I have multiple XPR 6550 radios and XPR 6350 Radios that came as part of a larger auction which have codeplug passwords.
For the 6550s with old firmware, I was able to use Wireshark to do some packet sniffing and detect the passwords in order to unlock them. But that only works on the older firmare before R01.12.11. So I still have a few on this version.
For the 6350s, I can't really tell the firmware easily unless i sort through packets with wireshark. The first few I checked were all MORE RECENT than R01.12.11, So out of luck there.
I scoured the forums, and found a few relevant threads. This one seems to be the most thorough and vetted:
forums.radioreference.com
It suggests doing a recovery, and I DO have the most recent firmware version which I downloaded (last week) directly from my https://customerhub.motorolasolutions.com/ account.
When I launch CPS (16 build 823.... do I NEED 828???), and try to recover I get this screen and I have no options other that the firmware and codeplug I have selected in the screenshot:

So great! But then I clock OK, and press "YES" on the warning to continue about the retuning... it thinks for a few seconds and I get this error:

Now crucially - right before this, I hear the windows "unplug a usb" sound that plays if you unplug the motorola programming cable. The USB connection is now no longer present in windows either.
I suspect I know the answer to this, because when I do this in one of the xpr 6550s I see a similar message to this on the screen:
(SAMPLE - NOT ACTUAL SCREENSHOT)

And the behavior is identical (same CPS error code, same USB disconnect tone).
So for those of you who have recovered radios with firmware past R01.12.11.... where am I going wrong?
For the 6550s with old firmware, I was able to use Wireshark to do some packet sniffing and detect the passwords in order to unlock them. But that only works on the older firmare before R01.12.11. So I still have a few on this version.
For the 6350s, I can't really tell the firmware easily unless i sort through packets with wireshark. The first few I checked were all MORE RECENT than R01.12.11, So out of luck there.
I scoured the forums, and found a few relevant threads. This one seems to be the most thorough and vetted:

Password protected Codeplug for a XPR6550 Sorry If you herd this one before
Sorry if I am beating a dead horse but I have searched high and low looking for a solution on bypassing, finding or overwriting a password protected codeplug. It is a motoTRBO xpr6550 with firmware ver 1.12.15 and CP ver 13.02.01. I have contacted the previous owner he has no clue (so I guess he...
It suggests doing a recovery, and I DO have the most recent firmware version which I downloaded (last week) directly from my https://customerhub.motorolasolutions.com/ account.
When I launch CPS (16 build 823.... do I NEED 828???), and try to recover I get this screen and I have no options other that the firmware and codeplug I have selected in the screenshot:

So great! But then I clock OK, and press "YES" on the warning to continue about the retuning... it thinks for a few seconds and I get this error:

Now crucially - right before this, I hear the windows "unplug a usb" sound that plays if you unplug the motorola programming cable. The USB connection is now no longer present in windows either.
I suspect I know the answer to this, because when I do this in one of the xpr 6550s I see a similar message to this on the screen:
(SAMPLE - NOT ACTUAL SCREENSHOT)

And the behavior is identical (same CPS error code, same USB disconnect tone).
So for those of you who have recovered radios with firmware past R01.12.11.... where am I going wrong?