Dead PLC recovery (S7-200 SMART v2.01)

[ffstest]

Hello,

Unfortunately I have a S7-200 SMART (SR40 CPU) v2.01 on a machine from China that has a dead output. I cannot read nor write to the PLC because of Level 4 protection.

Is it possible to swap the EEPROM to another working PLC (without burned output) of the same model to keep the program and parameters?


The program is level 4 protected and the manufacturer of the machine is out of business.

I hope EEPROM swap could work or is there a way to downgrade to level 3 on the SMART S7-200 v2.01? I could modify the program to use another output which is fine (unused)





I have some tools for the S7-200 to decrypt bin file from EEPROM but I have S7-200 SMART (SR40 CPU) v2.01 will this work on this newer unit??


Any clues will greatly help!

Thank you very much!!!

Steve

[cedricliu]

If you are in China,you can contact the cracker who can erase the Smart password and upload the program.
The fee is about 1800RMB.
http://www.jiemiplc.com/

[ffstest]

Thanks!

I guess this unit is very hard to crack.

Another question... where is the program block / parameters stored in the PLC? On the EEPROM or inside the MCU?

[yanzixiang]

There are 3 pcb in the box,1 for cpu,1 for IO,and 1 for power,
You can just replace the IO board.