Having the same problem with ours, we did evaluate whats going on during the boot session and we found out, that there are 3 components storing code permanently on the boards.

There is a 512KByte flash in a socket, there are 2 MByte flash with the same modules, but four of them in a dimm socket and there is a 128 Kbit serial EEPROM with 8 pins in a socket. And of coarse, there is 4MB or 8MB or 16MB or more RAM on board.

Now we found out, taking the 512Kb boot flash from a working board onto a non working one, it starts working. We will offer programmed flash chips (can be shipped overnight in an envelope), to supply an emergency service for dead MCP´s soonly.  But some knowledge is missed, so we did not get every MCP running again.
Oct. 4. 2002

Next questions is regarding the password in a C100 MCP. Here we got a lot information out of the web, to replace the password with a known one or to reset the switch to default settings. We will check all that in our lab und publishit here.

Whatever you plan, you must have physical access to the unit. There is no way remotely doing that. This makes sense, even Ascend and Cisco offer very well explained steps for allmost every Ascend and Cisco router, to reset the password or using a backdoor. This is no more a Cisco secret and it is very well documented.  We think, it is customer friendly to help with the least investment of time.