[?+]: unPassword Step7/Micro/Win S7-200/S7-300 Project

Utilites for Simatic Automation
Post Reply
ppp
Posts: 246
Joined: Thu Feb 09, 2006 6:52 am
Location: Russia

[?+]: unPassword Step7/Micro/Win S7-200/S7-300 Project

Post by ppp » Fri Jul 29, 2011 10:36 am

unPassword CPU under star in STEP7-projects
viewtopic.php?f=1&t=17844

Only for old password - not for Block Privacy
Только для старого метода паролирования - не для Block Privacy
Earlier in STEP7 CPU passwords hidden under asterisks could see easily enough.
After all, the programmers who wrote the STEP7 used a standard method from the Microsoft Visual Studio:
Раньше в STEP7 пароли процессоров под звездочками можно было посмотреть достаточно легко.
Ведь программисты, написавшие STEP7 использовали стандартный прием от Microsoft Visual Studio:
Image
It was enough to remove the asterisk in the property textBox.PasswordChar and password are displayed.
It could have been done a bunch of programs (asterwin, iws from Isqsoft ...)
Достаточно было убрать звездочку в свойстве textBox.PasswordChar и пароль отображался.
Это можно было сделать кучей программ (asterwin, iws от Isqsoft и др.)
Image

However, starting with version 5.5 of this hole covered. Under the stars have no password.
But now you can see passwords in the STEP7 project using pss7
Однако начиная с версии 5.5 эту дыру прикрыли. Под звездочками уже нет никакого пароля.
Однако теперь можно посмотреть пароли в проекте STEP7 с помощью программы pss7
Image
Requirements:
MS Framework 2.0 or higher.
tested on WinXP and Windows7.
virustotal.com check showed that the virus does not.

Using simple. Select the project folder and if it is the processors have the passwords, they will appear in the right part of the program.
Projects supported by any version of STEP7.
Требования:
MS Framework 2.0 и выше.
проверено на WinXP и Windows7.
проверка на virustotal.com показала, что вирусов нет.

Пользоваться просто. Выбираем папку проекта и если в нем процессоры имеют пароли, то они отобразятся в правой части программы.
Поддерживаются проекты созданные в ЛЮБОЙ версии STEP7.
http://depositfiles.com/files/b32bowb2t
http://rghost.ru/38392812
http://webfile.ru/5980771
http://upfile.su/622
http://us.ua/897539/
http://hit-file.ru/j68vizr0ud0j.html

========= Others tools ==================
Unlock password for S7 200 and S7 300 MMC viewtopic.php?t=2005
UnPassword for S7 300 and S7 400 viewtopic.php?f=1&t=17844
Unlock password for S7 300 and S7 400 by dictionary (tested with PC adapters, CP5512, CP5611)
viewtopic.php?t=7029
Unlocking protected C-/VB-functions in WinCC viewtopic.php?f=37&t=4748

=================================================
Update

Image

add pass MicroWin
add pass TIA Portal Step7 (S300/S400)
save pass in file (button "floppy")

http://depositfiles.com/files/68f5mv5pp
http://bayfiles.com/file/mMdR/SkJTxC/pss7.exe
http://webfile.ru/6145374
http://upfile.su/3198
http://www.ziddu.com/download/20494857/pss7.exe.html

p.s.
TIA Portal как оказалось хранит ВСЕ пароли, которые вы когда либо вводили.
И их легко можно посмотреть.
Last edited by ppp on Tue Dec 11, 2012 11:36 am, edited 1 time in total.

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [help] Remove Password Project S7-200 ?

Post by Linkinx64 » Sat Jul 30, 2011 4:29 am

Password: vietdongluc

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: Remove Password Project S7-200 ?

Post by Linkinx64 » Mon Aug 01, 2011 1:50 pm

asimvirk wrote:Please tell the procedure or tool information
YeuPLC wrote:Please,send for me Tool Remove or you can guide me how to remove password.
I don't have any special tool for it. I use Ollydbg and I can explain how to find a project password only if you know how to work with debugger.

Warning: the procedure disclosure may follow to complete impossibility to find a password in the future versions of Microwin because seimens developers does not sleep and know how to google, register on forum, etc.
Would you like to continue? (read)

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: Remove Password Project S7-200 ?

