S7-200 password problem

Hello,
*system architecture
I have a machine with a couple of s7-200 PLC and one HMI.the HMI is connected via it's DB9 port to the port0 of both PLCs.one of the PLCs is communicating with a drive through port1 and port1 of the other PLC is unused.

*Objective:
communicating with a SCADA system to many machines of the same architecture

*Problem:
i can not upload HMI application and all the PLCs are password protected for uploading.

Can i get the password of both PLCs to upload the program and know which registers i need to read?
or
Can i get a tool that listen(sniffer) for the data transmitted between HMI and PLCs and tell me what is the registers read by the HMI?


I have another question, s7-200, can i add a third PPI communication port by an external module ?

melsayedhasan said:

Can i get the password of both PLCs to upload the program and know which registers i need to read?

Click to expand...

Yes, if you contact the original programmer and he/she is willing to share it.
No, if you mean to ask if somebody here is willing to help you crack the passwords. These kinds of actions are definitely not welcomed here.

Kind regards,

thanks jvdcande, i don't need to get the password as i don't care about the program . what i need is the addresses of the registers to be read by my SCADA system.
can i know these registers by lstening to the data between the HMI and PLCs?

The answer is 'Yes you can', but don't ask me where you start. The guy who wrote the libnodave library for reading/writing data to/from Siemens PLCs did it by watching the data being received and sent by a PLC. I think you need a special kind of brain for dong that kind of stuff, but it is do-able.

http://sourceforge.net/projects/libnodave/
You could probably get a head start by reading the C program to find what kind of data you should be looking for.