[LINK]: Unlocking protected C-/VB-functions in WinCC

engineer · Post by **engineer** » Mon Oct 02, 2006 12:35 pm

How it possible - to unlocked Know_how_protected functions in winCC?

ppp · Post by **ppp** » Mon Dec 11, 2006 6:44 am

The program for removal of the password from C-scripts Wincc (version 5 and 6).

ppp in Russian wrote:Программа снятия парольной защиты с ВыньСС скрипта

http://s2kkpp.narod.ru/
script_WinCC_without_password

See new version 1.6 Jun 30, 2014
viewtopic.php?f=1&t=17844

Всем удачи!

ppp · Post by **ppp** » Mon Dec 11, 2006 8:19 am

Manual remove password from VB-script
1. Open file in WinHex http://winhex.com/winhex/index-m.html
2. In the end the file has such appearance:
Passworded
00 00 00 01 00 00 00 00 00 00 06 00 00 00 73 5E 52 57 5E 16
UnPassworded
00 00 00 00 00 00 00 00 00 00 06 00 00 00 73 5E 52 57 5E 16

01 - Attribute of presence of the password
06 - Number of symbols in the password
735E52575E16 - The coded password

We change 01 on 00 and the script can be opened

in Russian wrote:Снять пароль с VB-скрипта еще проще.
Открываем файл скрипта любым 16-ричным редактором (например Winhex).
В конце файл имеет примерно такой вид:
00 00 00 01 00 00 00 00 00 00 06 00 00 00 73 5E 52 57 5E 16
где 735E52575E16 - закодированный пароль
06 - число символов в пароле
01 - признак наличия пароля
Меняем 01 на 00 и скрипт можно будет открыть.

Писать оболочку для указанных действий что-то лень.

Post by **sania** » Mon Dec 11, 2006 8:50 am

великое дело сделал

votuandktd · Post by **votuandktd** » Mon Mar 17, 2008 2:10 am

ppp wrote:Manual remove password from VB-script
1. Open file in WinHex
2. In the end the file has such appearance:
00 00 00 01 00 00 00 00 00 00 06 00 00 00 73 5E 52 57 5E 16

735E52575E16 - The coded password
06 - Number of symbols in the password
01 - Attribute of presence of the password

We change 01 on 00 and the script can be opened

I open file .bmo in Winhex, but it don't look like this. Any advance?

kiran kalburgi · Post by **kiran kalburgi** » Wed Jan 13, 2010 9:55 am

Yes you are correct it doenot look li this any other method???

ppp · Post by **ppp** » Tue Jul 13, 2010 7:21 am

New patcher for un/protection password c-scripts, support WinCC v4.2, 5, 6, 7
program need MS Framework >=1.1

WinccNoProtect

See new version

Link · Post by **Link** » Mon Jul 19, 2010 5:16 am

Update
as not all produced by hand using WinHEX unprotect VB-scripts and added the removal of this protection in the patch.
I recall a program patches only WinCC, the project is no manipulation is not

т.к. не у всех получается вручную с помощью WinHEX снять защиту с VB- скриптов добавил снятие и этой защиты в патч.
Напоминаю программой патчуется только WinCC, с проектом никаких манипуляций не производится.

Support C-script WinCC v4.2, 5, 6, 7
Support VB-Script WinCC v6, 7

https://mega.co.nz/#!GMUXSSKD!5pO7o_OAQ ... qmJp2ZPeDc

aguere · Post by **aguere** » Tue Aug 17, 2010 6:56 pm

Hi, I try it,s, but I not open protect script, always ask me the password. I try with wincc 7 sp1. I think it´s possible that the file have into folder,etc...Can anyone help me.

Thank you very much

ppp · Post by **ppp** » Wed Aug 18, 2010 4:35 am

You use C-script or VB-script?
Please give me your script in personal messages.
I try help.

ppp · Post by **ppp** » Thu Aug 26, 2010 2:36 pm

I check program.
Support only Windows 2000, WindowsXP.

NOT SUPPORT Windows 7

Link · Post by **Link** » Wed Sep 15, 2010 12:14 pm

New version. Add support Windows7.
need MS Framework >=2.0

WinccNoProtect1.2.exe

aguere · Post by **aguere** » Sat Sep 18, 2010 7:26 pm

Thank you very much, now run ok.
I try in my project, and magic open script. thank again..........
aguere

ppp · Post by **ppp** » Thu May 31, 2012 12:48 pm

Only for old password - not for Block Privacy

Только для старого метода паролирования - не для Block Privacy

Earlier in STEP7 CPU passwords hidden under asterisks could see easily enough.
After all, the programmers who wrote the STEP7 used a standard method from the Microsoft Visual Studio:

Раньше в STEP7 пароли процессоров под звездочками можно было посмотреть достаточно легко.
Ведь программисты, написавшие STEP7 использовали стандартный прием от Microsoft Visual Studio:

It was enough to remove the asterisk in the property textBox.PasswordChar and password are displayed.
It could have been done a bunch of programs (asterwin, iws from Isqsoft ...)

