[?]: version for S7-200 crack password

votuandktd · Post by **votuandktd** » Mon Sep 15, 2008 5:43 am

Hello everybody!

I found new program for S7-200 crack password in china website but I don't know how to use it. Anyone help me!
Link:
http://www.tf168.cn/p/l/plc/atfile/S7-200.rar
http://www.tf168.cn/p/l/plc/atfile/s7200.rar

zzz-zzz · Post by **zzz-zzz** » Mon Sep 15, 2008 8:10 am

s7200.rar
AVG antivirus detect virus :
Trojan horse BackDoor.Generic9.OPD";"Infected"

but Kaspersky Online Scanner 7.0 say : there isn't Infected objects

votuandktd · Post by **votuandktd** » Mon Sep 15, 2008 9:13 am

I use NOD32 v3.0.657, not problem

votuandktd · Post by **votuandktd** » Wed Sep 17, 2008 8:18 am

hi,
I found how PC read S7-200 V1 password:

- connect with PLC address 2
10 02 00 49 4B 16

- Read password command
68 1B 1B 68 02 00 6C 32 01 00 00 00 00 00 0E 00 00 04 01 12 0A 10 02 00 08 00 00 03 00 05 E0 D2 16 10 02 00 5C 5E 16

- PLC answer
68 1D 1D 68 00 02 08 32 03 00 00 00 00 00 02 00 0C 00 00 04 01 FF 04 00 40 93 92 0E 0D 84 87 0E 0D FB 16

=> Password: 93 92 0E 0D 84 87 0E 0D
=> 93 92 9D 9F
=> 9 8 7 5

Anyone know "Read password command" of S7-200 CPU 226 V2?

maximax · Post by **maximax** » Fri Sep 19, 2008 1:38 pm

hi votuandktd,
how do you use the connect and read command? I try to send them to com port but I don't receive any answer message.

Thanks

errornet · Post by **errornet** » Thu Sep 25, 2008 1:44 pm

Why I view this filename in archive S7-200□□□PLC□□□□.rar

in Russian wrote:У меня файлы в архиве выглядят приблизительно так:
S7-200□□□PLC□□□□.rar
У меня тексты в документах приблизительно также.
Будто шрифта нет.

Post by **CoMod** » Thu Sep 25, 2008 2:02 pm

This is chinese Unicode font

in Russian wrote:Это китайский Unicode шрифт

Front_Line · Post by **Front_Line** » Fri Dec 05, 2008 12:15 pm

Post by **CoMod** » Fri Dec 05, 2008 1:58 pm

possible this is swindle version

возможно это мошенники обувают лохов на деньги

viewtopic.php?t=9415

fanren · Post by **fanren** » Sat Dec 06, 2008 2:42 am

I use this worked. try input 18077463. but it's not new version.
good luck!

Front_Line · Post by **Front_Line** » Mon Dec 08, 2008 1:36 pm

And can be share completely the worker? I enter 18077463 - there are no results.

fanren · Post by **fanren** » Tue Dec 09, 2008 6:27 am

good luck!

votuandktd · Post by **votuandktd** » Tue Dec 09, 2008 7:24 am

I can't worked. Please share program worked. many thanks

zengplc · Post by **zengplc** » Fri Dec 26, 2008 3:40 am

I want to give the register program to you,how to upload?
The crack program cannot crack s7200 china verson. who can crack?
http://plcforum.uz.ua//s7200cr.rar

co_don831 · Post by **co_don831** » Wed Jan 07, 2009 3:48 am

I try download it but i run , it's promt :

please help me ! thank you

sareeb · Post by **sareeb** » Thu Jan 08, 2009 11:55 am

Which cable can be work with this software? Could you please do me a favor?

Thanks
Saree

china_runtime · Post by **china_runtime** » Wed Jan 14, 2009 3:49 am

I download it ,but I try more times,it can not read the password! why ???

