Found SFP28 password, but unable to write. (fs.com SFP28-25GLR-31)

[aaron]

Hello,

I have a SFP28-25GLR-31 from fs.com, delivered with "Arista Networks " in the manufacturer name field.

Using the brute force feature in Revelprog IS, I was able to obtain the password 416E6479 (ASCII:Andy) in a little over 9 hours. (Yay!) This password was stored in the manufacturer name, which now reads as "Andyta Networks ".

Now, I'm trying to change the manufacturer name back to "Arista Networks ", but having some trouble. After preparing the buffer with the (checksummed) changes, I follow the procedure to unlock the transceiver by entering the password in the password tool and clicking execute. Those steps are depicted here:

01 - Password - Execute.png (65.1 KiB) Viewed 1464 times

02 - Custom Script Programming - Log.png (7.05 KiB) Viewed 1464 times

03 - Custom Script Programming - Script.png (11.36 KiB) Viewed 1464 times

When I got to click the "Write Buffer to Memory [F6]" button, however, I immediately get the following message:

04 - Device not found - Erase Operation Failed.png (53.99 KiB) Viewed 1464 times

I have tried reducing the speed to 50%, 10%, and 2%, but I get the same result each time. VPP has been kept at 3.3V. "Write sequence is set to the default, "Full Sequence (Erase + Write + Verify)".

If I change the "Write Sequence" it to "Without Erase (Write + Verify)", the writing step completes, but then Revelprog IS hangs on the verification step, as shown here:

05 - Without Erase - Hanging on Verification.png (48.06 KiB) Viewed 1464 times

Revelprog IS was clearly able to change the manufacturer name during the brute forcing process, so I am not sure what I am doing wrong here.

Thanks!

[aaron]

After playing around with this a little more, I was able to successfully write! The trick was to enable the "ND" (No Delay) option. I would have tried that option previously, but Revelprog IS does not seem to allow the "ND" checkbox to be toggled when the device type is set to "SFP [A0]". To work around this and enable "ND", I temporarily changed the device type from "SFP [A0]" to "SFP [USER]", toggled "ND", and then switched back to "SFP [A0]" before attempting to write.

I'm still not 100% confident that I am following the correct procedure, but the change I wrote seemed to stick, even after a power cycle of the transceiver.

[ArT]

I'm glad that you have resolved your issue and everything worked.
I recommend to operate directly on SFP (SFP[USER] in previous versions) - these procedures are based on scripts (A0/A2 is hard coded in database, that's why ND is not active - it's ok for basic operations).
Furthermore - when you select SFP (without A0/A2 suffix) you can operate directly on 128B pages and you have also BP option (byte by byte program) -some transceivers may require it during write to success.

PS. for future use - always try ASCII passwords before full range, it's much faster (limited range). Many passwords are in range of ASCII characters and there is no necessary to check all range.