Paradyne / Zhone 4200 DSLAM password recovery

I've never been able to find a password reset procedure for the Paradyne / Zhone 4200 GranDSLAM / 2600 bitstorm series of DSLAMs. I'm sure that there is an official procedure, but I haven't found it yet.

With the help of a friend who is familiar with VxWorks, I developed the below procedure. I hope this is helpful to somebody.

---

1. Power the DSLAM on, and quickly press a key at the "Press any key to stop auto-boot..." prompt

2. At the [VxWorks Boot] prompt, enter c.

3. Leave all of the parameters unchanged, except for flags. Enter 0x10 at the flags prompt. Leave the ones after that unchanged too.

4. At the [VxWorks Boot] prompt, enter @. The system will boot. Eventually you'll end up at a -> prompt. You might have to hit enter at Post Completed to see it.

5. At the -> prompt, enter hexdump("sparks.db") This dumps the password database, which is unencrypted. Towards the bottom, you'll see something like this:
00000770 ffffffa0 00 00 00 00 00 00 00 00 34 ffffff81 75 73 65 72 31 .........4.user1
00000780 00 00 00 00 00 00 00 00 00 00 00 70 00 34 ffffff81 75 ...........p.4.u
00000790 73 65 72 31 00 00 00 00 00 00 00 00 00 00 00 70 ser1...........p
000007a0 61 73 73 77 6f 72 64 00 00 00 00 00 00 00 00 70 assword........p
000007b0 61 73 73 77 6f 72 64 00 00 00 00 00 00 00 00 00 assword.........
000007c0 00 00 01 70 00 34 01 61 64 6d 69 6e 00 00 00 00 ...p.4.admin....
000007d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007f0 00 00 00 00 00 00 00 00 00 00 01 00 00 10 01 61 ...............a
00000800 64 6d 69 6e 00 00 00 00 00 00 00 00 00 00 00 00 dmin............


The username in this case is user1, with a password of password, and a priv password of password. The admin password is blank.

6. Reboot and try those credentials. Voila!