Danve · Post by **Danve** » Sat Jan 24, 2009 3:52 am

Hi,

I input 18077463 but still can't work.
The first number is different, in my computer is 36505420.

Help.........

Thank you

Front_Line · Post by **Front_Line** » Wed Feb 04, 2009 3:54 pm

It is not necessary to enter 18077463, it is necessary to download
http://plcforum.uz.ua//s7200cr.rar (keygen), the inquiry about registration will be gone. But in work the program did not try

geoux · Post by **geoux** » Mon Mar 02, 2009 3:03 pm

I do not understand that the procedure used to decode password
someone could read the password using this program or another method better

NouTec · Post by **NouTec** » Mon Mar 16, 2009 2:47 pm

Dear All

I've downloaded the KeyGen & also registered No Problem

Now,Which cable will be connected to the CPU,is it the PC/PPI cable from Siemens or RS-232 cable?

I need to know the answer from you urgently as I face a problem in my Machine

Thanks in Advanced

Omar · Post by **Omar** » Mon Apr 13, 2009 8:04 am

Dear Site Admins,

I want to read application program from PLC which is protected. Althought i have examined your web pages but couldn't find any crack program which is worked. If there is worked crack password program Could you pls post the link?

Many thanks,

amit · Post by **amit** » Thu Apr 23, 2009 2:54 pm

Dear friends
Gone through this topic and downloaded S7200 crack and regidter . But in the application many buttons are inactive and at the bottom garbage is obseved when you press uppermost key.
Pl let me know operating procedure for this soft or other program that works.

Amit

jamie Quach · Post by **jamie Quach** » Thu Apr 30, 2009 12:19 pm

Hi votuandktd,
let me know how PLC password is 9875 ? (98 i know):
- PLC answer
68 1D 1D 68 00 02 08 32 03 00 00 00 00 00 02 00 0C 00 00 04 01 FF 04 00 40 93 92 0E 0D 84 87 0E 0D FB 16

=> Password: 93 92 0E 0D 84 87 0E 0D
=> 93 92 9D 9F
=> 9 8 7 5
Thanks

amit · Post by **amit** » Sat May 02, 2009 5:09 pm

Which program r u using to give these commands and viewing PLC ans. Is it same which we are discussing in this tread?
Amit

jamie Quach · Post by **jamie Quach** » Sun May 03, 2009 1:13 am

Follow votuandktd, u can using to give commands by VB6 :
- Read password command
68 1B 1B 68 02 00 6C 32 01 00 00 00 00 00 0E 00 00 04 01 12 0A 10 02 00 08 00 00 03 00 05 E0 D2 16 10 02 00 5C 5E 16
And viewing PLC response.
If password is 22222222 then PLC response: 68 1d 1d 68 00 02 08 32 03 00 00 00 00 00 02 00 0c 00 00 04 01 ff 04 00 40 98 98 00 00 98 98 00 00 f5 16
If password is 22222222 then PLC response: 68 1d 1d 68 00 02 08 32 03 00 00 00 00 00 02 00 0c 00 00 04 01 ff 04 00 40 93 92 0e 0e 91 90 08 08 07 16
remark:
9A hex = 0
9B hex = 1
98 hex = 2
99 hex = 3
9E hex = 4
9F hex = 5
9C hex = 6
9D hex = 7
92 hex = 8
93 hex = 9
Hi votuandktd
Can you answer my question:
if password : 9875
- PLC answer
68 1D 1D 68 00 02 08 32 03 00 00 00 00 00 02 00 0C 00 00 04 01 FF 04 00 40 93 92 0E 0D 84 87 0E 0D FB 16
let me know how PLC password is 9875
I only understand and find password 98**
Many Thanks

votuandktd · Post by **votuandktd** » Mon May 04, 2009 3:18 am

9D = 0E XOR 93
9F = 0D XOR 92

Good luck

votuandktd · Post by **votuandktd** » Mon May 04, 2009 3:26 am

amit wrote:Which program r u using to give these commands and viewing PLC ans. Is it same which we are discussing in this tread?
Amit

