Here’s my project page I will be keeping updates on: http://www.riscit.info/wopr/

Read more to see the pictures and what not.

Well, I was able to use HyperTerminal and a serial cable to connect to it successfully, so I started from there. When you first connect to the router, use N-8-1 (or, No parity, 8 data bits, 1 stop bit) at 9600Baud. However, be careful, the Centillion 50/100 and 5000BH Models may reset if you press a key at the terminal before the CLI prompt appears.

Now you will want to login the engineer prompt using eng and the password is debug. This is an account, from my understanding, for network engineers to check out debug information in case something is wrong with the router.

Now you will need to access the what? prompt. The what? helps with the output of the raw debug data, again, as far as I can tell. There is nothing in the manuals about the eng and what? prompts at all.

Now, you begin the real work. You must dump the data in the flash memory. To do this you issue the command: d 0bfc60000 and hit ENTER

You will need to continue to dump this until you see a double 12C pattern. To continue dumping, press d and hit ENTER. Just about 12 bytes before this 12C pattern is the password in hex. I had to continue dumping this data about 5 or 6 times till I got the double 12C pattern. You will see the password on my C100 was: 313233343536. Which, when converted is 123456. Since: 31 = 1, 32 = 2, 33 = 3, 34 = 4, 35 = 5, 36 = 6 in hex.

Apparently in firmware verison 2.0.2 and above, password recovery is not possible from the CLI. Access to the enginnering or what? prompts requires the user password. To fix this, you will need to reprogram your flash.