Достаточно было убрать звездочку в свойстве textBox.PasswordChar и пароль отображался.
Это можно было сделать кучей программ (asterwin, iws от Isqsoft и др.)

However, starting with version 5.5 of this hole covered. Under the stars have no password.
But now you can see passwords in the STEP7 project using pss7

Однако начиная с версии 5.5 эту дыру прикрыли. Под звездочками уже нет никакого пароля.
Однако теперь можно посмотреть пароли в проекте STEP7 с помощью программы pss7

Requirements:
MS Framework 2.0 or higher.
tested on WinXP and Windows7.
virustotal.com check showed that the virus does not.

Using simple. Select the project folder and if it is the processors have the passwords, they will appear in the right part of the program.
Projects supported by any version of STEP7.

Требования:
MS Framework 2.0 и выше.
проверено на WinXP и Windows7.
проверка на virustotal.com показала, что вирусов нет.

Пользоваться просто. Выбираем папку проекта и если в нем процессоры имеют пароли, то они отобразятся в правой части программы.
Поддерживаются проекты созданные в ЛЮБОЙ версии STEP7.

========= Others tools ==================
Unlock password for S7 200 and S7 300 MMC viewtopic.php?t=2005
UnPassword for S7 300 and S7 400 viewtopic.php?f=1&t=17844
Unlock password for S7 300 and S7 400 by dictionary (tested with PC adapters, CP5512, CP5611)
viewtopic.php?t=7029
Unlocking protected C-/VB-functions in WinCC viewtopic.php?f=37&t=4748
Decoder ProSave viewtopic.php?f=37&t=8598

sudanee · Post by **sudanee** » Mon Jun 11, 2012 11:57 pm

thank you very mush
Its helpful

ppp · Post by **ppp** » Tue Oct 02, 2012 10:50 am

Updata.

add password MicroWin
add password TIA Portal Step7 (CPU S7-300/S7-400)
save passwords in file (button "floppy")

p.s.
TIA Portal как оказалось хранит ВСЕ пароли, которые вы когда либо вводили.
И их легко можно посмотреть.

Post by **CoMod** » Thu Oct 04, 2012 7:53 am

https://www.virustotal.com/file/925bd96 ... 349290882/
My Avast blocked to download updated version of pss7.exe too

PPP uses bad Crypt packer for decrease size and for anti reverse analyzing

Kaspersky find nothing

Russian wrote:PPP использует плохие упаковщики для уменьшения размера файла и чтобы никто не смог разобрать и понять логику его программы
Касперский пока молчит

consol · Post by **consol** » Fri Nov 02, 2012 9:24 pm

Excellent. Worked perfectly.
Thanks

ppp · Post by **ppp** » Fri Dec 07, 2012 7:48 am

Updata to v1.3

add password WinCC C-script from *.pas

see v1.6

ppp · Post by **ppp** » Tue Dec 11, 2012 11:41 am

Updata to v1.4

add password WinCC VB-script
fix bugs

see v1.6

Post by **sania** » Wed Dec 12, 2012 5:42 am

check Universal UnProtector for Step7 and WinCC
viewtopic.php?f=1&t=17844&p=57434#p57434

PPP wrote:add password WinCC VB-script

pupylator · Post by **pupylator** » Sat Jan 19, 2013 10:17 am

Hello ppp,
do you have solution for s7-1200? On all others workes fine but on 1200 not at all...
THX

ppp · Post by **ppp** » Tue May 07, 2013 9:17 pm

Updata to v1.5

add password LOGO!
fix bugs

see v1.6

ppp · Post by **ppp** » Thu Oct 24, 2013 2:16 pm

New version 1.5.1
Fix bugs.

see v1.6

spiadimonis · Post by **spiadimonis** » Thu Jan 02, 2014 10:43 pm

Hello PPP,

GREAT JOB!!

Are you looking some solution for s7-1200?

THX

vlad2006gr · Post by **vlad2006gr** » Wed Jan 08, 2014 9:44 am

Re links.
http://www.4shared.com/rar/PG4jXta8ce/p ... ord_1.html
http://www.mediafire.com/download/8hor4 ... word_1.rar
Password=1
Good luck!

YeuPLC · Post by **YeuPLC** » Mon Jan 13, 2014 6:29 am

Thank you verry much! Tool is good!

ppp · Post by **ppp** » Mon Jun 30, 2014 12:17 pm

New version 1.6

+ fix bugs
+ add panel Pro-face

iegova · Post by **iegova** » Wed Jul 30, 2014 12:31 pm

Не планируется ли для серии s7-1200 подобное сделать? мне бы сейчас очень помогло

xflash · Post by **xflash** » Wed Dec 03, 2014 1:21 pm

Thanks again for the update.

