[REQUEST] Image (back-up) of 32GB SIMATIC S7 Memory Card

[VATEK]

Hello ,

Someone will have teh Image of Cards the S7 1200 and S7 1500 cards

S7-1200 cards in WinHex or in .S7img or simply in .img


To update the S7 1200 firmware
6ES7 954-8LF01-0AA0 24 MB
6ES7 954-8LF01-0AA0 24 MB

6ES7 954-8LE01-0AA0 12 MB
6ES7 954-8LB01-0AA0 2 MB

Although the cards are standard MMC or SD with special SIEMENS format, I don't know if they can be cloned ....
In the S7 device presumably, the normal MMC cannot be used as S7 needs a card with special register in the CID and CSD registers
But for backup done by WinHex (not for use in S7) you can use any MMC or RS-MMC.

However, third-party MMC can be used if the CID and CSD records in the MMC match SIEMENS CID, CSD records.

For example, SIEMENS 64K to 4MB MMC cards run on the same hardware (16MB MMC), 8MB SIEMENS MMC, and 32MB MMC.

It is not possible to format a 4MB to 64KB card as the 4MB and 64KB cards run on the same hardware because they have different CID registers.

S7 recognizes the MMC size of CID, CSD and the card format. All these three records must match.

The CID and CSD registers are OTP (programmable once by the manufacturer) In the CSD register, the last 8 bits and CRC are partially programmable by the user.

I made my own bakery CID and CSD card reader / writer and programmed a simple C ++ program as I couldn't find any standard MMC reader with the ability to read and write CSD registers.

Right now I am looking for any supplier who can provide me with programmed MMC such as SIEMENS MMC.
If I'm successful, the price of these cards will drop a lot ...

The MMC image file of S7imgRD.exe or WINHEX

I also used OllyDbg, OllyDbg is a 32-bit and 64-bit assembly-level parser debugger for Microsoft® Windows®. The emphasis on parsing binary code makes it especially useful in cases where the source is not available.

With Ollydbg you will set the breakpoint to the address, for example the address 0x0052334E (raw offset: 0x0012334E)

http://www.ollydbg.de/


These cards cost too much, almost as much as the CPU

The fact is that a 6ES7 954-8LF01-0AA0 card or the 6ES7954-8LF02-0AA0 24 MB successor card is required to update the firmware of an S7 1200

6ES7954-8LF01-0AA0
SIMATIC S7 MEMORY CARD, 24 MB
*** Replacement *** SIMATIC S7, Memory Card for CPU S7-1x 00 / SINAMICS, 3, 3 V Flash, 24 MByte
6ES7954-8LF02-0AA0
SIMATIC S7 MEMORY CARD, 24 MB



I will put the steps to follow to update the firmware versions 6ES7 2xxzzz30 0XB0 in case anyone requests it.

For example, in the S7-1200 of the CPU with order number 6ES7 2141BE30 0XB0.

To update the S7-1200 firmware we must use a previously empty 24 MB SIMATIC SD card, without formatting ATTENTION !!!!

To EMPTY this type of cards it is very important to know that they cannot be formatted using the Windows format utility, as Microsoft ATTENTION !!!!
Windows renders the card unusable and can no longer be used in an S7-1200 CPU.

The CPU firmware is updated by performing the following steps
Step 1: Use the PC to erase the contents of the memory card using the card reader. Tip: Don't format the memory card!
Step 2: Download the firmware update file from Siemens official website. After downloading and unzipping it, the user will receive the "S7_JOB.SYS" and "FWUOPDATE" file Step 3: Copy the "S7_JOB.SYS" file and the "FWUOPDATE.S7S" folder to the memory card.
Step 4: Insert the memory card into the S7-1200 CPU card slot. The CPU will stop at this point and the "MINIT" LED will flash.
Step 5: Plug in the CPU (power on) after a power failure. If the "RUN / STOP" LED on the CPU flashes red and green alternately, the firmware is being updated. If the "MAINT" LED flashes, the update is complete.
Step 6: Remove the memory card.
Step 7: Disconnect and reconnect the CPU (power off / on).

[Petrozawodsk]

Hello.

Can anybody help with copy image (back-up) of 32GB SIMATIC S7 Memory SD Card?
Art No. 6ES7954-8LT02-0AA0 or 6ES7954-8LT03-0AA0.
Need disk sector-by-sector image, created by WinHex for example.

Всем привет.
Прошу помочь с образом семёновской цпушной SD карты на 32ГБ.
Пойдёт любой формат дампа, лишь бы был полный (с первого, до последнего сектора).
Спасибо заранее.

SIMATIC S7, memory cards for S7-1x 00 CPU, 3.3V Flash, 32GB

Formatting a SIMATIC memory card
https://support.industry.siemens.com/cs ... 7&lc=en-OM

[CoMod]

it won't help you - someone else's dump won't work
for S7 SD cards, the checksum is calculated from the hard-coded hardware serial number
это тебе не поможет - чужой дамп не подойдёт
для S7 SD карт контрольная сумма вычисляется по жёстко записанному аппаратному серийному номеру
http://s7detali.narod.ru/MMC/SMC.html

попробуй отформатировать в CPU =Formatting of a SIMATIC memory card may only be carried out in a CPU.

Deleting the contents of the SIMATIC memory card You have the following options for deleting the contents of the SIMATIC memory card:

● delete files using Windows Explorer

● format with STEP 7 Note If you format the card with Windows utilities, you will render the SIMATIC memory card unusable as a storage medium for a CPU.

Deletion of files and folders is permitted, with the exception of the "__LOG__" and "crdinfo.bin" system files.

