MMC tools

[MMCist]

See http://www.sps-forum.de/phpBB2/viewtopi ... 6a66893842

Das Tool liegt im VB6 Quellcode vor.
(und zwar nur im VB6 Code, keine EXE und so)
Gängige Tools, die es im Netz gibt, können folgendes nicht:
Anzeigen des SPS Programms das auf der karte ist (FC, DB, usw.)
Die gelesene Karte als Simatic Memory File Speichern.(mit Einschränkung)

Download: http://rothenbacher.dyndns.org/download/hdd4.zip


------- Siemens S7 MMC eprom utils -----------
http://members.aon.at/uteetz/
http://personal.telefonica.terra.es/web/suwe

To make a image file of your S7 MMC card place the card in a standard MULTICARD READER (recognized by your Win32 System) and
start the S7imgRD.exe. Select the drive letter of the card from the combo box and hit start.
If your system ask to format the Card – cancel !do not format!
Give a image file name to the save file dialog. Compress the image file and mail it together with the S7imgWR.exe to any place you want or
just keep the image file for later eprom replication in case you do not have access to the project files.
To bring the image file back to a eprom works same way, use the S7imgWR.exe.
I have tested the S7imgRD and S7imgWR with 128kb and 512kb. If you experience any difficulties feel free to send me a bug report.

MMC Images for S7imgWR and WinHex
Russian http://s7detali.narod.ru/MMC/MMC.html

English https://translate.google.ru/translate?s ... edit-text=

2006
http://s7detali.narod.ru/MMC/s7imgrd1.zip
http://s7detali.narod.ru/MMC/s7imgwr1.zip
2014
http://s7detali.narod.ru/MMC/s7imgrd2.zip
http://s7detali.narod.ru/MMC/s7imgwr2.zip
Nuevo / new / neu S7imgRD V2.0 Dec 2014 win7
http://members.aon.at/uteetz/

[CoMod]

http://www.plctalk.net/qanda/showthread.php?t=21591

S7 Mmc
--------------------------------------------------------------------------------
Hi every body,

last two weeks I was working on understanding what are S7-31x MMCs. In the end I collected following information:

64KB-4MB SIEMENS MMC cards are standard 16MB MMCs with special SIEMENS format. Datasheet at http://www.tischer.cz/HB28D032MM2-RENESAS.pdf.

8MB SIEMENS MMCs are the same but 32MB MMCs.

You can make bit copy of these MMCs by using tools at http://personal.telefonica.terra.es/web/suwe in standard MMC/SD card reader. By using this tools you also copy the special SIEMENS format.

But in case you would like to use non SIEMENS 16MB or 32MB MMC, you cant use it in S7 as every MMC has private CID and CSD register where are stored informacion as OEM/APPLICATION ID, PRODUCT NAME, .... . The example of SIEMENS 64KB MMC is at http://www.tischer.cz/64kb.txt. CID is OTP register and first 14 bytes of CSD are programed only by manufacturer. S7 checks and compares stored info. from CID and CSD.

If you have SIEMENS MMC accidentaly formated in standard MMC/SD card reader/writer (for example as FAT format) you can repair it in this standard MMC/SD reader/writer.
1. read original SIEMENS MMC by S7imgrd (the same size as failed card)
2. write this image to failed MMC by S7imgwr

When I was analyzing MMCs I also find out how is the password stored at the MMC.

