Lost supervisor password?

[genius_at_work]

If you've ever had a Ricoh/Savin/Gestetner/Lanier machine where the admin AND supervisor usernames/passwords have been lost, and you are locked out, this thread may be the answer you are looking for.

DISCLAIMER: The following procedure has the potential to damage your machine, and thus should only be performed by a trained Ricoh technician. I take no responsibility for any damage to data or devices, or for any losses of any kind, that result from performing this procedure.

WARNING: This procedure, if performed incorrectly, can cause your machine to become unusable. I strongly recommend that you copy a backup of the original NVRAM data to a safe place on your computer. Only make changes to the NVRAM file that is on the SD card. If your machine is unusable after installing the modified NVRAM data, you should be able to reinstall the original NVRAM data using the backup file.

For the newer series' of machines that have administrator logins (instead of key operator), Ricoh's official fix is to replace the NVRAM chip, thereby returning the username/password combinations to their default values. Unfortunately, this procedure also resets all of the other NVRAM settings (engine, etc) to their factory defaults as well. Obviously, this means that you have to spend time recalibrating the entire machine.

Luckily, if you have a small amount of computer expertise, there is another option that can take less than a minute once you are adept at the procedure.

IMPORTANT: Be sure to disconnect the machine from all external connections (network, USB, fax, CopyTrak, etc) before beginning this procedure. Also, ensure that the customer does not attempt to use any functions on the machine before you are finished. If the customer uses the machine before you can install the modified NVRAM data, you will have to start the procedure over from the beginning.

LostSupervisorPassword.pdf

The attached PDF file describes the procedure for resetting the supervisor username and password to their default values, in order to grant you access to reset the administrator passwords from the Web Image Monitor, or the User Tools menu.

You, or your supervisor, or the customer may ask if this procedure will expose secret passwords to you. The answer is that, NO, the passwords are encrypted in the NVRAM data file, so they cannot be read. The customer's passwords cannot be decrypted, so this procedure simply reverts those encrypted values back to a default value.

---

Below are the same instructions as contained in the PDF file, in case your computer cannot read PDF files.
Hex2.jpg

The symbols in the purple sections represent the various administrator logins. Use these symbols to locate the correct location within the hex data. The à symbol is hex code 0xC3.Ã[ = admin 0 (supervisor)Ã\ = admin 1 (primary admin)Ã] = admin 2Ã^ = admin 3Ã_ = admin 4

The pink sections represent the user names for each of the admin/supervisor logins as indicated by the purple reference symbols. In this example, the username for admin 0 ( Ã[ ) is supervisor.

The green sections represent the passwords for each of the preceding usernames. These values are encrypted, so they cannot be read directly. A series of ‘r’ characters represents a blank password.

The easiest way to gain access to the machine is to clear the admin 0 username and password. You can then log into the web monitor as supervisor, and change all of the other admin usernames and passwords from there.

Instructions:
· Download and install a hex editor (Google “HxD”).
· Upload your machine’s NVRAM to an SD card (SP5824).
· Insert the SD card in your PC and save a backup copy of the NVRAM folder on your desktop. Open the NVRAM data file (L1234567890.nv) on the SD card with the hex editor.
· Use the search function to locate the characters Ã[ . For the B222 and B230, it is located at 0001DFB0.
· After the four (4) ‘.’ (period) characters, overwrite the existing admin 0 username with supervisor
· After the series of ‘.’ (periods) that follow supervisor, replace any existing symbols with the lowercase ‘r’ character.
· Save the NVRAM file (do not change filename) to the SD card.
· Download the new NVRAM data to the machine (SP5825). Restart the machine and log into the web monitor with username “supervisor” and no password.

Important: All of the ‘.’ (period) characters must remain unchanged. If you need to replace any of the ‘.’ characters, copy and paste one of the existing ‘.’ characters.

---

If there are any problems or questions, post them in this thread (not PM).

Also, I am not able to perform this procedure for you as I already have enough of my own work to do.

-genius_at_work

[Eric1968]

If you enter the Factory SP-mode (which I will not mention here) you can easily reset the admin/supervisor password without using hex-editors etc.

BTW, you cracked the Ricoh source code?