I wrote a Visual basic program, used MSComm32.ocx to connect PC with PLC S7-200.
I send command and read answer.
Good luck

jamie Quach · Post by **jamie Quach** » Mon May 04, 2009 6:05 am

votuandktd wrote:9D = 0E XOR 93
9F = 0D XOR 92
Good luck

Thank you very much

amit · Post by **amit** » Wed May 06, 2009 10:06 am

Dear votuandktd ,
can you Pl share the program ?

votuandktd · Post by **votuandktd** » Thu May 07, 2009 7:51 am

You can use this program, you need modify it to suitable with your purpose

Code: Select all


Private Sub Form_Load()

    With MSComm1
        .CommPort = 1
        .Settings = "9600,e,8,1"
        .InputLen = 0
        .RThreshold = 1
        .InputMode = comInputModeBinary
    End With
    If MSComm1.PortOpen = False Then
        MSComm1.PortOpen = True
    End If
End Sub

Private Sub Form_Unload(Cancel As Integer)
    If MSComm1.PortOpen = True Then
        MSComm1.PortOpen = False
    End If
End Sub

Function ppird(readaddress As String)

    Dim i As Integer, temp As Integer
    Dim sendbyte(32) As Byte
    sendbyte(0) = &H68
    sendbyte(1) = &H1B
    sendbyte(2) = &H1B
    sendbyte(3) = &H68
    sendbyte(4) = &H2
    sendbyte(5) = &H0
    sendbyte(6) = &H6C
    sendbyte(7) = &H32
    sendbyte(8) = &H1
    sendbyte(9) = &H0
    sendbyte(10) = &H0
    sendbyte(11) = &H0
    sendbyte(12) = &H0
    sendbyte(13) = &H0
    sendbyte(14) = &HE
    sendbyte(15) = &H0
    sendbyte(16) = &H0
    sendbyte(17) = &H4
    sendbyte(18) = &H1
    sendbyte(19) = &H12
    sendbyte(20) = &HA
    sendbyte(21) = &H10
    sendbyte(22) = &H4
    sendbyte(23) = &H0
    sendbyte(24) = &H1
    sendbyte(25) = &H0
    sendbyte(26) = &H1
    sendbyte(27) = &H84
    sendbyte(28) = &H0
    sendbyte(29) = (readaddress * 8) \ 256
    sendbyte(30) = (readaddress * 8) Mod 256
    sendbyte(31) = &H0
    sendbyte(32) = &H16
    For i = 4 To 30
        temp = temp + sendbyte(i)
    Next
    sendbyte(31) = temp Mod 256
    
    ppird = sendbyte

End Function

Function ppiww(adressx As Integer, datax As Integer)

    Dim i As Integer, temp As Integer
    Dim sendbyte(38) As Byte
    sendbyte(0) = &H68
    sendbyte(1) = &H21
    sendbyte(2) = &H21
    sendbyte(3) = &H68
    sendbyte(4) = &H2
    sendbyte(5) = &H0
    sendbyte(6) = &H6C
    sendbyte(7) = &H32
    sendbyte(8) = &H1
    sendbyte(9) = &H0
    sendbyte(10) = &H0
    sendbyte(11) = &H0
    sendbyte(12) = &H0
    sendbyte(13) = &H0
    sendbyte(14) = &HE
    sendbyte(15) = &H0
    sendbyte(16) = &H6
    sendbyte(17) = &H5
    sendbyte(18) = &H1
    sendbyte(19) = &H12
    sendbyte(20) = &HA
    sendbyte(21) = &H10
    sendbyte(22) = &H4
    sendbyte(23) = &H0
    sendbyte(24) = &H1
    sendbyte(25) = &H0
    sendbyte(26) = &H1
    sendbyte(27) = &H84
    sendbyte(28) = &H0
    sendbyte(29) = (adressx * 8) \ 256
    sendbyte(30) = (adressx * 8) Mod 256
    sendbyte(31) = &H0
    sendbyte(32) = &H4
    sendbyte(33) = &H0
    sendbyte(34) = &H10
    sendbyte(35) = datax \ 256
    sendbyte(36) = datax Mod 256
    sendbyte(37) = &H0
    sendbyte(38) = &H16
    For i = 4 To 36
        temp = temp + sendbyte(i)
    Next
    sendbyte(37) = temp Mod 256
    ppiww = sendbyte
    