If you have any question, email me at tischer@atlas.cz

-------- http://www.tischer.cz/64kb.txt ----------------

64kb

Show

Code: Select all

==============================================================================
00:   FFh 01h FFh FFh FFh FFh FFh FFh
00:   FFh FFh FFh FFh FFh FFh FFh FFh
00:   FFh FFh FFh FFh FFh FFh FFh FFh
00:   FFh FFh FFh FFh FFh FFh FFh FFh
01:   FFh 00h FFh FFh FFh FFh FFh FFh
01:   FFh FFh FFh FFh FFh FFh FFh FFh
01:   FFh FFh FFh FFh FFh FFh FFh FFh
01:   FFh FFh FFh FFh FFh FFh FFh FFh
CID:  FFh 00h FEh 06h 00h 02h 41h 06h
CID:  41h 00h 00h 00h 25h 1Dh B9h 0Bh
CID:  20h 38h 87h 8Eh 36h FFh FFh FFh
CID:  FFh FFh FFh FFh FFh FFh FFh FFh
CSD:  FFh 00h FEh 48h 0Eh 01h 2Ah 0Fh
CSD:  F9h 81h E9h F6h D9h 01h E1h 8Ah
CSD:  40h 00h 5Dh BEh 4Fh FFh FFh FFh
CSD:  FFh FFh FFh FFh FFh FFh FFh FFh
----------------------CID STRUCTURE (10)-----------------------
Manufacturer ID           MID         : 06h 
OEM/Application ID        OID         : 00h 02h 
Product name              PNM         : 41h 06h 41h 00h 00h 00h 
Produkt revision          PRV         : 25h 
Product serial number     PNM         : 1Dh B9h 0Bh 20h 
Manufacturing date        MDT         : 38h     (MM/YY=03/05)
7-bit CRC checksum        CRC7 [7:1]  :	43h     (43h)
16-bit CRC checksum       CRC7 [32:1] : 8E36h	(8E36h) 
----------------------CSD STRUCTURE (09)-----------------------
CSD structure             CSD_STR     : `01`
Spec versione             SPEC_VER    : `0010`
Reserved                  00          : `00`
Data read access time 1   TAAC        : 0x0E    (reserved1ms)
Data read access time 2   NSAC        : 0x01
Max. data transfer rate   TRAN_SPD    : 0x2A    (2.0x10 Mbit/s)
Card command classes      CCC         : 0x0FF
Max read data block len   R_BLK_LEN   : 0x9     (512 bytes)
Partial bl read allowed   R_BLK_PAR   : 1       (Enabled)
Write block misalignment  W_BLK_MIS   : 0       (Disabled)
Read block misalignment   R_BLK_MIS   : 0       (Disabled)
DSR implemented           DSR_IMP     : 0       (Disabled)
Reserved                  00          : `00`
Device Size               C_SIZE      : 0x7A7
Max. read current Vdd min VDD_R_C_MIN : 0x06    (60 mA)
Max. read current Vdd max VDD_R_C_MAX : 0x02    (10 mA)
Max. write I at Vdd min   VDD_W_C_MIN : 0x06    (60 mA)
Max. write I at Vdd max   VDD_W_C_MAX : 0x06    (80 mA)
Device size multiplyer    C_SIZE      : 0x04    (64)
Erase group size          ERA_GRP_SI  : 0x00    (00 sectors)
Erase group siz. multip.  ERA_GRP_MU  : 0x05    (128)
Write protect grp. size   WP_GRP_SI   : 0x00	(00 sectors))
Write protect grp. ena.   WP_GRP_E    : 1       (Enabled)
Manufacturer default ECC  DEFAULT_ECC : 0x0  
Write speed factor        R2W_FACTOR  : 0x0     (1x)
Max. wr  data block len   WR_BLK_LEN  : 0x9     (512 bytes)
Partial blk. wr allowed   WR_BLK_PAR  : 0       (Disable)
Reserved                  --          : 0x00    (0x00)
Content prot. app         CO_PRO_ALL  : x0       (Disable)
File format group         F_FORM_GRP  : x0       (RESERVED)
Copy flag (OTP)           COPY        : x0       (ORIGINAL)
Permanent write protect   PE_WR_PRO   : x0       (NOT PROTECTED)
Temporary write protect   TE_WR_PRO   : x0       (NOT PROTECTED)
File format               FILE_FMT    : x0x0     (Reserved)
ECC                       ECC         : x0x0     (2 bits)
7-bit CRC checksum        CRC7 [7:1]  : 0x2Eh   (2Eh)
Not used                  --          : 0x1
16-bit CRC checksum       CRC7 [32:1] : BE4Fh  	(BE4Fh) 

==============================================================================

[MMCist]

WinHex v17.9_SR2
http://s7detali.narod.ru/MMC/WinHex_v17.9_SR2.zip

WinHex

Show

[smsasg]

Сравнительная информация служебных регистров различных карт:
What difference insidr MMC
http://s7detali.narod.ru/MMC/MMC_Card.pdf

[Tischer]

Please read the rest of the topic about MMC. There wrere mistake as S7imgrd dont do true bit copy of MMC needed for reparation S7 MMC. Only WinHex do it.

http://www.plctalk.net/qanda/showthread.php?t=21591

tischer@atlas.cz

[os1361]

dear author
thank you very much for s7imgrd2
very very thank you
its very helpful for me
best regard

[zohair_ssuet]

Dear All,

I have accidently format S7-1500 SMC Card in Windows7. This card has two hidden files "crdinfo.bin" and "__LOG__" previously which has its serial number information matched with the physical serial number labelled on it.

I had another machine 4MB same card and try to make and restore image at this card using s7rd.exe and s7wr.exe utility, but this faulty card remains not working on the s7-1500 CPU. CPU shows "No memory card plugged" that is CPU is not booting up this card. Although the card is reading in USB card reader, its FAT32.