Post by Linkinx64 » Tue Aug 02, 2011 6:00 am

Ok, the procedure as follow:
I used Microwin from here:
http://www.filefactory.com/file/c2c2779 ... 0.5.08.iso
No service packs were installed.

1. Attach to microwin.exe with Ollydbg and set breakpoint at address 0x0052334E (Raw offset: 0x0012334E) in module microwin.exe (add esp,14)
2. When you trying to open protected project type any password and click OK. The program will be caught at the specified breakpoint (press SHIFT+F9 if Olly got exception before breakpoint).
3. Open Memory window (Alt+M in Olly). Memory search pattern (ASCII): R04.00
4. Look at 20-30 follow bytes after found pattern and you'll see it ..
Image

For another version of microwin the address (breakpoint) can be different. In this case you can search for all executive200.PRJ_Open* function calls and find needed peace of code.
I hope all clear for you..
Unpassword video s7-200_project_unpass_procedure_with_ollydbg: http://www.youtube.com/watch?v=zzMVl4iK-IU

Last edited by Linkinx64 on Tue Jan 24, 2012 10:59 am, edited 4 times in total.

smsasg
Posts: 44
Joined: Tue Apr 11, 2006 4:40 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by smsasg » Thu Aug 04, 2011 1:50 pm

The program S7_Unlock was written for passwords up to 8 characters ... In the near future it will be updated.
http://www.2shared.com/file/9Miamk7I/Un ... Image.html

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Fri Aug 05, 2011 4:28 am

brave_eagle wrote:Is it possible to upload to another host, wupload can not be visited
http://depositfiles.com/files/p5v3sm00l
(offtop) How did you downloaded DigiVis500 crack last time if wupload can not be visited?
not full unpassword
Что-то прога не договаривает... Password: vietdongluc
Image

smsasg
Posts: 44
Joined: Tue Apr 11, 2006 4:40 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by smsasg » Wed Aug 10, 2011 7:50 am

The program S7_Unlock was written for passwords up to 8 characters ... In the near future it will be updated.
Updated Version 5.01 of the "Unlock_and_converter_MMC_Image_S7":
http://www.2shared.com/file/YQ1sgNFX/Un ... Image.html

http://www.2shared.com/file/kwoDiyWb/RT ... _Pass.html

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Sun Nov 20, 2011 4:50 am

gombit wrote: http://narod.ru/disk/31733372001/RTU.mwp.html Please help me remove password in POU NET_EXE, or tell me how this programm is work.
In SBR0 (NET_EXE) POU properties > Protection tab type 4G7S in password field and click Authorize button.

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Mon Jan 02, 2012 5:25 am

Password: nnnn (for all POUs)

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

unPassword procedure for Microwin project/pou/etc.

Post by Linkinx64 » Fri Jan 13, 2012 4:37 pm

elettrodo wrote:hello guys,who can tell me how to open a protected subroutine microwin? Thank you.
sehgal0070 wrote:dears ,

i have a project of s7 200 with some password protected POUs in it.
Pl give a solution to see inside the password protected
POUs/ if anyone could tell me the password so that i can open & see it.

regards to all
etc, etc..
Without uploaded project files...
...this is one of the ways to go:

Image

(thnx)

Which version do you use Ollydbg ?
Ollydbg v1.1 + special conversion and decryption software (developed by myself).
Jaza wrote:I was hoping you could explain to how to use ollydbg to find the password for a POU?

I would appreciate that thank you. with you detailed explanation and video I was able to crack the password of a whole project but unable to use the same instructions to get a password for a POU.
I will record an unpassword POU video in a free time...
However, if you need to unlock POUs urgently - upload your project now.
==========================================
Uvex wrote:project is password protected we should look in ollydbg for the executive200.PRJ_Open* function (set breakpoint and so on), it work, i checked it.But if only one POU is password protected and rest of the project is without any password this method doesn't work, what function do I have to look for? How to find password to POU not for the project?
If you want to look into POU you can use this method to bypass POU password and see code: viewtopic.php?f=1&t=5932&p=10582.
Here some people do this way. No need debugger even.
Do you still need my "know-how"?