[zed255]

Yes, for those in-the-know there is an SP that can be run on the newer GW based machines that will clear the passwords for admin and supervisor. This is still a useful work-around, thanks for sharing.

As for 'cracking the source code', that's a little glamourized. The NVRAM data is partially encrypted but I'm not surprised that the use of a simple hex editor allows the modification of certain things. I think I might have to grab an NVRAM download off a machine to 'play' a little and see if there are any other secrets it may reveal <insert evil laughter here>.

[femaster]

If you enter the Factory SP-mode (which I will not mention here) you can easily reset the admin/supervisor password without using hex-editors etc.

Just a question of curiosity. Is this Factory SP-Mode documented anywhere (TSRC, RFG-esource, etc.,) or is this just something used, and known, "at the factory"? I assume that the information is on a "need to know" basis, and us "regular" Ricoh field techs fall into the catagory of NOT needing to know...

I believe in my 5-years as a tech, I've only ever needed to reset an admin password once. Thankfully the supervisor password had not been touched.

This other SP mode might be some useful information to know should one ever need it, but I'd assume that it opens up a whole new world of control that a regular tech should probably not be in.

[nmfaxman]

Ok. I thought I was the only one that figured this out. My ego tends to get huge.
Here are the encryption codes.

a b c d e f g h i j k l m n o p q r s t u v w x y z
* ê ª k + ë « h ( è ¨ i ) é © n . î ® o / ï ¯ l , ì




A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
" â ¢ c # ã £ ` à a ! á ¡ f & æ ¦ g ' ç § d $ ä




1 2 3 4 5 6 7 8 9 0 - =
> þ ¾  ? ÿ ¿ | < ~ 9 =

I was thinking I could make some money on this, but it was a matter of time before someone else figured it out.
You can't download the changed data back to the machine. It reads a checksum to see if there were any changes or corrupt data.
The best bet is to read it and log in to WIM to change the logins back to factory.

At least I was able to help fellow techs.
I suggest charging the boss or customer for this knowledge.
Have fun guys and girls.

[zed255]

As far as I know it isn't documented anywhere and is supposed to be used by regional support personel to assist techs in the field. I first encountered it while having one of my area RTSMs out on a problem machine. He accessed Factory SP mode while I happen to be watching, so I took note. Saved my bacon a few times over the years. Basically it allows a number of 'hidden' SPs to appear. None of those are likely to be documented either, at least not the ones I have found useful.

[nmfaxman]

If you've ever had a Ricoh/Savin/Gestetner/Lanier machine where the admin AND supervisor usernames/passwords have been lost, and you are locked out, this thread may be the answer you are looking for.

DISCLAIMER: The following procedure has the potential to damage your machine, and thus should only be performed by a trained Ricoh technician. I take no responsibility for any damage to data or devices, or for any losses of any kind, that result from performing this procedure.

WARNING: This procedure, if performed incorrectly, can cause your machine to become unusable. I strongly recommend that you copy a backup of the original NVRAM data to a safe place on your computer. Only make changes to the NVRAM file that is on the SD card. If your machine is unusable after installing the modified NVRAM data, you should be able to reinstall the original NVRAM data using the backup file.

For the newer series' of machines that have administrator logins (instead of key operator), Ricoh's official fix is to replace the NVRAM chip, thereby returning the username/password combinations to their default values. Unfortunately, this procedure also resets all of the other NVRAM settings (engine, etc) to their factory defaults as well. Obviously, this means that you have to spend time recalibrating the entire machine.

Luckily, if you have a small amount of computer expertise, there is another option that can take less than a minute once you are adept at the procedure.

IMPORTANT: Be sure to disconnect the machine from all external connections (network, USB, fax, CopyTrak, etc) before beginning this procedure. Also, ensure that the customer does not attempt to use any functions on the machine before you are finished. If the customer uses the machine before you can install the modified NVRAM data, you will have to start the procedure over from the beginning.

LostSupervisorPassword.pdf

The attached PDF file describes the procedure for resetting the supervisor username and password to their default values, in order to grant you access to reset the administrator passwords from the Web Image Monitor, or the User Tools menu.