These are required by the CPU. If you delete these files, then you will no longer be able to use the SIMATIC memory card with the CPU. If the "__LOG__" and "crdinfo.bin" system files have been deleted, format the SIMATIC memory card as described in the following section.

Formatting a SIMATIC memory card
Note
Formatting of a SIMATIC memory card may only be carried out in a CPU. Otherwise the SIMATIC memory card cannot be used in the S7-1500 CPUs.
If you want to format the SIMATIC memory card using STEP 7, an online connection to the relevant CPU must exist. The relevant CPU is in the STOP mode.
Proceed as follows to format a SIMATIC memory card:
1. Open the Online and Diagnostics view of the CPU (either from the project context or via "Accessible devices").
2. In the "Functions" folder, select the "Format memory card" group.
3. Click the "Format" button.
4. Click "Yes" in response to the confirmation prompt.
Result:
● The SIMATIC memory card is formatted for use in S7-1500 CPUs
● The data on the CPU are deleted with the exception of the IP address

[Petrozawodsk]

...попробуй отформатировать в CPU...

Спасибо.
Но вопрос всё-таки открытый.

У меня нет такой карты, мне нужна инфа с такой большой карты.
Хочу разобраться в структуре данных такой карты.

I don't have card. I need information, what exactly is located inside it.
So I need disk image for education purposes.
Can anybody make copy?
To share it - you can make archive to reduce final size.

[CoMod]

the structure there is simple - there is a directory with service files
and a copy of the service file data at the end of the address space
understand on the WinHex images http://s7detali.narod.ru/MMC/SMC.html

структура там простая - есть каталог со служебными файлами
и копия данных служебного файла в конце адресного пространства
понимай на выложенных образах http://s7detali.narod.ru/MMC/SMC.html

Code: Select all

24 MB S7img 	S7-1200-24MB.S7img				real size 32 MB
24 MB WinHex 	6ES7954-8LF02-0AA0_24_MB_SMC.ZIP		real size 32 MB
		6ES7954-8LF03-0AA0_24_MB.ZIP (3 cards) 		real size 32 MB
4 MB WinHex 	6ES7954-8LC02-0AA0.zip				real size 8 MB
2 GB WinHex 	6ES7954-8LP02-0AA0_2GB_SMC_0098cb7108.zip 	real size 2 GB

[Petrozawodsk]

Я для начала изучил инет, и детали на народе тоже. А потом уже запостил топик.
Мне непонятны остались некоторые поля, думаю с большими флешками разберу остальные.

Im already studied that link before. I need extra info from bigger one.

[CoMod]

а как ты представляешь несжатый образ в 32 гигабайта ? Винда его выдержит ?
на руках есть на 2 ГБ, и несколько 24 МБ.

and how do you imagine an uncompressed image of 32 gigabytes? Will Windows handle it?
I have a 2 GB one on hand, and several 24 MB ones.

[Petrozawodsk]

Выдержит. Винхекс его всеравно частями грузит в память.
А если его надо смонтировать, я обычно винхексом на флешку через картридер пишу и винда подтягивает.
Плюс Винхекс может парсить образ сам и файлики оттуда брать, но он как-то плохо это делает, поэтому я обычно образ на флешку нарезаю.

Не могли бы вы с ваших карт образа сделать, ну или хотя бы "crdinfo.bin" с них выложить?
При одних и тех же заказных, внутри оказываются разные данные. Похоже для семёна разные конторы флехи штампуют.
Обычно образа по большей части пустые, так что после 7Zip они очень маленькие.

Чутка доп. инфы по картам
How do you calculate the service life of a memory card of the S7-1500/S7-1200 and ET 200?
https://support.industry.siemens.com/cs/document/109482591

Winhex still loads it into memory in parts.
And if it needs to be mounted, I usually write it to a flash drive via a card reader with Winhex and Windows pulls it up.
Winhex can parse the image itself and take files from there, but it does it poorly, so I usually cut the image onto a flash drive.

Could you make an image from your cards, or at least upload "crdinfo.bin" from them?
With the same orders, there are different data inside. It looks like different companies stamp flash drives for Semen.
Usually the images are mostly empty, so after 7Zip they are very small.

A little extra information on the cards
How do you calculate the service life of a memory card of the S7-1500/S7-1200 and ET 200?
https://support.industry.siemens.com/cs/document/109482591

[Petrozawodsk]

Does anybody have 6AV6881-0AP40-0AA0 or 6AV6881-0AQ40-0AA0 - SIMATIC HMI MEMORY CARD, 32GB?
I need image copy of it, or at least "crdinfo.bin" file from the root of flash disk (hidden, system file).

Может есть у кого такие флешки?
Нужен образ, ну или на крайний случай скрытый системный файл из корня диска "crdinfo.bin".

https://support.industry.siemens.com/cs/pd/1353878?pdti=pi&dl=ru&lc=ru-RU
https://support.industry.siemens.com/cs/pd/1353880?pdti=pi&dl=ru&lc=ru-RU

(6AV6881-0AP40-0AA0, 6AV6881-0AQ40-0AA0 - SIMATIC HMI MEMORY CARD, 32GB)

[Dfcz]

лишь бы был полный (с первого, до последнего сектора).

Там есть еще служебный сектор, который обычным кардридером не прочитать.

[kaitoukid_1997]

Hello,
Do you have img. copy file yet?

[framuga]

Hi. Does anyone have a winhex image of a 32GB card for the 1200/1500 PLCs? Thanks. 6ES7954-8LT02-0AA0

[framuga]

Does anyone at least have the CID number for a 32GB card? Or the crdinfo.bin file?