End Function

Private Sub MSComm1_OnComm()
Dim rcvtemp(5) As Byte
Dim rcv_array() As Byte
Dim yy As Long
    Select Case MSComm1.CommEvent
        Case comEvReceive
            rcv_array = MSComm1.Input
            If rcv_array(0) = &HE5 Then
                MSComm1.RThreshold = 25
                rcvtemp(0) = &H10
                rcvtemp(1) = &H2
                rcvtemp(2) = &H0
                rcvtemp(3) = &H5C
                rcvtemp(4) = &H5E
                rcvtemp(5) = &H16
                MSComm1.Output = rcvtemp
            ElseIf rcv_array(0) = &H68 And rcv_array(1) = &H17 Then
                yy = Val(rcv_array(25)) * 256 + Val(rcv_array(26))
                Text1 = yy
            Else
                MSComm1.RThreshold = 1
            End If
        End Select
    watchtimer.Enabled = False
End Sub

amit · Post by **amit** » Mon May 11, 2009 9:31 am

Dear votuandktd,
Tahnk you very much for sharing program code. I dont know much about VB and not in touch for long time but now i will go through it once again and let you know.

Amit

hoanhnghiep · Post by **hoanhnghiep** » Fri May 22, 2009 2:46 pm

Hi votuandktd,
Please help me !
I send command :

Code: Select all

10 02 00 49 4B 16

(connect with PLC address 2)
then PLC S7-200 CPU224 answer :

Code: Select all

10 00 02 00 02 16

But I send command :

Code: Select all

68 1B 1B 68 02 00 6C 32 01 00 00 00 00 00 0E 00 00 04 01 12 0A 10 02 00 08 00 00 03 00 05 E0 D2 16 10 02 00 5C 5E 16

then PLC no response.
Can you help me to explain why PLC no response?

Sorry my knowledge about VB6 no good.
This is my program, can you help me to show wrong points ?

Code: Select all

Private Sub Form_Load()
With MSComm1
.Settings = "9600,e,8,1"
.InputLen = 0
.RThreshold = 1
.InputMode = comInputModeBinary
End With
Timer1.Enabled = False
Timer2.Enabled = False
End Sub
Private Sub Command1_Click()
MSComm1.PortOpen = True
MSComm1.Output = Chr(16) & Chr(2) & Chr(0) & Chr(73) & Chr(75) & Chr(22)
Timer1.Enabled = True
End Sub
Private Sub Timer1_Timer()
Text1.Text = MSComm1.Input
Call Command2_Click
Timer2.Enabled = False
End Sub
Private Sub Command2_Click()
MSComm1.Output = Chr(104) & Chr(27) & Chr(27) & Chr(104) & Chr(2) & Chr(0) & Chr(108) & Chr(50) & Chr(1) & Chr(0) & Chr(0) & Chr(0) & Chr(0) & Chr(0) & Chr(14) & Chr(0) & Chr(0) & Chr(4) & Chr(1) & Chr(18) & Chr(10) & Chr(16) & Chr(2) & Chr(0) & Chr(8) & Chr(0) & Chr(0) & Chr(3) & Chr(0) & Chr(5) & Chr(224) & Chr(210) & Chr(22) & Chr(16) & Chr(2) & Chr(0) & Chr(92) & Chr(94) & Chr(22)
Timer2.Enabled = True
End Sub
Private Sub Timer2_Timer()
Text1.Text = MSComm1.Input
MSComm1.PortOpen = False
Timer2.Enabled = False
End Sub

