MMC tools

SIMATIC S7-200/300/400, Step7, PCS7, CFC, SFC, PDM, PLCSIM,
SCL, Graph, SPS-VISU S5/S7, IBHsoftec, LOGO ...
Post Reply

MMC tools

Post by MMCist » Sun Oct 16, 2005 10:15 am

See ... 6a66893842

Das Tool liegt im VB6 Quellcode vor.
(und zwar nur im VB6 Code, keine EXE und so)
Gängige Tools, die es im Netz gibt, können folgendes nicht:
Anzeigen des SPS Programms das auf der karte ist (FC, DB, usw.)
Die gelesene Karte als Simatic Memory File Speichern.(mit Einschränkung)


------- Siemens S7 MMC eprom utils -----------

To make a image file of your S7 MMC card place the card in a standard MULTICARD READER (recognized by your Win32 System) and
start the S7imgRD.exe. Select the drive letter of the card from the combo box and hit start.
If your system ask to format the Card – cancel !do not format!
Give a image file name to the save file dialog. Compress the image file and mail it together with the S7imgWR.exe to any place you want or
just keep the image file for later eprom replication in case you do not have access to the project files.
To bring the image file back to a eprom works same way, use the S7imgWR.exe.
I have tested the S7imgRD and S7imgWR with 128kb and 512kb. If you experience any difficulties feel free to send me a bug report.

MMC Images for S7imgWR and WinHex

English ... edit-text=

Nuevo / new / neu S7imgRD V2.0 Dec 2014 win7

Site Admin
Posts: 3479
Joined: Thu Feb 16, 2006 3:25 pm
Location: Russia

Post by CoMod » Mon Apr 03, 2006 11:11 am

S7 Mmc
Hi every body,

last two weeks I was working on understanding what are S7-31x MMCs. In the end I collected following information:

64KB-4MB SIEMENS MMC cards are standard 16MB MMCs with special SIEMENS format. Datasheet at

8MB SIEMENS MMCs are the same but 32MB MMCs.

You can make bit copy of these MMCs by using tools at in standard MMC/SD card reader. By using this tools you also copy the special SIEMENS format.

But in case you would like to use non SIEMENS 16MB or 32MB MMC, you cant use it in S7 as every MMC has private CID and CSD register where are stored informacion as OEM/APPLICATION ID, PRODUCT NAME, .... . The example of SIEMENS 64KB MMC is at CID is OTP register and first 14 bytes of CSD are programed only by manufacturer. S7 checks and compares stored info. from CID and CSD.

If you have SIEMENS MMC accidentaly formated in standard MMC/SD card reader/writer (for example as FAT format) you can repair it in this standard MMC/SD reader/writer.
1. read original SIEMENS MMC by S7imgrd (the same size as failed card)
2. write this image to failed MMC by S7imgwr

When I was analyzing MMCs I also find out how is the password stored at the MMC.

If you have any question, email me at

-------- ----------------

Code: Select all

00:   FFh 01h FFh FFh FFh FFh FFh FFh
00:   FFh FFh FFh FFh FFh FFh FFh FFh
00:   FFh FFh FFh FFh FFh FFh FFh FFh
00:   FFh FFh FFh FFh FFh FFh FFh FFh
01:   FFh 00h FFh FFh FFh FFh FFh FFh
01:   FFh FFh FFh FFh FFh FFh FFh FFh
01:   FFh FFh FFh FFh FFh FFh FFh FFh
01:   FFh FFh FFh FFh FFh FFh FFh FFh
CID:  FFh 00h FEh 06h 00h 02h 41h 06h
CID:  41h 00h 00h 00h 25h 1Dh B9h 0Bh
CID:  20h 38h 87h 8Eh 36h FFh FFh FFh
CSD:  FFh 00h FEh 48h 0Eh 01h 2Ah 0Fh
CSD:  F9h 81h E9h F6h D9h 01h E1h 8Ah
CSD:  40h 00h 5Dh BEh 4Fh FFh FFh FFh
----------------------CID STRUCTURE (10)-----------------------
Manufacturer ID           MID         : 06h 
OEM/Application ID        OID         : 00h 02h 
Product name              PNM         : 41h 06h 41h 00h 00h 00h 
Produkt revision          PRV         : 25h 
Product serial number     PNM         : 1Dh B9h 0Bh 20h 
Manufacturing date        MDT         : 38h     (MM/YY=03/05)
7-bit CRC checksum        CRC7 [7:1]  :	43h     (43h)
16-bit CRC checksum       CRC7 [32:1] : 8E36h	(8E36h) 
----------------------CSD STRUCTURE (09)-----------------------
CSD structure             CSD_STR     : `01`
Spec versione             SPEC_VER    : `0010`
Reserved                  00          : `00`
Data read access time 1   TAAC        : 0x0E    (reserved1ms)
Data read access time 2   NSAC        : 0x01
Max. data transfer rate   TRAN_SPD    : 0x2A    (2.0x10 Mbit/s)
Card command classes      CCC         : 0x0FF
Max read data block len   R_BLK_LEN   : 0x9     (512 bytes)
Partial bl read allowed   R_BLK_PAR   : 1       (Enabled)
Write block misalignment  W_BLK_MIS   : 0       (Disabled)
Read block misalignment   R_BLK_MIS   : 0       (Disabled)
DSR implemented           DSR_IMP     : 0       (Disabled)
Reserved                  00          : `00`
Device Size               C_SIZE      : 0x7A7
Max. read current Vdd min VDD_R_C_MIN : 0x06    (60 mA)
Max. read current Vdd max VDD_R_C_MAX : 0x02    (10 mA)
Max. write I at Vdd min   VDD_W_C_MIN : 0x06    (60 mA)
Max. write I at Vdd max   VDD_W_C_MAX : 0x06    (80 mA)
Device size multiplyer    C_SIZE      : 0x04    (64)
Erase group size          ERA_GRP_SI  : 0x00    (00 sectors)
Erase group siz. multip.  ERA_GRP_MU  : 0x05    (128)
Write protect grp. size   WP_GRP_SI   : 0x00	(00 sectors))
Write protect grp. ena.   WP_GRP_E    : 1       (Enabled)
Manufacturer default ECC  DEFAULT_ECC : 0x0  
Write speed factor        R2W_FACTOR  : 0x0     (1x)
Max. wr  data block len   WR_BLK_LEN  : 0x9     (512 bytes)
Partial blk. wr allowed   WR_BLK_PAR  : 0       (Disable)
Reserved                  --          : 0x00    (0x00)
Content prot. app         CO_PRO_ALL  : x0       (Disable)
File format group         F_FORM_GRP  : x0       (RESERVED)
Copy flag (OTP)           COPY        : x0       (ORIGINAL)
Permanent write protect   PE_WR_PRO   : x0       (NOT PROTECTED)
Temporary write protect   TE_WR_PRO   : x0       (NOT PROTECTED)
File format               FILE_FMT    : x0x0     (Reserved)
ECC                       ECC         : x0x0     (2 bits)
7-bit CRC checksum        CRC7 [7:1]  : 0x2Eh   (2Eh)
Not used                  --          : 0x1
16-bit CRC checksum       CRC7 [32:1] : BE4Fh  	(BE4Fh)