Can I download a password-locked Mlgx program?

Bob T. Jones

Member
Join Date
Jul 2015
Location
Ohio
Posts
12
I have a Micrologix 1100 with a locked program that I'm wondering if I will be able to download if I need to replace the PLC?

I've only ever downloaded a MLgx program with the program open in RSLogix 500, and can't open the program without the password. I only see an "upload" and no "download" option if RSLogix is open without a program.

Note that I'm not interested in opening the program because of our agreement with the vendor, so please don't reply with methods of unlocking the program. I just want to know if I have a means of in-house disaster recovery without using the vendor.
 
In other words you have a copy of the offline file, you just can't open it because you don't have the password? Since obviously if you don't have the file in the first place you can't download it regardless of password...

To my knowledge there isn't a way, but it's not a situation I've ever dealt with. You can clear the processor memory, but I don't think that helps any if you can't open the file to download.

For disaster recovery you could ask the vendor to provide a memory module pre-loaded with the program and set for either 'load on error' or 'load always'.
 
thanks plvlce... good assumption about having the offline, password-protected file, which I can't open. I should have been more specific. At least you're making me feel better about not knowing a way to download it.

I was thinking about the memory module as well and am surprised we don't have that set up already since our standard is to have disaster recovery in place before commissioning a new system.
 
Using a custom made cable I was able to decipher a password on a ML1100 recently.

I used wireshark to listen to the receive port and found the data when the plc responded with "incorrect password"

This same facility had backups of most of the other programs that were password protected. I found these passwords using notepad++ and some patience.
 
This is a good question, and it's very good that you're asking it before the emergency arises.

The RSLogix 500 source code protection method is basic to the point of being archaic: you can't open a password-protected program at all. There's no granular protection for preventing edits, or hiding just some of the routines or features. It's either "I can open it by entering the password" or "I can't open it at all".

And you are correct that RSLogix 500 needs to have the program open in order to download it to a controller.

The best way to implement disaster recovery for that controller, without access to the program, is to have the OEM provide a pre-loaded memory module with the loading behavior set to "on corrupt/empty memory" or "always".

The topic of "how do I clear the memory of a MicroLogix if the program is password-protected or OEM Locked" is a different and more complicated question.

The topic of "how do I crack MicroLogix / RSLogix password protection" is a slightly simpler topic, because the answer is "it's possible but we don't discuss it here", in conjunction with "Ken's A-B tattoo tingles whenever somebody discusses passwords and he has moderator authority".
 
Last edited:
Thanks ArcReactor and Ken, for your replies! Although I may pursue the Wireshark method as an academic exercise, for disaster recovery we will request a memory module from the OEM, who is thankfully still in business!

I also found a Micrologix download utility on the AB website that allows me to select the password-protected program file for download. I haven't downloaded it to a PLC yet to confirm that it would allow me to, but that would be interesting if Rockwell actually provided a "convenient" means of disaster recovery for cases like this.

Btw, the password, in this case, is encrypted.
 
who is thankfully still in business!
Thankfully indeed... We're about to be replacing/upgrading a system in part because it had a locked MicroLogix and the vendor went out of business a couple years ago.
I also found a Micrologix download utility on the AB website that allows me to select the password-protected program file for download. I haven't downloaded it to a PLC yet to confirm that it would allow me to, but that would be interesting if Rockwell actually provided a "convenient" means of disaster recovery for cases like this.
I've not heard of this before, please follow up with how it works out.
 
I also had never heard of this utility. So I thought I would give it a try, albeit using RSEmulate 500.

No go....first prompt is asking to enter the password. Even after I entered the password it failed with an incompatible processor error. However, I can possibly attribute that to using Emulate instead of the ML1100 the program specified. RSLogix accepted it and allowed me to download, but this tool would not.

OG
 
Last edited:
Thanks ArcReactor and Ken, for your replies! Although I may pursue the Wireshark method as an academic exercise, for disaster recovery we will request a memory module from the OEM, who is thankfully still in business!

I also found a Micrologix download utility on the AB website that allows me to select the password-protected program file for download. I haven't downloaded it to a PLC yet to confirm that it would allow me to, but that would be interesting if Rockwell actually provided a "convenient" means of disaster recovery for cases like this.

Btw, the password, in this case, is encrypted.

Describe encrypted. Normally when a .rss is password locked the password is not encrypted and is available in the source file. Likewise with the serial comms to and from the processor.
 
lol Operaghost... good guess! The two reasons why I know it's encrypted is because the hexedit method yielded garbage ascii. Plus the vendor told me it was encrypted.

Thanks for testing the download utility! It saves me from borrowing a MicroLogix from our spares. Very disappointing though that it doesn't work!!

If you're looking on the AB site for the free download utility, it can be found among the MicroLogix 1100 downloads in one of the earlier FW versions. Be sure to scroll down to see all the downloads available. It may also be in the downloads for other Micrologix processors. But no need to search for it since Micro Lite is free, more functional, and easier to find on the AB site.
 
Last edited:

Similar Topics

Hi Friends, I want to download Password Protected Software from one PLC Simatic S7-200 CPU 224 to other PLC of same configuration. Is there anyone...
Replies
1
Views
4,024
Does anyone know if it is possible to setup a Panelbuilder32 file so a password is required for upload or download to or from the HMI? Passwords...
Replies
5
Views
2,806
I want the upload a program from one machine that have a FP0 PLC. But i have one problem the program is protected by a password. Is there a way...
Replies
8
Views
5,753
Hi everyone, I got a Parker HMI, CTC PA2. I tried to download program to it but it froze in the process and could not finalize. Now, when I try to...
Replies
0
Views
27
I am new In a CCW and as a beginner I am trying to learn programming but i am noticing that my CCW software is taking around 1 minute to download...
Replies
2
Views
71
Back
Top Bottom