| View previous topic :: View next topic |
| Author |
Message |
sunsong
Junior
Joined: 16 Jul 2012
Posts: 1
|
 Posted: 16/07/2012 08:22 Post subject: how to open step7 ladder program locked by password ? |
 |
|
Hi !
In one of our CNC machines the siemens s7-200 PLC program is password protected ( POU is protected for viewing and editing ), how to unlock the same ?
please help. |
|
| Back to top |
|
 |
messer
Senior
Joined: 08 Mar 2012
Posts: 2059
Location: Europe
|
| Posted: 16/07/2012 11:25 Post subject: Re: how to open step7 ladder program locked by password ? |
|
|
| sunsong wrote: | Hi !
In one of our CNC machines the siemens s7-200 PLC program is password protected ( POU is protected for viewing and editing ), how to unlock the same ?
please help. |
Ok, the procedure is as follow:
I used Microwin from here:
http://www.filefactory.com/file/c2c2779/n/Step7.Micro.Win.v4.0.5.08.iso
No service packs were installed.
Download Ollydbg:
http://plc.myforum.ro/debugger-disassembler-programs-rtos-demos-vt867.html?highlight=ollydbg
See procedure:
http://plc.myforum.ro/remove-password-project-s7-200-vt121.html?highlight=ollydbg
1. Attach to microwin.exe with Ollydbg and set breakpoint at address 0x0052334E (Raw offset: 0x0012334E) in module microwin.exe (add esp,14)
2. When you trying to open protected project type any password and click OK. The program will be caught at the specified breakpoint (press SHIFT+F9 if Olly got exception before breakpoint).
3. Open Memory window (Alt+M in Olly). Memory search pattern (ASCII): R04.00
4. Look at 20-30 follow bytes after found pattern and you'll see it ..
For another version of microwin the address (breakpoint) can be different. In this case you can search for all executive200.PRJ_Open* function calls and find needed peace of code.
I hope all clear for you..
Unpassword video: http://www.filefactory.com/file/c190cda/n/s7-200_project_unpass_procedure_with_ollydbg.avi |
|
| Back to top |
|
|
messer
Senior
Joined: 08 Mar 2012
Posts: 2059
Location: Europe
|
| Posted: 16/07/2012 19:40 Post subject: Unlock S7 200 |
|
|
link:
https://www.rapidshare.com/files/3527454295/unlockchiness7-200passsword.rar |
|
| Back to top |
|
|
romax
Junior
Joined: 24 Mar 2012
Posts: 9
|
| Posted: 27/01/2013 13:18 Post subject: |
|
|
did any body use this sniffer and worked ????
especialy with the pc adapter ???
6es7 972-0cb20-0xa0 |
|
| Back to top |
|
|
Yeo
Member
Joined: 12 Jan 2012
Posts: 223
|
| Posted: 04/01/2014 18:03 Post subject: |
|
|
I'm also looking for it, can any one helps?
| romax wrote: | did any body use this sniffer and worked ????
especialy with the pc adapter ???
6es7 972-0cb20-0xa0 |
|
|
| Back to top |
|
|
jmv
Junior
Joined: 05 Apr 2012
Posts: 19
|
| Posted: 05/01/2014 13:18 Post subject: |
|
|
I already opened the siemens block with "s7canopener"
sorry english! |
|
| Back to top |
|
|
messer
Senior
Joined: 08 Mar 2012
Posts: 2059
Location: Europe
|
| Posted: 05/01/2014 16:31 Post subject: |
|
|
To clarify the issue passwords in S7 -200 the following considerations I hope are useful:
The 200 has 3 types of passwords you can set :
1) Password access to the project, which does not allow you to open your project for viewing or editing on the PC if you do not put first pass .
2) Password of POU ( Program Operating Units) , which helps protect any or all program blocks (Main , Subroutines , Interrupts ) , this is the type of password you use for SIEMENS libraries (such as that of MODBUS)
3) Password access to the CPU, with various levels of access ( see the program and not just for editing , see nothing, etc. . )
4) Unlock password for S7 200 MMC
Let's see what can be done:
For....
1) Use:
http://www.hotfiles.ro/download/pss7_v1.5.1.rar/1034945
which works also for s7-200 and s7-1200 if you have project with password.
If you have only the executable use ollydbg as follow:
http://www.hotfiles.ro/download/s7_200_project_unpass_procedure_with_ollydbg.rar/1034950
2)Use:
Depending on what SP are you installed try for SP4, SP5, SP6, SP9 this
http://www.hotfiles.ro/download/microwin_v4.0_pou_pass_all.rar/1034949
Inside you have readme.
3)Use:
http://www.hotfiles.ro/download/siemens_s7_200_plc_decrypt_s7_200_ok.rar/1034953
You have readme inside..and this works only withn Serial Adapter not with USB Adapter...
4)Use:
You can create image file from MMC by S7imgRD.exe or WINHEX
if you need to make true bit copy of MMC card or you want to repair failed MMC card, you have to use WinHex program
(http://www.x-ways.net/winhex/index-m.html).
Here is a procedure:
a) read the autentic MMC in 2 steps
1.
2.
64KB image
http://www.tischer.cz/64KB.zip
8MB image
http://www.tischer.cz/8MB.zip
b) write the original image into failed MMC
1. 
2. 
dont you afraid if you receive the following notice
3.
you can decode password of S7-200 project file *.mwp
with:
http://www.hotfiles.ro/download/unlock_and_converter_mmc_image_s7_v101.rar/1034942
http://www.hotfiles.ro/download/unlock_and_converter_mmc_image_s7_v501.rar/1034943
http://www.hotfiles.ro/download/unlock_and_converter_mmc_image_s7_v601.rar/1034944
..601 is the last one.....
If you have the project but MMC has been protected just download again:
I hope I you'll have some tools to work with... |
|
| Back to top |
|
|
hanun
Junior
Joined: 07 Jun 2018
Posts: 1
|
| Posted: 20/06/2018 21:00 Post subject: |
|
|
| could you update links please... |
|
| Back to top |
|
|
365electricalvn
Junior
Joined: 16 Jan 2019
Posts: 19
|
| Posted: 16/01/2019 06:23 Post subject: |
|
|
You can easy unlock POU passwords for viewing & editing by tools.
See and download here (Tools Unlock POU Passwords): [url]https://youtu.be/V9zuH6GfM60[/url]
-----
Regards! |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
