plcforum.uz.ua

unPassword CPU under star in STEP7-projects
http://plcforum.uz.ua/viewtopic.php?f=1&t=17844

Only for old password - not for Block Privacy


Earlier in STEP7 CPU passwords hidden under asterisks could see easily enough.
After all, the programmers who wrote the STEP7 used a standard method from the Microsoft Visual Studio:


It was enough to remove the asterisk in the property textBox.PasswordChar and password are displayed.
It could have been done a bunch of programs (asterwin, iws from Isqsoft ...)



However, starting with version 5.5 of this hole covered. Under the stars have no password.
But now you can see passwords in the STEP7 project using pss7


Requirements:
MS Framework 2.0 or higher.
tested on WinXP and Windows7.
virustotal.com check showed that the virus does not.

Using simple. Select the project folder and if it is the processors have the passwords, they will appear in the right part of the program.
Projects supported by any version of STEP7.


http://depositfiles.com/files/b32bowb2t
http://rghost.ru/38392812
http://webfile.ru/5980771
http://upfile.su/622
http://us.ua/897539/
http://hit-file.ru/j68vizr0ud0j.html

========= Others tools ==================
Unlock password for S7 200 and S7 300 MMC viewtopic.php?t=2005
UnPassword for S7 300 and S7 400 viewtopic.php?f=1&t=17844
Unlock password for S7 300 and S7 400 by dictionary (tested with PC adapters, CP5512, CP5611)
viewtopic.php?t=7029
Unlocking protected C-/VB-functions in WinCC viewtopic.php?f=37&t=4748

=================================================
Update



add pass MicroWin
add pass TIA Portal Step7 (S300/S400)
save pass in file (button "floppy")

http://depositfiles.com/files/68f5mv5pp
http://bayfiles.com/file/mMdR/SkJTxC/pss7.exe
http://webfile.ru/6145374
http://upfile.su/3198
http://www.ziddu.com/download/20494857/pss7.exe.html

p.s.
TIA Portal как оказалось хранит ВСЕ пароли, которые вы когда либо вводили.
И их легко можно посмотреть.

Password: vietdongluc

I don't have any special tool for it. I use Ollydbg and I can explain how to find a project password only if you know how to work with debugger.

Warning: the procedure disclosure may follow to complete impossibility to find a password in the future versions of Microwin because seimens developers does not sleep and know how to google, register on forum, etc.
Would you like to continue?

Ok, the procedure as follow:
I used Microwin from here:
http://www.filefactory.com/file/c2c2779/n/Step7.Micro.Win.v4.0.5.08.iso
No service packs were installed.

1. Attach to microwin.exe with Ollydbg and set breakpoint at address 0x0052334E (Raw offset: 0x0012334E) in module microwin.exe (add esp,14)
2. When you trying to open protected project type any password and click OK. The program will be caught at the specified breakpoint (press SHIFT+F9 if Olly got exception before breakpoint).
3. Open Memory window (Alt+M in Olly). Memory search pattern (ASCII): R04.00
4. Look at 20-30 follow bytes after found pattern and you'll see it ..


For another version of microwin the address (breakpoint) can be different. In this case you can search for all executive200.PRJ_Open* function calls and find needed peace of code.
I hope all clear for you..
Unpassword video s7-200_project_unpass_procedure_with_ollydbg: http://www.youtube.com/watch?v=zzMVl4iK-IU

The program S7_Unlock was written for passwords up to 8 characters ... In the near future it will be updated.
http://www.2shared.com/file/9Miamk7I/Unlock_and_converter_MMC_Image.html

http://depositfiles.com/files/p5v3sm00l
How did you downloaded DigiVis500 crack last time if wupload can not be visited?

not full unpassword
Что-то прога не договаривает... Password: vietdongluc

Updated Version 5.01 of the "Unlock_and_converter_MMC_Image_S7":
http://www.2shared.com/file/YQ1sgNFX/Unlock_and_converter_MMC_Image.html

http://www.2shared.com/file/kwoDiyWb/RTU_without_Pass.html

In SBR0 (NET_EXE) POU properties > Protection tab type 4G7S in password field and click Authorize button.

Password: nnnn (for all POUs)

Without uploaded project files...
...this is one of the ways to go:






Ollydbg v1.1 + special conversion and decryption software (developed by myself).

I will record an unpassword POU video in a free time...
However, if you need to unlock POUs urgently - upload your project now.
==========================================
If you want to look into POU you can use this method to bypass POU password and see code: viewtopic.php?f=1&t=5932&p=10582.
Here some people do this way. No need debugger even.
Do you still need my "know-how"?

======================
Cracked datamanagers for Step 7-Micro/WIN 4.0 SP9 (or "unprotect POU using any password"): http://www.4shared.com/rar/KGyhbMHf/datamanagers200dll_for_V40_STE.html

try 3369 as pass.

Hello

J6W8 for ETH1_CTRL and ETH1_XFR, POUs under the "Wizard" group
3597 for all remaining POUs

kn14 (for all POUs)

Password = 5954 (* for all POUs *)

Password: 7602 (for all POUs)

Password: 1356 (for all POUs)

Com_descarte (SBR6) POU password: 4G7S

Thanks all for sharing various views.

I wanna get some support too. I have s7-200 plc running with a project. it is password protected. i do not have any backup for this.