You, or your supervisor, or the customer may ask if this procedure will expose secret passwords to you. The answer is that, NO, the passwords are encrypted in the NVRAM data file, so they cannot be read. The customer's passwords cannot be decrypted, so this procedure simply reverts those encrypted values back to a default value.

---

Below are the same instructions as contained in the PDF file, in case your computer cannot read PDF files.

Hex2.jpg

The symbols in the purple sections represent the various administrator logins. Use these symbols to locate the correct location within the hex data. The à symbol is hex code 0xC3.
Ã[ = admin 0 (supervisor)
Ã\ = admin 1 (primary admin)
Ã] = admin 2
Ã^ = admin 3
Ã_ = admin 4

The pink sections represent the user names for each of the admin/supervisor logins as indicated by the purple reference symbols. In this example, the username for admin 0 ( Ã[ ) is supervisor.

The green sections represent the passwords for each of the preceding usernames. These values are encrypted, so they cannot be read directly. A series of ‘r’ characters represents a blank password.

The easiest way to gain access to the machine is to clear the admin 0 username and password. You can then log into the web monitor as supervisor, and change all of the other admin usernames and passwords from there.

Instructions:
· Download and install a hex editor (Google “HxD”).
· Upload your machine’s NVRAM to an SD card (SP5824).
· Insert the SD card in your PC and save a backup copy of the NVRAM folder on your desktop. Open the NVRAM data file (L1234567890.nv) on the SD card with the hex editor.
· Use the search function to locate the characters Ã[ . For the B222 and B230, it is located at 0001DFB0.
· After the four (4) ‘.’ (period) characters, overwrite the existing admin 0 username with supervisor
· After the series of ‘.’ (periods) that follow supervisor, replace any existing symbols with the lowercase ‘r’ character.
· Save the NVRAM file (do not change filename) to the SD card.
· Download the new NVRAM data to the machine (SP5825). Restart the machine and log into the web monitor with username “supervisor” and no password.

Important: All of the ‘.’ (period) characters must remain unchanged. If you need to replace any of the ‘.’ characters, copy and paste one of the existing ‘.’ characters.

---

If there are any problems or questions, post them in this thread (not PM).

Also, I am not able to perform this procedure for you as I already have enough of my own work to do.

-genius_at_work

Dude, no offence but I opened it with notepad and scrolled down to the area you described to read the same info.

As always............................................ ...........

[zed255]

Ok. I thought I was the only one that figured this out. My ego tends to get huge.
Here are the encryption codes.

...

At least I was able to help fellow techs.
I suggest charging the boss or customer for this knowledge.
Have fun guys and girls.

So its a simple substitution cipher? I would have thought it would be actual encryption using something like the current meter and or serial as the key. This intrigues me. I'm going to have to compare you results with my first opportunity to check this out.

[wfinn]

Just a question of curiosity. Is this Factory SP-Mode documented anywhere (TSRC, RFG-esource, etc.,) or is this just something used, and known, "at the factory"? I assume that the information is on a "need to know" basis, and us "regular" Ricoh field techs fall into the catagory of NOT needing to know...

I believe in my 5-years as a tech, I've only ever needed to reset an admin password once. Thankfully the supervisor password had not been touched.

This other SP mode might be some useful information to know should one ever need it, but I'd assume that it opens up a whole new world of control that a regular tech should probably not be in.

I found out from a senior tech of 15 years during a last ditch troubleshooting we did. I was also told it was buried in Goose's Guide once and I checked and verified that it actually is in Goose's Guide, It's just not labelled but if you know what you are looking for then you can easily find it. As far as just giving it out... well you aren't allowed to.

[Gift]

If you enter the Factory SP-mode (which I will not mention here) you can easily reset the admin/supervisor password without using hex-editors etc.

BTW, you cracked the Ricoh source code?

Hi Eric,

I know how to enter to the factory mode (got this information during a training for the Aficio 5550C - very nice trainer, hehe). I just checked all SP5xxx programs within the factory mode twice (on a MPC2500) but there's nothing obviously named refering to reset the admin/supervisor codes - can you tell the sp programm (via PM if you prefer not to post this in public), no need to tell how to enter factory SP for me.

besides that: nice and interesting work@genius