretty sure the OP instructions (Mussels) are on Windows 10. I was trying on my laptop previously so I could enable/disable wifi and use the lan cable for connecting to the DJA0231.

I really want to get the DJA0231 working for me (on my TPG internet).
Anyway, I'll try again and also check out the Whirlpool forums you mentioned.

How did you get on with this? Hopefully you're all sorted now, but in case you aren't...

I presume it will work just as well on W11, but I've only used W10 Pro. Have you confirmed you're on a rootable firmware? If not you'll need to flash a rootable version in the inactive bank and force the device to boot from it. Don't bother with WiFi, just move the LAN cable back and forth between WAN/LAN on the router as necessary. Once you gain root with TCH Exploit you can plug the WAN port of the DJA device into a LAN port on your existing modem and your computer into a LAN port on the DJA to pull the latest scripts for unlocking the full firmware and blocking Telstra... Make sure you set the optimal bank plan too. I've gone hunting and added my cheat sheet below, this unifies a lot of information that is spread between forum posts. I highly recommend the previously mentioned Whirlpool thread for any further issues you face, they're quite responsive and extremely knowledgeable

GAIN ROOT ACCESS
Start by resetting device to defaults by holding in reset switch until device "clicks".
Check the firmware installed onto your device in your web browser, usually http://mygateway (both), http://192.168.0.1 (DJA0230), or http://192.168.1.1 (DJA0231).
Find your Modem/Router @ https://hack-technicolor.readthedocs.io/en/stable/Repository/
Compare firmware version installed, you are ok to proceed with rooting if it's listed as method C (TCH-EXPLOIT), otherwise perform optional flashback.

OPTIONAL
If detected version showing as "-" in the table you will need to flash back using "Tftpd64" with below guide to a version which can be rooted using TCH-EXPLOIT.

Hacking Technicolor Gateways - Recovery

Most Technicolor Gateways run customized firmware implementing ISP-specific integrations and get locked down in functionality to match service requirements. This kind of sucks because if you decide to use this device with a different ISP, you are likely to be blocked from doing that, or simply...

hack-technicolor.readthedocs.io

DJA0230 use: vbnt-v_20.3.c.0389-MR20-RA.rbi
DJA0231 use: vcnt-a_20.3.c.0389-MR20-RA.rbi

Once flashed back force Gateway to restart to bank 1, 0231 procedure is included in above guide, 0230 can be power cycled via rapid plug/unplug or using buck method.

------------------------------------------------------------------

Root with tch-exploit-win.exe via WAN port after setting static IP.

Set network interface to private if unable to kick exploit procedure:
Get-NetConnectionProfile
Set-NetConnectionProfile -InterfaceAlias Ethernet -NetworkCategory Private

------------------------------------------------------------------

POST ROOT - USING TCH-GUI-UNHIDE SUBSET & FIRMWARE UPGRADE:

tch-gui-unhide/utilities at master · seud0nym/tch-gui-unhide

Modify Telstra-branded Technicolor devices to access hidden features - seud0nym/tch-gui-unhide

github.com

1. Download latest scripts:
curl -skL https://raw.githubusercontent.com/seud0nym/tch-gui-unhide/master/get | sh -s --

2. (OPTIONAL) Load Technicolor logo.gif to root directory with WinSCP.

3. Safely disable Telstra access and re-open GUI (step 1 will need to be repeated first):
A. Disable Telstra phoning home, set Cloudflare DNS, disable Guest WiFi, and enable DumaOS QoS package (remove "-gy" for no Duma):
./de-telstra -A -nc -G -gy
B. Enable interface visibility in dark theme with 5 cards per line:
./tch-gui-unhide -tn -a5

4. Set optimal bank plan:
./set-optimal-bank-plan

5. Perform firmware upgrade from USB (once complete, perform step 3 & 4 again):
DJA0230:
./safe-firmware-upgrade -c -d "/mnt/usb/USB-A1/vbnt-v_20.3.c.0432-MR21.1-RA.rbi"
DJA0231:
./safe-firmware-upgrade -c -d "/mnt/usb/USB-A1/vcnt-a_20.3.c.0501-MR22.1-RA.rbi"

6. Load rootable firmware to second bank
-

7. Set to boot from latest firmware

RESET TO DEFAULTS:
./reset-to-factory-defaults-with-root

TO DO
1. Learn how to load rootable firmware to second bank and set load plan so old firmware only loads as fallback.