How can i upload project from the PLC? I do not wanna erase the plc as no backup with me.

regards

Your issue does not pertain to a project/POU protection.
I think the following topics may be helpful for you:
viewtopic.php?f=31&t=7029
viewtopic.php?f=31&t=2005

POU password: 1314

I don't have those files too. Add your request to the relevant topic.
Also, I don't uphold .dlls patching if there's a lot of other methods to find or bypass POU password exist.

Password = 24st (* for all POUs *)

dears ,

i have a project of s7 200 with some password protected POUs in it.
Plz give a solution to see inside the password protected
POUs/ if anyone could tell me the password so that i can open & see it.

http://www.4shared.com/file/w5FHecce/DROLIA_25_RAP.html

regards to all

Could you explain why...
...not a solution?

Added possibility to unprotect data blocks too (using any password):
http://www.4shared.com/rar/S7Jl2n65/datamanagers200dll_for_V40_STE.html
S7-MicroWIN version: 4.0.9.25
If new cracked datamanagers won't help - upload projekt.

https://www.rapidshare.com/files/3712818177/see_no_pass.rar

Good luck!

MAIN,SBR_0,SBR_1: 007
INT_0: 9100
are you happy now?

Hello.
Help please.
I need POU password on project
https://www.dropbox.com/s/se8f4i35mwy4f79/press110.mwp
Thanks a lot!

My methods are: unprotect with Ollydbg. Or use patched datamanagers. What kind of bruteforce you are talking about?
/password : 1314

Firstly im trying using Ollydbg, but cant find Entry point of function on button "Autorize".
Secondly im write script with AutoIt and run brute all generated passwords.
With password "1314" Program(v4.0.3) sayed "Password is incorrect"
I cant use datamanager200.dll because my ver of step7 is lower (v4.0.3) than patched datamanager(v.4.0.5)
and when i replace datamanager raised Exception like "Cant find Entry point of function..."

Sorry, my fault. I took a wrong project when move from one PC to another.
Your passwords:
EPC_COMM: EQoO
EPC_REVI: TGxK
EPC_TRAI: VTcK

ThankYou very much!
All passwords are 100% working.

POU=9W5K
PASS level2=0960

Password for all POUs: ptpp

Program blocks:
AVAN_CAT, C_FORMATURA: 9114

Program blocks ("Wizard" group):
PID0_INIT, PID1_INIT, PID2_INIT, PID_EXE: 9W5K
MOD4_CTRL: W9F3

Data blocks ("Wizard" group):
PID0_DATA, PID1_DATA, PID2_DATA: 9W5K
MOD4_DATA: W9F3

Not at all. There's nothing "bright" in the unpassword procedure and everyone who wants can do it.

Thanks for the post.
I just want to know which Step 7 versions your application applies:
1) Step 7 Ver 5.5
2) TIA V11 Sp2
3) MicroWin V4.9

Regards

AUTOSERVER_ESP: 1234
AUTOSERVER_ENV: 1234
AUTOSERVER_RCP: 1234
CTRL_GIRO: 1034
ESC_EANG: 1034
NET_CTRL: 1034

http://rapidshare.com/files/305294232/PLC.7z

Different name, but always same task and the same psw ?

Thanks

Dear all

i have a project of s7 200 with some password protected POUs in it.

http://www.4shared.com/file/-SUrVhEk/Binh224_PLC.html

Please help me

Thank a lot every body.

hi
i have a microwin project but i dont know its password on pou(subroutine12)
please help me
my project file is in this page: http://www.4shared.com/file/sZfcXZtk/s2 ... _2006.html
please please help me

Hi phavantuan6,
I'm not as to access the file , it's saying access denied, can you please reupload it or email me the file at deep_arvind@yahoo.com

I need to Unpassword the file urgently.
Please help!!!

Thanks in advance.

ЦчіМРт (OB1): A123
PID0_INIT (SBR10): 9W5K
PWM0_RUN (SBR11): B2H4
PID_EXE (INT0): 9W5K

hii dear

re posting the link

http://rapidshare.com/files/1121044574/i7b-3532-3rp48paharpur.mwp

http://www.4shared.com/file/Im9v9-J6/i7b-3532-3rp48paharpur.html


If still you can't download it please send me your mail id ,i will mail to you.

thanks a lot, my mail is myrobokits@gmail.com

To myrobokits

Load the alternative sites (4shared, letitbit, mediafire) or enable this option.
Good luck!

SBR_14 1460
SBR_12 1211
MOD5_CTRL W9F3
MOD5_DATA W9F3
Good luck!

Thanksssss You are awesome...

To israeldca

For (PRINCIPAL)OB1, SBR_0 and TP_177_Micro Pass: 5600

For USS3, USS_INIT, USS1, USS2, USS_CTRL, USS4, USS6, USS_RPM_W, USS5,
USS_WPM_W, USS_WPM_R, USS_RPM_R, USS_RPM_D, USS_WPM_D, USS7,
USS8, USS9 Pass: 2BW9

For Escala_Analogica Pass: vmcf

For TD_CTRL_408 and TD_ALM_408 Pass: J6R6

For RCP0_READ and RCP0_WRITE Pass: G0K1
Good luck!

I have problems with this program and unblock it but when I do the correction in the program works fine the problem is when I turn turn off and lose all changes and no longer know what to do : ( plissss help meee plsss


http://www.4shared.com/file/ffaMFp7a/bl ... 62013.html ------modified
http://www.4shared.com/file/-SfvH9zK/bloquera.html --------original

To guissous

Password OB1 zc35
Password library is 0123
Good luck!