Siemens S7 CPU Locked

[JesperMP]

.. the original inquirer only wanted to be able to download a new program.

.. don't have its Step7 project and want to download its
blocks, create a symbol table and be able to make some
necessary changes to its program.

So he wants to access the program, not to clear it.

 

[RMA]

Yes, I know Jesper, that's why I made it clear that the guy hadn't mentioned whether or not it was effectively a ClearPLC effect or not - especially in view of the fact that the original inquierer wasn't bothered.

It's always worth inquiring , though.

 

[John Gaunt]

S7-300 CPU Locked

Thanks RMA, JesperMP, jrwb4gbm and Ken M,

I need to get past the password but cannot risk losing
the program as I don't have the Step7 project. If I can
get past the password then I can generate a new project.

I will try to email andi in Germany.
Regards............John Gaunt

 

[bobsheck]

S7-300 CPU Locked

While I am not familiar with this brand of PLC, the password and other programming instructions are probably stored in an EAROM - Electrically Alterable Read Only Memory chip. So if the chip is in a socket, you could remove the chip and put it in a reading device and dump the contents out to a reader, then you should be able to recover the password. Obviously this is what the manufacturer could do for you if you could get them to do it.

It sounds like a hacker with the right tools could decode it for you. Unfortunatley I don't have the tools available but in theory, that's the way to go.

 

[John Gaunt]

S7 CPU Locked

Thanks bobsheck,
I will keep your suggestion in mind. Unfortunately I don't have the equipment available to read the memory chip. I have tried monitoring the communications between the Step7 PC and the PLC and find that it is encoded or encripted.
Regards.............John Gaunt

 

[John Gaunt]

S7 CPU Locked

Thanks bobsheck and RMA,
Look like the memory card is the way to go.
As indicated by RMA there is somebody in Germany who for a fee will decode the data on the memory card and provide the password.
This is his e-mail address: [email protected]

I expect this will solve my problem.
Thanks again.

 

[martin xiang]

s7-300 cpu locked

Dear John,

This is martin from china, i have a same problem with yours,and have same situation like yours before. i need your help.
our cpu type as belows
CPU module: CPU315-2DP 315-2AF03-0AB0
FLASH card: MC 951/128KB /5V FLASH
6ES7 951-0KG00-0AA0

as your mentioned,can i find the password via comlite32 under win98? how can i do?

I also has not reding device,and we only have 1 off flash card, if lose,i am worried we will lose the whole machine.

You are experienced on this,pls help me.

Your answer is my highly appreciated.

BR
martin
[email protected]

 

[martin xiang]

s7-300 cpu locked

Dear John,

This is martin from china, i have a same problem with yours,and have same situation like yours before. i need your help.
our cpu type as belows
CPU module: CPU315-2DP 315-2AF03-0AB0
FLASH card: MC 951/128KB /5V FLASH
6ES7 951-0KG00-0AA0

as your mentioned,can i find the password via comlite32 under win98? how can i do?

I also has not reading device,and we only have 1 off flash card, if lose,i am worried we will lose the whole machine.

You are experienced on this,pls help me.

Your answer is my highly appreciated.

BR
martin
[email protected]

 

[istantch]

any success with this password issue ?

 

[John Gaunt]

"UNLOCKING" S7 PLC CPU

We managed to find the PASSWORD for the PLC by purchasing the
services of Andi Rothenbacher in Germany

S.Rothenbacher GmbH
Benzstr.6 89079 Ulm
tel: 0731 45020
fax: 0731 46055
email: [email protected] <mailto:[email protected]>
<http://www.rothenbacher-gmbh.de>

Andi was able to find the PASSWORD from a copy of the files
stored on the Micro Memory Card (MMC)

Regards.................John Gaunt

 

[istantch]

Glad to hear that Jhon. Thanks for the address and email.
Does Andi speak english. What was the charge ?

 

[RMA]

Glad to hear that the contact worked out - hope the price wasn't excessive!

 

[John Gaunt]

The charge was 1110 Euros.

English is no problem.

Regards.............John Gaunt

 

[istantch]

What was the procedure he asked you to do in order to get the password transferred to where. Memory stick. I have a client willing to use his service. I will send Andy email , but would like to get more info before that - Thanks John Gaunt !

 

[John Gaunt]

Hi Istantch,
Andi provided instructions. It was just a matter of
putting the MMC card in a reader attached to a laptop
and copying all the files from MMC to a folder on PC.
This was emailed to Andi who emailed back the password.
Regards.........John Gaunt