Here goes!!!!
don´t ask me how i got this procedure.
Information for free!
>Follow the procedure required:
>
>Password Recovery for Centillion/Switches
>
>1st Method
>
> The following is the procedure for recovering the password
>from a
>C100 or 5000BH switch from the CLI via a serial connection. If the
>customer
>has a copy of the configuration file with the password saved in it,
>refer to
>the Solution "Recovering C100 or 5000BH switch password using DOS".
>
> If the configuration file is not available, do the
>following:
>
> 1.)
>
> Go to the what? prompt. The what? prompt can be accessed by
>going
>to the engineering prompt and typing what at the CLI. To access the
>engineering prompt type eng from the config prompt and enter debug as
>the
>password. To exit the what prompt, type the control sequence Ctrl + X.
>Note:
>Do not type any other characters than stated below, doing so could
>cause
>accidental reset of the switch. Do not hit backspace or delete. If a
>mistake
>is made hit the Esc key.
>
> Access to what? prompt:
>
> command>eng
>
> Please enter password: debug
>
> eng>what
>
> what?
>
> 2.) Ex.
>
> At the what? prompt, obtain d 0bfc60000 what?d 0bfc60000
>
> Continue dumping (d<CR>) until 0bfc607FF
>
> (To continue dumping type only a d at the what prompt)
>what?d
>
> Next, obtain d 0bfc70000
>
> Continue dumping until 0bfc707FF
>
> Somewhere towards the end of one or both dumps, you will
>find a
>double2C pattern.
> Approximately 12 bytes before this is the password in hex.
>Use a
>hex to ascii conversion table to recover the password.
>
> The dumps that are being obtained are the configuration
>files
>stored in the switch memory.
> One or both of theses files will contain the password for
>the
>switch.
>
> Example:
>
> BFC70480: 00000000 00000000 00000000 00000000
> BFC70490: 00000000 00000000 00000000 00000000
> BFC704A0: 00000000 00000000 00000000 00006261
> BFC704B0: 796E6574 00000000 00000000 00000400
> BFC704C0: 0000012C 0000012C 00000000 00000000
> BFC704D0: 00000000 00000000 00000000 00000000
> 6261796E6574 is the password here. Translates to baynet.
>
> NOTE: In version 2.0.2, password recovery from the CLI is
>not
>possible. Access to the engineering or what? Prompt requires the user
>password. The solution is to RMA the MCP.
>
>
>
> HEX TO ASCII CONVERSION TABLE:
>
> Char Hex Description
>
> SP 20 Space
> ! 21 Exclamation mark
> " 22 Quotation mark (" in HTML)
> # 23 Cross hatch (number sign)
> $ 24 Dollar sign
> % 25 Percent sign
> & 26 Ampersand
> ` 27 closing single quote (apostrophe)
> (28 Opening parentheses
> ) 29 Closing parentheses
> * 2a Asterisk (star, multiply)
> + 2b Plus
> , 2c Comma
> - 2d Hyphen, dash, minus
> . 2e Period
> / 2f Slant (forward slash, divide)
> 0 30 Zero
> 1 31 One
> 2 32 Two
> 3 33 Three
> 4 34 Four
> 5 35 Five
> 6 36 Six
> 7 37 Seven
> 8 38 Eight
> 9 39 Nine
> : 3a Colon
> ; 3b Semicolon
> < 3c Less than sign (< in HTML)
> = 3d Equals sign
> > 3e Greater than sign (> in HTML)
> ? 3f Question mark
> @ 40 At-sign
> A 41 Uppercase A
> B 42 Uppercase B
> C 43 Uppercase C
> D 44 Uppercase D
> E 45 Uppercase E
> F 46 Uppercase F
> G 47 Uppercase G
> H 48 Uppercase H
> I 49 Uppercase I
> J 4a Uppercase J
> K 4b Uppercase K
> L 4c Uppercase L
> M 4d Uppercase M
> N 4e Uppercase N
> O 4f Uppercase O
> P 50 Uppercase P
> Q 51 Uppercase Q
> R 52 Uppercase R
> S 53 Uppercase S
> T 54 Uppercase T
> U 55 Uppercase U
> V 56 Uppercase V
> W 57 Uppercase W
> X 58 Uppercase X
> Y 59 Uppercase Y
> Z 5a Uppercase Z
> [ 5b Opening square bracket
> \ 5c Reverse slant (Backslash)
> ] 5d Closing square bracket
> ^ 5e Caret (Circumflex)
> _ 5f Underscore
> ` 60 Opening single quote
> a 61 Lowercase a
> b 62 Lowercase b
> c 63 Lowercase c
> d 64 Lowercase d
> e 65 Lowercase e
> f 66 Lowercase f
> g 67 Lowercase g
> h 68 Lowercase h
> i 69 Lowercase i
> j 6a Lowercase j
> k 6b Lowercase k
> l 6c Lowercase l
> m 6d Lowercase m
> n 6e Lowercase n
> o 6f Lowercase o
> p 70 Lowercase p
> q 71 Lowercase q
> r 72 Lowercase r
> s 73 Lowercase s
> t 74 Lowercase t
> u 75 Lowercase u
> v 76 Lowercase v
> w 77 Lowercase w
> x 78 Lowercase x
> y 79 Lowercase y
> z 7a Lowercase z
> { 7b Opening curly brace
> | 7c Vertical line
> } 7d Closing curly brace
> ~ 7e Tilde (approximate)
>
>
> 2nd Method
> If you have a copy of the configuration do the following:
>
> 1) Open MS-DOS prompt.
>
> 2) Go to directory containing the config file.
>
> 3) Type in: debug xxx.cfg
>
> Prompt changes to "-"
>
> 4) Hit "d<CR>" until the line beginning xxxx:05a0 comes
>into
>view.
>
> Read the convenient ascii decode from the right hand side
>of the
>page,
>
> starting from 05ae.
>
> 5) Hit "q<CR>" to exit the debug application.
>
> NOTE: If a copy of the configuration file is not available,
>please refer to the solution:
>
> "How to recover the password on a C100 of 5000BH switch".