Password Removal for Lucent Cellpipe 20a-GX-UK

Just bought myself a second hand Lucent CellPipe 20a-GX-UK DSL Router, but
can't get in to configure it as it's password protected. Didn't get any
manuals, cables, power supply, etc, but managed to hook it up well enough to
get it to power on.

I can use the terminal connection, and can watch it perform its POST, try
and connect to a DSL line (which isn't connected), then prompt me for a
password before getting any further.

The Lucent website doesn't seem to be much help, I found an operations
manual by Google searching, and that's as far as it went.

It doesn't dish out an IP address, and giving my computer a static address
of 192.168.0.10, then trying to connect to the router on 192.168.0.1 doesn't
work either.

Anyone got any ideas?

Cheers,
Dave
--
(remove spamblock or reply to group)


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.688 / Virus Database: 449 - Release Date: 19/05/2004

"David Baxter" <(E-Mail Removed)> wrote in message
news:0Ovsc.6964$(E-Mail Removed)...
> Just bought myself a second hand Lucent CellPipe 20a-GX-UK DSL Router, but
> can't get in to configure it as it's password protected. Didn't get any
> manuals, cables, power supply, etc, but managed to hook it up well enough
to
> get it to power on.

Just a follow-up...

I took the cover off, it's actually manufacturered by Xavi
(www.xavi.com.tw), and the PCB is marked "x7007r". Their website identifies
this device as having a USB interface, 4 ethernet ports and a WAN port- the
one I have in front of me has one WAN port and one ethernet port, and seems
to match their x7001r device.

It's not asking for a username, just a password.

So, any help appreciated.

Cheers,
Dave
--
(remove spamblock or reply to group)


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.688 / Virus Database: 449 - Release Date: 19/05/2004

google for Lucent Cellpipe Password seemed to illuminate try

http://www.tek-tips.com/gviewthread....547/qid/365132

Garf

"David Baxter" <(E-Mail Removed)> wrote in message
news:0Ovsc.6964$(E-Mail Removed)...
> Just bought myself a second hand Lucent CellPipe 20a-GX-UK DSL Router, but
> can't get in to configure it as it's password protected. Didn't get any
> manuals, cables, power supply, etc, but managed to hook it up well enough
to
> get it to power on.
>
> I can use the terminal connection, and can watch it perform its POST, try
> and connect to a DSL line (which isn't connected), then prompt me for a
> password before getting any further.
>
> The Lucent website doesn't seem to be much help, I found an operations
> manual by Google searching, and that's as far as it went.
>
> It doesn't dish out an IP address, and giving my computer a static address
> of 192.168.0.10, then trying to connect to the router on 192.168.0.1
doesn't
> work either.
>
> Anyone got any ideas?
>
> Cheers,
> Dave
> --
> (remove spamblock or reply to group)
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.688 / Virus Database: 449 - Release Date: 19/05/2004
>
>

"Garf" <(E-Mail Removed)> wrote in message
news:40b36983$0$20509$(E-Mail Removed)...
> google for Lucent Cellpipe Password seemed to illuminate try
>
> http://www.tek-tips.com/gviewthread....547/qid/365132
>
> Garf

Already been there, thanks... spent over 8 hours on this damn thing so far,
managed to achieve very little. Managed to load a later firmware version
over the top, but it REALLY didn't like it and appears to have killed it.

The way I understand its functionality is this:

Custom Routing and Modem Firmware co-exists on a paritioned flash chip with
the Emergency Boot Code. If the Software is damaged or corrupted, the
firmware on the CPU will default to the Emergency Boot Code, which allows a
re-flash of the firmware.

And all that sits on top of the CPU's (virata helium 210-80) own firmware,
which is where I am now.

It appears that the last flash totally destroyed ALL the data on the flash
chip, causing the device to default back to the CPU's firmware, which simply
provides me with a:

VRTA>

prompt. At this prompt, there are two commands: 'q', which exits the prompt
until you hit 'q' again, and 'r', which brings up the memory location of the
string that follows it, ie:

r a
0000000a : 142ab210

So, my conclusion is that it's a little bit screwed.

Dave
--
(remove spamblock or reply to group)


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.688 / Virus Database: 449 - Release Date: 18/05/2004

In article <40b36983$0$20509$(E-Mail Removed)>, "Garf"
(E-Mail Removed) says...
>
> google for Lucent Cellpipe Password seemed to illuminate try
>
> http://www.tek-tips.com/gviewthread....547/qid/365132
>
"the trick is to corrupt the flash
(i raked a tiny smallest precision screwdriver i had
on all the flash contact and after on the ARM processor till it
rebooted."
That sounds exciting :-)

"Rob Morley" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) t...
> "the trick is to corrupt the flash
> (i raked a tiny smallest precision screwdriver i had
> on all the flash contact and after on the ARM processor till it
> rebooted."
> That sounds exciting :-)

Y'know, that actually did work.

It was just a case of fooling the CPU into thinking the firmware stored in
the flash memory was corrupted, making it fall back onto its failsafe
Emergency Code.

Dave
--
(remove spamblock or reply to group)


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.688 / Virus Database: 449 - Release Date: 18/05/2004

In article <mdLsc.7230$(E-Mail Removed)>, "David Baxter"
(E-Mail Removed) says...
>
> "Rob Morley" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) t...
> > "the trick is to corrupt the flash
> > (i raked a tiny smallest precision screwdriver i had
> > on all the flash contact and after on the ARM processor till it
> > rebooted."
> > That sounds exciting :-)
>
> Y'know, that actually did work.
>
> It was just a case of fooling the CPU into thinking the firmware stored in
> the flash memory was corrupted, making it fall back onto its failsafe
> Emergency Code.
>
I imagine it would :-) From what I can find the boot block is supposed
to be protected, so I wonder how you managed to destroy it. Is the
flash chip removable?

"Rob Morley" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) t...

> Is the flash chip removable?

Unfortunately not. It's one of those surface-mounted jobs with a dozen or so
tiny tiny tiny solder tags.

I now need to find out what commands are accepted by the VRTA> prompt, aside
from "q"uit and "r"ecall (from memory)...

Dave
--
(remove spamblock or reply to group)


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.688 / Virus Database: 449 - Release Date: 18/05/2004

In article <ckRsc.8365$(E-Mail Removed)>, "David Baxter"
(E-Mail Removed) says...
>
> "Rob Morley" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) t...
>
> > Is the flash chip removable?
>
> Unfortunately not. It's one of those surface-mounted jobs with a dozen or so
> tiny tiny tiny solder tags.
>
> I now need to find out what commands are accepted by the VRTA> prompt, aside
> from "q"uit and "r"ecall (from memory)...
>
I can picture you typing in the hex for the boot block.

"Rob Morley" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) t...

> I can picture you typing in the hex for the boot block.

And there's another problem.

The VRTA> prompt only accepts those two commands - "q" and "r". There
appears to be no way of getting data into the thing! Tho, I did take a look
at the serial (console) port connections, and it has more pins connected
than just the transmit, receive and ground pins, so I wonder if there's a
special cable I could use that would activate a flash function that would
allow me to simply upload a new image.

There surely has to be a way of fixing this thing - I can't believe that a
product would be designed with firmware in the CPU and no way to access
it...


Dave
--
(remove spamblock or reply to group)


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.688 / Virus Database: 449 - Release Date: 18/05/2004