======================
Cracked datamanagers for Step 7-Micro/WIN 4.0 SP9 (or "unprotect POU using any password"): http://www.4shared.com/rar/KGyhbMHf/dat ... 0_STE.html

peterg70
Posts: 121
Joined: Tue Apr 12, 2011 1:44 pm

Re: [?]: unPassword locked Microwin 4.0 subroutine

Post by peterg70 » Sat Jan 14, 2012 12:36 am


Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Wed Feb 22, 2012 6:09 am

Hello
Evgeniy24rus wrote:Hello, help please with password S7-200 Micro-Win
http://www.2shared.com/file/Hsu-lYMI/PD_8000_1_VA.html
J6W8 for ETH1_CTRL and ETH1_XFR, POUs under the "Wizard" group
3597 for all remaining POUs

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Tue Jun 12, 2012 3:32 pm

shara_ks wrote:plz help me how to remove the step7 microwin pou password plz help me unpassword plz help me sir
kn14 (for all POUs)

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Tue Jul 03, 2012 4:20 am

vjcaes wrote:can anybody unlock the POU's in the project I link?

https://www.dropbox.com/s/jn8036zh0equn ... 110612.mwp
Password = 5954 (* for all POUs *)

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Mon Jul 16, 2012 4:50 am

oldsnake wrote:hello
please help unlock password
http://file2.uploadfile.biz/i/IDENMEIMIIEZXD
thank
Password: 7602 (for all POUs)

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Wed Jul 18, 2012 6:33 am

Ilde wrote:Could you tell me the password of this file, pls??

It's really important for me, thank you!!
https://rapidshare.com/files/3530978013 ... 5recup.mwp
Password: 1356 (for all POUs)
lessat wrote: would like to know de password of the POU 6 (Com_descarte), of the S7-200.
Is it possible?

The program is in the link above:

http://www.4shared.com/zip/kGbFQR9I/PackLine03.html?
Com_descarte (SBR6) POU password: 4G7S

tufail_74
Posts: 32
Joined: Wed Mar 22, 2006 9:44 am
Location: Middle East

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by tufail_74 » Thu Jul 19, 2012 5:58 pm

Thanks all for sharing various views.

I wanna get some support too. I have s7-200 plc running with a project. it is password protected. i do not have any backup for this.

How can i upload project from the PLC? I do not wanna erase the plc as no backup with me.

regards

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Fri Jul 20, 2012 5:36 am

tufail_74 wrote:I have s7-200 plc running with a project. it is password protected. i do not have any backup for this.
Your issue does not pertain to a project/POU protection.
I think the following topics may be helpful for you:
viewtopic.php?f=31&t=7029
viewtopic.php?f=31&t=2005

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Fri Aug 24, 2012 5:33 am

siemeas wrote:Could you tell me the password of this file, pls??
https://rapidshare.com/files/4258171024/ZJ-KTF0901.mwp
POU password: 1314

Linkinx64
Posts: 894
Joined: Sun Apr 11, 2010 3:00 am
Location: Russia

Re: [?+]: unPassword Step7-Micro/Win S7-200 Project

Post by Linkinx64 » Sat Aug 25, 2012 1:15 pm

Uvex wrote: unfortunately all the download links are not active. Where could I download this dll files?
I don't have those files too. Add your request to the relevant topic.
Also, I don't uphold .dlls patching if there's a lot of other methods to find or bypass POU password exist.
elektronikmuh wrote:Could you tell me the password of this file, pls??
Mail:muh.elektronik@gmail.com
https://rapidshare.com/files/2292287533/5th%201630-.mwp
main: z9Jo
com_init: 1112
com_send: 1112
com_incept: 1112
absolute_value: 1112
inverter_run: z9Jo
JianSuJuLiJiSuan: 1112
HSC_Initialization: z9Jo
IPC_display: z9Jo
work_start_set: z9Jo
IPC_try_PRG: z9Jo
parameter_conversion: z9Jo
IO_and_parameter_mapped: z9Jo
load_table: z9Jo
unload_table: z9Jo
furnace: z9Jo
fur_account: z9Jo
quench_1: z9Jo
reset: z9Jo
blower: z9Jo
glass_length: z9Jo
fur_TT: z9Jo
fur_GSJL: z9Jo
fur_kWF: z9Jo
fur_GSCL: z9Jo
fur_WF: z9Jo
DBCDI: 1112
que1_JS: z9Jo
que1_WF: z9Jo
que1_CS: z9Jo
que1_auto: z9Jo
que1_manual: z9Jo
que_TT: z9Jo
com_incept_int: 1112
com_send_int: 1112