plc.myforum.ro PLCs users www.plc.myforum.ro!    FAQ   Search   Memberlist   Usergroups   Register   Profile   Log in to check your private messages   Log in  How to unsceure the compact logix L32E?          plc.myforum.ro Forum Index -> ALLEN-BRADLEY(Rockwell Automation) Reg. U View previous topic :: View next topic   Author Message Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 29/04/2013 08:52    Post subject: How to unsceure the compact logix L32E? I've a Compactlogix L32E but the controller is secured by the vendor(i dont have the password). Now i'm unable to go online or upload the ladder diagram . Anyone knows how to unlock a secured Compactlogix L32E or upload it? Hope someone can help. Back to top messer Senior Joined: 08 Mar 2012 Posts: 2059 Location: Europe Posted: 02/05/2013 21:07    Post subject: Re: How to unsceure the compact logix L32E? Yeo wrote: I've a Compactlogix L32E but the controller is secured by the vendor(i dont have the password). Now i'm unable to go online or upload the ladder diagram . Anyone knows how to unlock a secured Compactlogix L32E or upload it? Hope someone can help. Is this working ..go to "Controller Properties" > "Passwords" and use PW 22865625 to reset password..??? Back to top Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 02/05/2013 22:49    Post subject: Re: How to unsceure the compact logix L32E? When the controller is secured, I can't go online so i'm unable to go to the "Controller Properties". messer wrote: Yeo wrote: I've a Compactlogix L32E but the controller is secured by the vendor(i dont have the password). Now i'm unable to go online or upload the ladder diagram . Anyone knows how to unlock a secured Compactlogix L32E or upload it? Hope someone can help. Is this working ..go to "Controller Properties" > "Passwords" and use PW 22865625 to reset password..??? Back to top Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 05/05/2013 20:23    Post subject: Re: How to unsceure the compact logix L32E? I think no one is able to unsecure the CPU processor when Rockwell comes out this security tool. Really sad(sad is that I bought the equipment but is is locked by vendor).... Back to top Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 18/05/2013 19:59    Post subject: Re: How to unsceure the compact logix L32E? Manage to get this document but still can't figure out how to get the password. http://www.reversemode.com/downloads/logix_report_basecamp.pdf Any expert can help one this? Thanks Back to top Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 28/07/2013 08:54    Post subject: Re: How to unsceure the compact logix L32E? Any expert how to crack the password? Back to top Yeo Member Joined: 12 Jan 2012 Posts: 223 Posted: 02/08/2014 14:04    Post subject: Re: How to unsceure the compact logix L32E? Anyone has any idea of how to unlock the security tool for processor? Back to top bluedog Junior 2 Joined: 18 May 2013 Posts: 25 Location: UK Posted: 05/08/2014 18:38    Post subject: Re: How to unsceure the compact logix L32E? Yeo wrote: Anyone has any idea of how to unlock the security tool for processor? The short answer is no. AB have done a really good job on this and the CPU does not actually expose the password. When you use the security tool, the password you entered is sent to the CPU and it simply responds with a match/no match response - the password is not sent back to the application. All the password processing is done in the firmware. The long answer is yes, it is possible using a brute-force attack, the info you need is in the document you posted. However: 1. Each unlock request requires you to send a session ID request and parse the response to extras the ID. 2. Once you have the session ID, you can send an unlock request with a password using that session ID. The CPU will respond with what is basically a yes/no reponse. 3. If the response was no, then generate the next password and go to step 1. Here's the kicker - the limiting factor is the two request/responses. On my system I was only able to process 200 requests per second, although this was a single-threaded application - multi-threading will help, but since the length of the password that you can set in the CPU is not limited (ok, it's limited, but the number of characters is high enough to make brute-forcing unusable), you will probably not live long enough to see the result. Calculate the number of passwords up to a length of 50 characters for yourself and see if you have that long to wait around. You don't know if the programmer used 'a' or 'staythefuckoutofmyprogram' for the password. Even if you could process 2,000,000 requests per second, you will be retired before it's done. On the plus side, the password is not case-sensitive, cannot begin with a number, cannot contain two consecutive under-scores, and cannot end with an underscore. Have fun. Back to top selftester Member 2 Joined: 10 Aug 2013 Posts: 430 Posted: 02/09/2014 17:19    Post subject: Unpassword RSLogix RSLogix 500 Version 8.10.00 (CPR 9) Patch the file rs500.exe Offset | Old Byte | New Byte ---------------------------------------- 00313C64 | 74 | 90 00313C65 | 14 | 90 ----------------------------------------- Master Password Controller Properties" > "Passwords". PW 22865625 (erase any password). Back to top bluedog Junior 2 Joined: 18 May 2013 Posts: 25 Location: UK Posted: 02/09/2014 20:55    Post subject: selftester wrote: Unpassword RSLogix RSLogix 500 Version 8.10.00 (CPR 9) Patch the file rs500.exe Offset | Old Byte | New Byte ---------------------------------------- 00313C64 | 74 | 90 00313C65 | 14 | 90 ----------------------------------------- Master Password Controller Properties" > "Passwords". PW 22865625 (erase any password). This only works for SLC500 and MicroLogix controllers. Back to top psgama Member junior Joined: 24 Mar 2014 Posts: 81 Posted: 26/02/2015 08:04    Post subject: From the document linked to, it seems like you would have to force the cpu into a state where it was ready to accept new firmware, but by doing this do you destroy the logic on this type of PLC or is the logic still stored during the firmware upgrade process? Back to top abdollahi Junior Joined: 24 May 2016 Posts: 1 Posted: 03/04/2017 20:52    Post subject: Re: How to unsceure the compact logix L32E? Yeo wrote: Anyone has any idea of how to unlock the security tool for processor? Hello We could Upload the program from locked Plc Seris 5000 By studio logix V21 or Higher in online connection And then removed the password Back to top Display posts from previous:  Oldest FirstNewest First         plc.myforum.ro Forum Index -> ALLEN-BRADLEY(Rockwell Automation) Reg. U All times are GMT + 2 Hours Page 1 of 1   Jump to: Select a forum PLC's Users International Forum----------------Board RulesPLC TutorialsSIMATIC Automation Systems -Reg.USimatic Automation SystemsLinksGE Fanuc Emerson Reg. UGE Fanuc Emerson ALLEN-BRADLEY(Rockwell Automation) Reg. UALLEN-BRADLEY(Rockwell Automation)OMRON Reg. UOMRONHONEYWELLSchneider_Electric Reg. USchneider ElectricOther PLCs Reg. UOther PLCsSIEMENS SIMATIC HMI- Reg. USIEMENS SIMATIC HMIOther HMI-Reg. UOther HMICNC & Robotics-Reg. UCNC & RoboticsProgramming Reg. UProgrammingAutoCAD Reg. UAutoCADRenewable EnergyBuilding Technology ManagementPLC BooksCables, Sensors,Transducers ...Drives & InvertersSiemens Hardware & SoftwareSafety Military & AerospaceUtilitiesFAQs & NewsJobsDisclaimer Romanian Users Forum----------------ROSIEMENS SIMATIC Automation SystemsROSIEMENS SIMATIC HMIROSimatic ROther PLCsROther HMIBooksROCADRUtilitieseLearningSimulatorsApplication Examples  You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum Powered by phpBB © 2001, 2005 phpBB Group Fa-ti si tu propriul forum GRATUIT, pe www.myforum.ro