Thanks
Hoanhnghiep

votuandktd · Post by **votuandktd** » Sat May 23, 2009 1:57 am

Hi Hoanhnghiep,

You should modify my program and use

Code: Select all

"Private Sub MSComm1_OnComm()"

Good luck,

hsbeyond · Post by **hsbeyond** » Fri Jul 03, 2009 8:56 am

have the crack version,
but i don't know how to upload

duonis · Post by **duonis** » Fri Nov 13, 2009 10:31 am

This password read command (68 1B 1B 68 02 00 6C 32 01 00 00 00 00 00 0E 00 00 04 01 12 0A 10 02 00 08 00 00 03 00 05 E0 D2 16 10 02 00 5C 5E 16 ) work corectly with S7 200 V1 ,but with V2 plc response (68 1D 1D 68 00 02 08 32 03 00 00 00 00 00 02 00 0C 00 00 04 01 FF 04 00 40 00 00 00 00 00 00 00 FB 16
Maybe somebody know how read password new version S7 200 plc
Thanks

trumen · Post by **trumen** » Tue May 11, 2010 4:23 am

votuandktd wrote:I can't worked. Please share program worked. many thanks

I steel cannot running the reading PLC

gauravkharadi · Post by **gauravkharadi** » Sun May 04, 2014 12:44 pm

Dear, Please let me know how you have sent the command (software) and which was the cable?

Thanks
Gaurav H.

influx · Post by **influx** » Sun Jun 29, 2014 8:26 pm

Hi, anybody help me my plc password;CPU224XP
pls request : 68 1D 1D 68 00 02 08 32 07 00 00 00 16 00 0C 00 04 00 01 12 08 12 85 01 00 00 00 D6 02 0A 00 00 00 FE 16

thank u.

edwardmanurung · Post by **edwardmanurung** » Fri Dec 19, 2014 5:01 pm

Would you share the program in exe file? Because I already try with vb6, but no good result

the program stop after end sub of form_load. I don't know why

rahulkhaladkar · Post by **rahulkhaladkar** » Thu Sep 24, 2015 11:42 am

dear sir please send updated link s7200.exe

KadirUG · Post by **KadirUG** » Sat Sep 19, 2020 10:49 pm

Hello
Thanks For This Great Sharing Jamie
How about LETTER Uppercase and Lowercase Do You Have This List ?

For example :
?? hex = A
?? hex = B
?? hex = C
?? hex = D

Thanks..

Juanci · Post by **Juanci** » Wed Dec 14, 2022 4:25 am

I am looking for a program to remove the password to the project of a plc s7 200 smart, also for the HMI.

Mukesh01987 · Post by **Mukesh01987** » Mon Apr 01, 2024 8:01 pm

Please share file.. Link has dead..

PLCforum.uz.ua

[?]: version for S7-200 crack password

[?]: version for S7-200 crack password

Read password command CPU 226 V2?

I want to give the register program to you

s7-200 crack pass error ?

Re: [?]: New version for S7-200 crack password!

Re: Read password command CPU 226 V2?

Cable of S7-200 Crack

S7-200 crack password

Re: Read password command CPU 226 V2?

Re: Read password command CPU 226 V2?

Re: Read password command CPU 226 V2?

Re: [?]: New version for S7-200 crack password!

Re: S7 200 CRACK

Re: Read password command CPU 226 V2?

Re: [?]: version for S7-200 crack password

Re:

Re: [?]: version for S7-200 crack password

Re: [?]: version for S7-200 crack password

Re: [?]: version for S7-200 crack password

Re: [?]: version for S7-200 crack password