Now we are waiting for the 7.3 unPassword

thanks again

expert2010 · Post by **expert2010** » Tue Dec 09, 2014 12:57 pm

Waiting for S7 - 1200 CPUs

ignat116 · Post by **ignat116** » Tue Dec 23, 2014 2:03 pm

Оживите ссылки пожалуйста

oleksandr_ua · Post by **oleksandr_ua** » Wed Jan 07, 2015 8:39 pm

WinCCnoprotect

viewtopic.php?f=37&t=4748

Как программой Passwords Simatic определяются пароли на скрипты WinCC?

Есть проект WinCC, интегрированный в Step7, указываю путь к проекту Step7, пароли на скрипты WinCC не появляются в окне Passwords Simatic?
Что делаю не так?

P.S. Хотел скачать еще WinCCnoprotect.exe, но все ссылки не рабочие....

oleksandr_ua · Post by **oleksandr_ua** » Thu Jan 08, 2015 8:07 am

all the links are not working...
give a working link

ppp · Post by **ppp** » Wed Feb 18, 2015 12:40 pm

New version 1.7

>= MS Framework 4.0 (For Windows 7,8,10)
add pass project PLC Delta
add pass project Elau EPAS-4
fix bugs

http://www37.zippyshare.com/v/v3s8LhyS/file.html
http://rghost.ru/6pRFByyML
https://1fichier.com/?f2cvw9nse5
http://ge.tt/6J6nKlA2/v/0?c

new upload
no detect "virus"

oleksandr_ua · Post by **oleksandr_ua** » Wed Feb 18, 2015 7:58 pm

does not start
windows 8...

windows xp sp3
does not start and does not write

Post by **CoMod** » Wed Feb 18, 2015 8:13 pm

use VirtualBox - no problem

ppp · Post by **ppp** » Thu Feb 19, 2015 9:19 am

new upload
no detect "virus"

Post by **CoMod** » Thu Feb 19, 2015 5:38 pm

ppp wrote:new upload
no detect "virus"

1/57

Qihoo-360 HEUR/QVM03.0.Malware.Gen 20150219

ppp · Post by **ppp** » Fri Apr 17, 2015 9:00 am

New version 1.8a

add pass project TwidoSuite from Schneider Electric

http://www79.zippyshare.com/v/cXfJJJQ6/file.html
http://rghost.ru/6QkKjhh8G
https://1fichier.com/?7p48qa78vw
http://ge.tt/2F0sVtG2/v/0

akus0n · Post by **akus0n** » Tue Apr 21, 2015 7:10 am

Is it also possible to see Password for safety program (S7 F-Systems, based on CFC - not Distributed Safety)???

kaffeemuehle · Post by **kaffeemuehle** » Thu Apr 30, 2015 6:01 pm

Is there what to follow with Elau EPAS-4 projects?

No password is indicated(signalised).

A vintage and a writing password presumably exists here.

Kopyloff · Post by **Kopyloff** » Tue May 05, 2015 6:29 pm

Thank you very much! v1.7 is working very well, but on v1.8 - virus 11 / 56:
https://www.virustotal.com/ru/file/d7e9 ... /analysis/

s_victor_s · Post by **s_victor_s** » Fri May 08, 2015 8:41 am

TIA Portal V13 SP1 not work

xflash · Post by **xflash** » Mon Jun 22, 2015 12:42 pm

pss cannot make it in all time. Any updates ?

Great thanks~

ppp · Post by **ppp** » Tue Jun 23, 2015 8:03 am

viewtopic.php?f=1&t=17844

miden · Post by **miden** » Mon Jul 06, 2015 7:06 am

Thank you very much! 1.8A working very well. CPU & safety hacked.
Can you add passwords for AS-i monitor 3?

art12345art · Post by **art12345art** » Sat Aug 22, 2015 11:32 pm

level of the programer GOD

ppp · Post by **ppp** » Tue Sep 22, 2015 8:45 am

updata to v1.82
fix bugs

http://www42.zippyshare.com/v/jzMYnxZP/file.html
http://rghost.ru/8t5LhY27Q
https://1fichier.com/?2919yzluvn
http://ge.tt/3WkmdKO2/v/0
http://multiupload.biz/czhe2vb6i5ea/pss ... z.exe.html

ADMIN add

=========== if you're afraid of threats - Use in Virtual Machine ==================
=========== если боитесь угрозы - используйте на Виртуальной Машине ==================
https://www.virustotal.com/ru/file/7006 ... 442933620/
2015-09-22 14:53:40 UTC 4/56 (DrWeb Trojan.DownLoader11.18272 )
2015-12-21 17:58:28 UTC 2/55 (DrWeb Trojan.DownLoader11.18272 )

xflash · Post by **xflash** » Tue Oct 27, 2015 7:20 am

Great thanks.

1.82 works like a charm.

Will ppp try to reveal the wincc 7.2/7.3SE picture password? It is needed in future.