 

[e_jakaj]

stuck with this guide https://github.com/seud0nym/tch-exploit#readme
Booting between banks on Technicolor Gen 3 Cobra xhbut having trouble to get root with Putty

 

[Spankmier]

Not sure on the bank switching method for Gen 3, ask in the previously mentioned Whirlpool master thread "Technicolor Gateways - Rooting and customisation discussion". The guy who wrote the exploits frequently posts there.

 

[wgibbons]

Hi I have modded the Model 2 (white) Telstra router but buggered if I can with a Model 3 (black) Cobra XH. Tried the usual but nothing seems to work. Is there any way of rooting these so I can run openwrt? TCH-exploit does not seem to work.

 

[RemoteRobotics]

Hi Mussels,

Thank you for your amazing post unlocking the Static Route functionality on my Technicolor DJN2130:

I just ran into a the 'WAN Services' card not being displayed properly:

Any workarounds?

Thank you.

 

[wgibbons]

Hi I have modded the Model 2 (white) Telstra router but buggered if I can with a Model 3 (black) Cobra XH. Tried the usual but nothing seems to work. Is there any way of rooting these so I can run openwrt? TCH-exploit does not seem to work.

On a model 3, If you downgrade the firmware to a rootable version eg: bcmVCNT-8_nand256_ubifs_update-r20.4-319-2-1-MR0-RA-BOOTSTRAP-signed.pkgtb ,then it can be done. You will need to get TFTP server , USB stick and follow instructions.

• Downgrade to a version that is Type 2 / *C rootable with Tch-Exploit (eg: 2.03x). Need to use usb stick in Router.
• https://hack-technicolor.readthedocs.io/en/stable/Hacking/Type3/
• then, this is done with TFTP server (TFTPD64) and a Lan port on the modem/router with a USB with required files on it installed on the Modem/Router.
• https://hack-technicolor.readthedocs.io/en/stable/Recovery/#bootp-flashing
  • Ip 10.0.0.100, 10.0.0.99 lan port.
• Factory reset unit. Hold reset, power up wait till front white light flashes release.
• Once the old firmware is rooted and stable you can then use the Tch-exploit method.
• Use Tch-exploit on wan port . (*** latest version 2.02 only as old ones do not work on Model 3)
• https://github.com/BoLaMN/tch-exploit?tab=readme-ov-file

static ip 58.162.0.1 255.255.255.0 dns 58.162.0.1

Hit wps when prompted after text on screen goes green.

Use Putty into the rooted modem to apply rooted patches to secure root.

curl -k -L https://github.com/seud0nym/tch-gui-unhide/releases/latest/download/$(uci get version.@version[0].marketing_version).tar.gz | tar -xzvf –

./set-optimal-bank-plan

./de-telstra -A

./tch-gui-unhide

./tch-gui-unhide-cards

./de-telstra -m

You can expose Pages as required and add/remove any Features not required.

In my case I minimize add on's so as to free up Modem memory and processing for optimal performance. Things like add stopper running on the Modem can consume memory and reduce performance.

Be aware that a factory reset will swap Banks and you will need to repeat the process on that bank.

The reason they have and use banks is so that the Modem/Router always holds a working firmware in the alternative bank to factory reset to so Firmaware changes or faulty updates do not completely lock out your modem/router and there is a way of getting it restored. You can change banks on rooted devices but on unrooted devices it is complex.

 

[wgibbons]

Have inherited a telstra model 3 and have issue with factory reset. Reset held while power up I get the white light change slightly to yellowish but it NEVER starts to flash no matter how long I hold the reset in after power up. The router will boot and function on an old 20.4 version but cannot root it. Any ideas?

 

[Spankmier]

Hi Mussels,

Thank you for your amazing post unlocking the Static Route functionality on my Technicolor DJN2130:

I just ran into a the 'WAN Services' card not being displayed properly:
[pic]

Any workarounds?

Thank you.

Sorry mate, don't check in here often. I've had success re-running the tch-gui-unhide script with my preferred options when I've encountered similar issues.

I use "./tch-gui-unhide -tn -a5 -dy" which enables full interface visibility in dark theme with 5 cards per line + removes login requirements via web interface (remove "-dy" to preserve login requirement).

If this fails you'll be better off asking in the previously mentioned Whirlpool master thread "Technicolor Gateways - Rooting and customisation discussion". It's still quite active.

 

[Spankmier]

Have inherited a telstra model 3 and have issue with factory reset. Reset held while power up I get the white light change slightly to yellowish but it NEVER starts to flash no matter how long I hold the reset in after power up. The router will boot and function on an old 20.4 version but cannot root it. Any ideas?

Ask in the previously mentioned Whirlpool master thread "Technicolor Gateways - Rooting and customisation discussion". This thread is basically dead, the WP thread is active.