GPON Huawei MA5671A

[EduNeves]

Hi Support,

I received the Revelprog-IS recently, and I'm trying to brute force the Huawei MA5671A password; however, it is timing out every minute or so;

Reading through the forum, I found a few settings I could try, such as checking the 'No Delay' option and adjusting the 'Write Delay' manually, but it also does not improve the password search.

The search password will take about 200 days, but stopping every minute, I think it will be impossible to figure this out.
Is there anything else I could try to keep this search working without interruptions?

Thank you!

[ArT]

Please send me a screenshot of your settings, maybe we can adjust sth
Does it timeout everytime after 100 passwords, or is it randomly?
Does increasing write delay anything changes?
Does it read A0 and A2 area without issues, or sometimes is it timeout?

[EduNeves]

Hi ArT,

I am running the Revelprog IS v1.9.0 on the below machine configuration:

Intel i7-4790 CPU @ 3.60GHz
32GB of Memory
Windows 11 Pro:
Version 21H2
OS Build 22000.739

The windows have the following power options set:
- High performance;
- USB selective suspend setting = disabled

On your questions:
Does it timeout every time after 100 passwords, or is it randomly?
A: Not sure if around 100 passwords, but it seems random.
Does increasing write delay anything changes?
A: I have changed a few times the write delay when not using the BP option;
However, it does not seem to change the behaviour or improve the condition.
When trying to use like 1.0 ms, I notice that every time I hit the 'Start' button, the 'Device TIMEOUT' message is displayed right away. But in general, using any value above it seems to produce the same results, with a few occasions where I can see it working for about 1h30m without interruption.
Does it read A0 and A2 area without issues, or sometimes is it timeout?
A: Sometimes, especially when I reset the device power, it gives me the timeout message. But when it reads, I can get the A0 information clearly; however, the A2 seems to be encrypted or password-protected since what is displayed is not readable.

Below, I am attaching a few screenshots in sequence from some attempts I have made this morning;
You will see that the value for the write delay varies and seems to not interfere with the overall result.
Another observed situation I could see is that as time passes, especially on searches that last more, the 'passwords per second' decrease significantly. For example, for the last Screenshot 2022-07-08 164849, the search started with around (333/s) and ended up with only (15/s).
It would be nice to have this value in a good mark during the entire search.

Thank you for your help.

[ArT]

(...)however, the A2 seems to be encrypted or password-protected since what is displayed is not readable.

A2 can not be encrypted or password protected (based on MSA standard), read can be slightly different every time becasue there are diagnostic data (read-only), more details here: viewtopic.php?f=32&t=529

Password search time is decreasing when application detects when SFP is not responding (timeout), it will inrease write delay time and try to brute force without interrucpting process (so you can see decreased speed).

Generaly in your case issue is not stable SFP. From some reason it occasionally does not respond on I2C commands (timeout) and this is the source of all issues. It may be because SFP MCU is doing something in background. Please try to connect TX Disable pin to VCC3P on board. By default, transceiver should disable TX output (internal pull up to +3.3V) but maybe it's not working in your transceiver so you can connect it externally. When TX is enabled, power consumption will be much higher and I2C transmission may not work properly. It's also good idea to test it on other PC to eliminate USB power supply issues. When PC motherboard accidentaly limits USB current output (SFP drains quite a lot of current) it will reset SFP and you will have also timeout. And last question - how about other transceivers from other brand - do you have similar issues or only with this particular one?

[EduNeves]

Hi Art,

Thank you for your update here;

I was expecting to find in the A2 pages the GPON mac address as other folks could list it using the I2C SDA/SCL connection from a raspberry4. At this point, I can see info, but mostly not readable as per the below screenshot.

Selection_857.png (64.37 KiB) Viewed 2754 times

During the password search, it does not stay long and constantly searches with an average of 7~10 passwords per second. It starts at around 50~68 passwords per second but decreases till it dies at 7/6 passwords per second.

After connecting the TX Disable pin to VCC3P on the board, I got it running for more time, around 3h20m. I also tried, as suggested, to connect from another machine, and I plugged it directly into my windows server, where the results came to be pretty similar to what I am getting on my personal computer. So, I believe these Hauwei sticks are the reason for the lack of performance using the tools - I've tested a few already, and all are giving the same results. Unfortunately, I don't have any other transceivers available to try, but I appreciate your help so far.

Once again, Thank you!

[thankfly]

As I know, you want to upload a third-part rom or OS into the module?
You dont need password if you want this. All you need is upload with SSH.
Hope helpful.

[ArT]

Do you have maybe external power source, e.g. adjustable power supply DC? It's good idea to test it when you power supply SFP directly from external power supply - you can connect +3.3V and GND directly to adapter board (VCC3 and GND pins) and disconnect USB power supply from PC. The issue is with transceiver stability and maybe external - more stable power than from PC USB - will help.