S7 300 PLC password

[bmw_apprentice]

Hello,

I have a bit of a situation, and I think I know the answer but this font of knowledge may prove something.

I want to do the unthinkable.

We have a machine where the supplier has gone bust and to this date we cannot find anyone who has a copy of the PLC program, they are either lying or it actually doesnt exist. The PLC is password protected in TIA V14 (I think 14, could be 15) and I cannot upload from it, get online to it, anything.

S7300 PLC. In TIA.

I have tried an old back door method using wire shark to capture the password in plain text but that loophole seems to be closed now. No surprise.

Is there anything I can do? I just want a backup so we dont run blind waiting for the machine to fail....

 

[mk42]

Hello,

I have a bit of a situation, and I think I know the answer but this font of knowledge may prove something.

I want to do the unthinkable.

We have a machine where the supplier has gone bust and to this date we cannot find anyone who has a copy of the PLC program, they are either lying or it actually doesnt exist. The PLC is password protected in TIA V14 (I think 14, could be 15) and I cannot upload from it, get online to it, anything.

S7300 PLC. In TIA.

I have tried an old back door method using wire shark to capture the password in plain text but that loophole seems to be closed now. No surprise.

Is there anything I can do? I just want a backup so we dont run blind waiting for the machine to fail....

I don't know of a way around the PLC access protection.


What you should be able to do is pull the memory card out of the PLC and pull the project off it. You'd need either a Siemens Field PG or a USB prommer to read the MMC card.


There is a way to do an "online backup" but I think it requires being online with the PLC first, which wouldn't help you much.

 

[bmw_apprentice]

Ah, ha...

Does this work???

I can do this... I have both a prommer and MMC reader. I assumed this would be password protected

 

[mk42]

I assumed this would be password protected

Honestly, never tried with a password, but it's worth a go, right?

 

[RVaughan]

With Online Backup in Portal you won't have the editable program, more like an image of the compiled program. I have never tried to get one with a 300 processor in Portal, much less one password protected.

 

[JunQ]

Hello,
Just searching other stuff and saw your question. You are very likely to have a chance to find an app to hack the password. I did this 7 years ago but that was on Step7. I guess it still works on TIA as password is on MMC.
In case of scam, don't pay for it wherever it asks.

 

[Chris PLC]

go to PLC247.com they sell a program for $80 that will tell you the password for any S7-300 MMC.
I have used it several times.