QSFP is restoring original eeprom data after restart

[optic44]

Hello, I'm using revelprog with qsfp adapter. I'm very satisfied, already reprogrammed dozens of transceivers with it. But with one QSFP I have strange issue. I already found manufacturer password for it (it took few days but it found password ), I can change manufacturer name, s/n and other protected bytes, but when I disconnect transceiver from adapter (or restart it) then all changes are lost. Somehow it restores original data in eeprom. Do you think it may have few passwords with different level of access? Any other idea? Any help will be appreciated

[ArT]

If I good understood, you found password, now you can change manufacturer name (but it was not possible without password), but when you disconnect sfp and connect it again, it restores original data? I'm not specialist in transceivers but one important question: does brute force changed manufacturer name when it found password? (it should write password in manufacturer name field)

If no -> probably there is also additional mechanism for transceiver protecting. Password is required, but it's not enough. Maybe vendor protected it also in such way where special authorization bytes should be written e.g. to user eeprom or vendor area. Without authorization code it does not allow for eeprom data changing. Hard case, because you will need additional information from vendor.

If yes -> probably there are few passwords and one password is valid only for one operation (you can reprogram qsfp only few times) - in such case you should find also other password if you continue brute force. If it find second password DO NOT disconnect transceiver from adapter. You need to rewrite it in the same session (if you disconnect power from it then password will not be valid anymore).

[optic44]

If I good understood, you found password, now you can change manufacturer name (but it was not possible without password), but when you disconnect sfp and connect it again, it restores original data? I'm not specialist in transceivers but one important question: does brute force changed manufacturer name when it found password? (it should write password in manufacturer name field)

Exactly. It found password and saved this password in manufacturer name permanently - restart does not restore original manufacturer name. So password worked and allowed for single change, but this password does not work anymore.

If yes -> probably there are few passwords and one password is valid only for one operation (you can reprogram qsfp only few times) - in such case you should find also other password if you continue brute force. If it find second password DO NOT disconnect transceiver from adapter. You need to rewrite it in the same session (if you disconnect power from it then password will not be valid anymore).

If I remember I do not disconnected QSFP after it found password. If password is for single use it should still working when I tried to reprogram it, right? Hmm, I'll try to find another password, wish me luck. Any other idea?

[ArT]

Have you tried to reprogram page 0 only? When you select QSFP [USER] from memory database you can select which memory area would you like to operate, by default it's A0 block (256 bytes), but first 128 bytes in A0 block are mostly diagnostic information which can not be changed. All important information (manufacturer name, serial number etc) are stored in Page 0 area (please check memory organization for more details here: viewtopic.php?f=32&t=529) . Please change Area from A0h (256 bytes) to Page Select (128 bytes)-> Page 0, read it (it should read 128 bytes) and change manufacturer name and write it back. Please remember to set password before in Tools -> Qsfp -> Password (checkbox "enter current password" should be checked). Any difference?

[optic44]

It worked!!! I programmed page 0 only and used password which was found with brute force tool and restarting module does not restoring original data. Awesome, thank you Art!!

[mk96]

HI, I ran into the same problem. It seems that mfg and host/user pass are the same. After reinserting the qsfp all changes are gone. It seems that even the password gets wiped from the mfg name after qsfp reinsert.