Cracking a Cisco 837 ADSL Router

| Hi | I have 3 x Cisco 837 routers that have come back to me from our ISP. I | am not able to reset these and clear the startup configs. Some of them | I was able to remove the flash memory which was enough for me to get | into rommon mode to clear the startup config but not these 3!! | I have tried all the CTRL-BRK sequences at powerup, using Tera Term, | Hyper Terminal and NetTerm | It appears the config is stored in NVRAM and there is nothing I can do | to clear it. I have cracked the lid but there doesn't appear to be | anyway of shorting and / or clearing the NVRAM | | Does anyone know of a way I can clear the startup config?

Have you seen this:

Yesy I have tried this and the Break sequence is not working Tried using Tera Term, Hyper Terminal and Netterm Tried using CTRL-C CTRL-BRK and the pull down menu that allows you to send a break!!

| > | Hi | > | I have 3 x Cisco 837 routers that have come back to me from our ISP. I | > | am not able to reset these and clear the startup configs. Some of them | > | I was able to remove the flash memory which was enough for me to get | > | into rommon mode to clear the startup config but not these 3!! | > | I have tried all the CTRL-BRK sequences at powerup, using Tera Term, | > | Hyper Terminal and NetTerm | > | It appears the config is stored in NVRAM and there is nothing I can do | > | to clear it. I have cracked the lid but there doesn't appear to be | > | anyway of shorting and / or clearing the NVRAM | > | | > | Does anyone know of a way I can clear the startup config? | >

| > Have you seen this:

| | Yesy I have tried this and the Break sequence is not working | Tried using Tera Term, Hyper Terminal and Netterm | Tried using CTRL-C CTRL-BRK and the pull down menu that allows you to | send a break!!

If the break sequence does not work, refer to "Standard Break Key Sequence Combinations During Password Recovery" for other key combinations.

this:

|

combinations.http://www.cisco.com/en/US/products/hw/routers/ps133/products_tech_no... Not heard of "simulating break" - might need it one day, thanks.

The documented password recovery procedures do work for 837 by the way.

One other possibility might be that the data rate has been changed. I have the vague idea that you can do this in the configuration register. Not sure if it affects rommon mode tho'. You could try the various rates and stop/parity or use say an oscilloscope to check it.

Note than the commands for setting the config reg from rommon varies betweern platforms. (there are two variations.) I forget the details.

Finally - I don't suppose that anyone would be paranoid enough to physically damage the console connection? Would they?

I assume that your console cable setup works on other boxes just fine to break into their boot sequence.

The early hardware of the 827/837 came out when no service password-recovery was still an undocumented command, and there was no provision to get back into the box. When it came semi documented is when IOS was changed to allow a break-clear-config option of password recovery. Before then, you were totally fubar if you wanted back in without the password.

I think the only way you're going to get into the box would be to somehow either ICP or remove the NVRAM/Flash chip in the box itself, and erase that chip. Its not stored on the optional FLASH DIMM which was used for extended storage of IOS images, but usually a seperate chip from what I remember.

Kinda a reason that the command was undocumented and not recommended for use in the first place..