Mitsubishi FX3G-60MT PLC

[EICS]

I have a client with a Mitsubishi FX3G-60MT PLC

the machine is Chinese only 5 years old and surprisingly its build is good. however.... its PLC has been password protected

The OEM does not have the password as this component was done by another Chinese company and they will not provide the password.

I and many others have requested the password and even rang the OEM and spoken to them in mandarin but the OEM does not have it and cannot get it off the other company (bad blood exists there I suspect)

I cannot access the PLC to go on-line due to password, I and many others have tried to crack this password with all manner of attempts to no avail. we have correct software and interfaces and can see the PLC but cannot access due to password entry stage not being valid.

machine is down at present and an output is not operating correctly (its not hardware, faulty output or wiring... its code related as I have checked all this, some coded condition is causing this)

does anyone have any experience with these PLC's and can add any thoughts on getting access?

very frustrating as its a simple machine with 44 inputs and 28 outputs. schematics are in broken English which adds another challenge

 

[drbitboy]

Without making any judgements about the process, have you tried this link?

 

[EICS]

Without making any judgements about the process, have you tried this link?

No, i didn't think it would be a simple thing, this has blown me away.

have you or do you know of anyone who has used this successfully?

it looks good on you tube but i am a little skeptical.....

thanks for this info, its most helpful for supporting this machine and worth a go.

 

[drbitboy]

No, i didn't think it would be a simple thing, this has blown me away.

have you or do you know of anyone who has used this successfully?

it looks good on you tube but i am a little skeptical.....

thanks for this info, its most helpful for supporting this machine and worth a go.

I would use a machine I did not care about, and air-gap that machine when I ran that crack .EXE.

 

[parky]

Be careful, depends on where that is hosted, it may contain malicious code, I do know somebody that used something called crack.exe to find a PW on a Q series, it trashed his hard disk, in saying that I have also heard of a program that does work, well, on the A series, I do know that the newer Q series the password is definitely harder to crack.

 

[Steve Bailey]

Treading on thin ice here, folks.

By consensus, this forum frowns on discussions of password cracks. However misguided the OEM may be in applying a password, it is their right to do so. it is the responsibility of the end user to obtain any necessary passwords they feel necessary prior to accepting the machine. If the OEM won't supply a password, buy from an OEM who will.

 

[parky]

I do agree but I think it is worth mentioning the dangers of sourcing cracks, it is an easy window for people to spread mayhem in the digital world, just look (or perhaps that's the wrong word lol) at **** sites, the number of people who have asked me to sort out their computer, usually find most screwed computers the history dictates the browsing of these sites or sites that distribute cracks etc.

 

[goghie]

You will obtain the code without comments, and it will be easier for you to do it from scratch than to decode it.

 

[cjfugal]

I can attest to what goghie says, I made it into one and found a few thousand rungs stuck in 1 routine with absolutely no description, live view wasn't much of a thing either.

 

[parky]

Most PLC's do not store comments or symbols in the PLC itself, however, in Mitsubishi there is an option (if using certain IDE, where the symbols, comments & source (if you call it that can be downloaded so that when uploaded it will re-construct the complete source, however, this is an option & not many programmers will do it or even know about it.
Also, if the original programmer used either GXIEC or GXWorks to program it, an upload will be difficult to understand as the program will contain hundreds of jumps past the main program END to sub routines. There will also be a very large amount of what could be considered temporary memory areas used as a way of passing parameters to those functions. For example: in GXIEC or Works if you create a FB (function block) when called in the main program the input/output pins of that function will use memory bits/words in the higher reserved area so for example if you created a simple add FB (not that you would) you have three variables two inputs & one output.
so the code produced is like the following
MOV D100 D998 //move the data in D100 FB IN
MOV D101 D997 // /Move the data in D101 FB IN
JC P0001 // jump to the subroutine
MOV D996 D102 // move the result back to D102 FB Out

FEND // end of main routine

P001: //Subroutine pointer
ADD D998 D997 D996 // do the maths in the function
RET // Return back to main routine
.....
.....
.....
END
As I said, you would not do this simple function as it would take more memory than using the built in functions, it is just a demonstration of how a structured LAD/FB program works.
The idea is to keep Melsec programs sort of compatible between IDE's.
So to answer the question in short form:
If it was programmed in GXDeveloper or the older IDE's and no symbols were downloaded to the PLC then it would be a strait list in ladder as one main routine.
If programmed in GXIEC or GXWorks AS a structured project then it is probable that there will be many jumps past the main routine to subroutines passing data via temporary variables.

 

[EICS]

thanks for all the info its appreciated.


its a very simple machine, end user lost a day and a half last week as i could not fault find the issue electrically, it ended up being a pressure regulator incorrectly adjusted - fiddled with by someone and not mentioned at all


very frustrating when you cannot access.