SLC 500 Password

[stupidav]

Is there any way to bypass the Password on the SLC 500 with out losing everything.

I know there is a Master Reset that can be done. Although this will completely erase the program that resides on the controller and E-Prom. AB claims that you can get them and only them onsite and they can gain access to the program.

The problem is, I have a customer that had the Battery go bad and during an extened powerloss the Program was lost. The Unit has an E-Prom although the configuration is not setup to load from E-Prom. The unit will not allow the Program to be loaded from E-Prom with out the Password.

It would not be so bad but the program is doing some special ASCII stuff with some Obsolete Device. So I need to access the E-Prom to reload the program. The OEM of the machine has been out of business for some time and everyone that I have found that was part of the company has no idea as to what the password might be.

Yes, the customer is aware that they can contact AB (GMS Support) and get the situation resolved, but they had serious Bad Luck with them in the past, so it would be an absolute last resort as far as they are concerned.

Any help would greatly be appreciated.

 

[mwiskow]

Yes there is a way to do it.
Do you have the program on disk? or just on the eprom?
Email me your response and I will see what I can do.

 

[mwiskow]

Forgot my email: [email protected]

 

[Eddie Willers]

There's a risk here, that somebody will tell you "oh, here's the master password, I heard it from some A-B guy ten years ago". What if they are wrong and that blanks out your EEPROM ?

Usually folks who fish for a back-door password are trying to get into a program that's already in RAM (and yes, I know what it is). I don't know if that same method works for an EEPROM that's loading a passworded program into the CPU.

The right thing to do is hire GMS to come unlock the damn thing. Tell them it's their opportunity to make up for their past screw-up.

There's another risk.... Phil usually shuts down password related threads as soon as somebody objects.

 

[stupidav]

Thanks to all for the info and help.

Eddie I talked to the customer today, and they said that they would scrap the machine before they let GMS back into their facility.

Apperantly the GMS Rep. was on the main production line network and accidentally downloaded the machine program that he was working on to a different machine. The customer lost that program, and then once it was determined what had happened (obviously everything was down at that point)GMS charged them for their time to reprogram the machine that they messed up to begin with, not to mention the Downtime that was never recovered.

After all of that, is how I got in the door.

I don't have any problems with GMS (which is why I recomened them to my customer), but I do understand where my customer is coming from. Fortunatly AB does give out publicly the master reset password that will clear the program so I know what not to use.

 

[Phil Melore]

public password?

snip...
Fortunatly AB does give out publicly the master reset password that will clear the program so I know what not to use.

I question that statement stupidav, since this forum is 'very public' and everytime that password is posted here our friends at AB remind me that it's "not public".

So, please save me the editing headache by not posting it... not that you were going to anyway... but just in case someone else is thinking about it.

Enjoy,

 

[stupidav]

Sorry Phil,

I do know for a fact that the passwords to Clear the entire unit including the Program / reset it back to factory defaults, at least used to be available right from ABs Wedsite. I only know this because I got them from them apporximatly 8-10 months ago. I ran into a different situation where as I built a machine for a customer out of bits and peices of some old equipment. I just cleared the unit and was able to start from scratch with out Pulling the Processor apart and shorting several things out that they recomend as an alternate means of reseting the processor. I will look for the documentation that I found and if it is still available can I send it to you or at least post a link to it as long as it is 100% legitimate?

Sorry to trouble you,

Dave

 

[stupidav]

http://domino.automation.rockwell.c...BE3CAFB92000CB6C85256AFB0065D486?OpenDocument

 

[BobB]

Is the storage device an EPROM or EEPROM?

If an EPROM, I understood there was no way to overwrite the thing except by UV light in the window.

Am I wromg? Does the PLC have an EPROM writer of some sort built in that will over write? Have never seen a PLC that could do that yet.

If the device is an EEPROM, that is a different kettle of fish.

 

[Fred Floggle]

In deference to Phil , I won't give him a fanny wobble by posting the password as I once did before . I didn't think that this password was anything special at the time , but it seems it isn't that well known .
If only there was a way into S7 PLC's - I have yet to find one .
Unfortunately I'm not close by or I could help , surely there must be someone close who knows the trick ?
Did you say that you had the password protected program resident on a PC ? If you did , I could help you with that .
Sorry , just re-read the post , you could send the eprom - what processor do you have ?

 

[Ken Moore]

Link to another ---deleted by phil---

 

[Wiggum]

backdoor

Try

---deleted by phil---

 

[Fred Floggle]

Well done , what kind of a

W
A
N
K
E
R

are you ?
What a frickin hot shot

 

[rsdoran]

With the SLC500 there are 2 options. If its the OEM lock feature that has you blocked then you may have to get the OEM, AB may not be willing to unlock an existing clients program.

The OEM lock doesnt have a master password bypass that I am aware of.

I thought the SLC used numeric passwords, 0-9 combinations. Would that be 10^10 (10 to the power of 10)? Shouldnt take long to try those combinations....you do get paid by the hour dont you?

 

[Phil Melore]

Dear all,

I have been told that such password stuff is considered proprietary by the vendor. The vendor told me that... so ethics tells me to abide by their request.


Therefore, please do not 'link to' nor post such information about cracking theirs or other vendors passwords.

Thanks for your cooperation!!!

Enjoy,