UPC Free Internet Givaway Extravaganza

About two years ago, I first heard about a few smart UK folks getting free interwebs off their cabling providers on the techwatch forums. At the time I thought it was a pretty nifty thing to try out here in Eire when i got the time. However, I forgot about this potential research project until I happened to come across a cheap NTL cable modem for sale.

The cable modem I bought was a Motorola surfboard 5101e. I made a JTAG cable using the schematic shown here: http://i43.tinypic.com/15wnsk7.jpg, although you can also use the much simplier one http://img255.imageshack.us/img255/4128/sb5100webstarblackcatou7.png (you can even omit the resistors if you want) or buy one for cheap off ebay http://cgi.ebay.co.uk/Blackcat-JTAG-CABLE-MOTOROLA-SURFboard-SB5100-SB5101_W0QQitemZ330423060795QQcmdZViewItemQQptZPCC_Modems?hash=item4ceebfc93b. At the mo mine looks like the cat made it, but give me a week or two and il make a proper one.

I connected it all up, installed "JTAG utility 1.3 by ToM" on the PC, and flashed with haxorwarellrev39-LITE.bin (available in the downloads section of www.sbhacker.net), using the flashing directions that came with the file.

When it said "flashing complete", I rebooted the modem, went to 192.168.100.1, and was happy-out to be greeted with the haxorware web gui.

So I conected the modem up to the "Tv" socket on the "NTL" labelled socket on the wall, and rebooted the modem. After searching for a bit (have a look in the top right corner of the web gui or the overview page for the modems status), it completed the following one after the other:

Acquire Downstream Channel Done
Obtain Upstream Parameters Done
Upstream Ranging Done
Establish IP Connectivity Done
Retrieve Time of Day Done
Negotiate security Done
Receive configuration Done
Register connection Done
Cable modem status Operational

However, further down the page, i noticed that the Configuration file that the device recieved was called "cm_unknown.bin". So I went to the Addresses page of the webgui, and bumped up the mac address of both the ethernet and the HFC by two places i.e "HFC: 34:34:34:34:34:34" became "HFC 34:34:34:34:34:36". I then clicked on save and reboot.

After doing this three times, The modem eventually received a "cm_express.bin" configuration file. Then i unplugged the ethernet from my PC, waited a bit, plugged it back in, and noticed that the PC got a new IP address. Then I was able to connect to the internet.

Im currently downloading at around 1mb (i.e, i get a full 700mb iso in about 5min) I tried bumping up the HFC mac address a few times, and managed to get a "cm_starter.bin" configuration file, but didnt notice any change in speed. I didnt spend much time messing around with this, but Il still look into getting higher speeds. There is probably some configuration file for businesses or high-end connections that should let me do that. Il keep you updated

For good general information on how Cable internet works and how to hack it look for the "Haynes Cable Modem Manual" on google. Just to note, when they say that you have to swap mac addresses with someone else on a different network segment, this isnt the case with UPC ireland as they seem to have less security as the NTL England.