I used WinHEX to check the contents of the working and faulty smc card of s7-1500, there are some more files which are not visible in My Computer. These are " FAT 1, FAT 2, Boot Sector" etc. which will not be overwrite to another faulty card if I I restore image in winhex of correct card. I can't understand this encryption. I saw the SMC serial number is also written in "crdinfo.bin" file. If I change this SMC number in crdinfo.bin as per faulty card (after copy and paste of two hidden files from working card to faulty card), then same problem, CPU 1500 didn't detect such faulty card.

http://www.google.com.pk/imgres?imgurl= ... BsQMygCMAI

Please help someone !!!

[Info]

how-do-you-detect-an-inconsistently-or-incorrectly-formatted-simatic-memory-card-smc-and-how-do-you-repair-it
https://support.industry.siemens.com/cs ... w/69063974

[Seshu Vardhan]

use image file of another mmc card and put into the formatted one

[teamplayer]

Hello!
Can anybody share s7img file for 512kB MMC:

6ES7953-8LJ30-0AA0

Many thanks!

[Akmal]

http://s7detali.narod.ru/MMC/MMC_512_KB ... 0-0AA0.zip

[navidentezari]

Hello
Please help me.
I need S7 imsge file for 16MB MMC.
Can anybody share s7img file for 16MB MMC.
Thanks.

[CoMod]

Can anybody share s7img file for 16MB MMC.

show Order No. Micro Memory Card 16MB 6ES7953-8L??????
https://support.industry.siemens.com/cs ... t/82098000

[navidentezari]

I need S7 imsge file for 16MB MMC.
Can anybody share s7img file for Simotion 16MB MMC.
6AU1700-0AA01-0AA0
Simotion Boot Software Memory Module
Manufacturer(s): Siemens
Model(s) :Siemens SIMOTION

Simotion card

Show

[navidentezari]

Hello
I have a SIMOTION MEMORY CARD 16MB for C230-2.
Order No: 6AU1700-0AA01-0AA0
That formatted with windows.
I need image file from Simotion MMC 16MB for write to This MMC with s7 img writer.
Someone can help me.
Thanks.

[KARAVATI]

HELLO FRIENDS
HOW TO READ S7 IMG FILE IN TIAPORTAL .wld
AND DEFINE HARDWARE
I READ THIS FILE BUT NOT CONFIGURE HARDWARE.
THANKS

[mohdabshr]

Hi all

i have mmc card 64kb for s7 300 i make image but i can not find password i am using unlock_and_converter_mmc_image_s7 v6.01 i need you help

[azhar_ali_429]

Hello!
Can anybody share s7img file for 4 MB MMC?

6ES7953-8LM20-0AA0

[Windoze]

See http://www.sps-forum.de/phpBB2/viewtopi ... 6a66893842

Das Tool liegt im VB6 Quellcode vor.
(und zwar nur im VB6 Code, keine EXE und so)
Gängige Tools, die es im Netz gibt, können folgendes nicht:
Anzeigen des SPS Programms das auf der karte ist (FC, DB, usw.)
Die gelesene Karte als Simatic Memory File Speichern.(mit Einschränkung)

Download: http://rothenbacher.dyndns.org/download/hdd4.zip

Anyone got a Mirror for this Tool?

[patxiu]

I also need the image for s7img file for simotion 16MB MMC (6AU1700-0AA01-0AA0).
My machine has stopped and I think the SD is corrupt (only 5 folders are read but empty).
I already have my USER files, but not the KEYS and SIEMENS folders.
Thanks in advance,

[gladiator]

Hi, I used s7imgrd2.01 to read an 8M MMC fom a regular reader, during reading blocks to img file, it found two passwords but when I open the MMC from Field PG slot, both passwords is incorrect when I try to copy blocks to wld file. Can you find the correct password for me? Thanks so much!

Please open the file below:
https://drive.google.com/file/d/1L9i2R8 ... sp=sharing

[aziz]

Hi
How did you find the password for the blocks, help me please!

[fran72hk]

Hello everyone, please someone can share the image winhex or s7img of the card 6ES7953-8LG11-0AA0 of 128kb

Thanks

[CoMod]

Hello everyone, please someone can share the image winhex or s7img of the card 6ES7953-8LG11-0AA0 of 128kb

https://s7detali.narod.ru/MMC/MMC.html

128 KB 6ES7953-8LG11-0AA0_MMC_128KB.ZIP real size 16 MB