Tips & Tricks

Siemens PLC S7200 all four-level & three-level password unlock decryption software with disassembly decryption kit

June 18, 2020

3042

If the question can be solved, first disassemble the PLC to see if it is a compatible machine PLC. The compatible machine cannot be solved. No matter what version of the genuine 200 CN OR Original Germany series, disassemble and compare the CPU pictures introduced below to see details Introduction

Package-1 including: USB programmer + card holder + tweezers + plastic tool box + 3 chips + USB drive mail box (excluding decryption software)

Package-2 including: USB programmer + card holder + tweezers + plastic tool box + 3 chips + a full set of decryption software (excluding technical support, please research and decrypt on delivery)

Package-3 including: USB programmer + card holder + tweezers + plastic tool box + 3 chips + a full set of decryption software (four-level replacement system block decryption method) (including technical support, any problems encountered in decryption One by one guidance)

Package-4 including USB programmer + cardholder + tweezers + plastic toolbox + 3 chips + a full set of encryption software (including the data of the previous 3 packages + the fourth level is to modify the verification code decryption method) (including Technical support, guidance for any problems encountered in decryption), applicable system: XP WIN7 32 WIN7 64, this package has a registration code, restrict the use of a computer, send the machine code to obtain the registration code & pay attention.

Level 3 and level 4 must be disassembled EEPROM

As the long as it is the third generation of the original 200 or 200CN series, the model has a 3 character,

CPU222CN DC 6ES7 212-1BB23-0XB8
CPU 222 AC 6ES7 212-1BB23-0XB0
CPU 224 CN DC 6ES7 214-1AD23-0XB8
CPU 224 DC 6ES7 214-1AD23-0XB0
CPU 224 CN AC 6ES7 214-1BD23-0XB8
CPU 224 AC 6ES7 214-1BD23-0XB0
CPU 224XP CN DC 6ES7 214-2AD23-0XB8
CPU 224XP DC 6ES7 214-2AD23-0XB0
CPU 224XP CN AC 6ES7 214-2BD23-0XB8
CPU 224XP AC 6ES7 214-2BD23-0XB0
CPU 226 CN DC 6ES7 216-2AD23-0XB8
CPU 226 DC 6ES7 216-2AD23-0XB0
CPU 226 CN AC 6ES7 216-2BD23-0XB8
CPU 226 AC 6ES7 216-2BD23-0XB0

This set of software is for disassembly and decryption. It can crack the passwords of all Siemens S7-200 PLCs (imported, domestic CN models) sold on the market so far. The models include (212, 214, 216, 222, 22CN, 224, 224CN, 224XP, 224XP CN, 226, 226CN, 226XM) easily crack the Level 3 and POU passwords. It is by far the most advanced and truly practical decryption method, directly reading the EEPROM chip of the PLC to obtain the password.

One Step: USB programming driver (same as programming cable driver) – first install. The driver is in the S7-200 chip data reading and writing software \USB port programmer driver \SETUP.EXE folder. Double-click SETUP.EXE to install the programmer driver first. After installation, insert the USB programmer. If you click SETUP. Please purchase from plc-unlock.com If the EXE cannot be installed, install it in the device manager, plug in the USB reader, the computer finds the new device, and you can manually find the location of the driver file. Or download the driver wizard to install it automatically.

Two-Step: to bring your own tools 2 parts, the first thing is electric iron or a hot air gun, the second thing is forceps. (For data security, it is recommended to use a hot air gun to prevent a short circuit in Lynx).

Three Step: Practice operating reading and writing tools, distributed 3 ICs: 24C64 for 222, 24C256 for 224 224XP, 24C512 for 226 Select the relevant model, click to read, and deliver the blank IC, read out to F, and rewrite the content randomly, 0 1 2 3 to F, point to write, after proofreading, if they are consistent, the writing is successful. Pay special attention that this is the IC that is delivered can be written casually, and the IC removed from the board must not be written, otherwise, the PLC will be scrapped.

Four Step: The following is the decryption operation. Before disassembling and decrypting, please use Siemens S7-200 decryption 2013 version to read the PLC, check the encryption level of the PLC and backup the memory retained by the power failure, this memory is stored in the RAM Six-Step: First look at the “24CXX disassembly chip map” in this software decryption package. At this time, you open the cover according to the installation instructions of Siemens PLC, remove the CPU board, find the 24CXX chip, and remove it with an electric soldering iron or air gun EEPROM chip comes. (Note: CPU221CN, CPU222 CN EEPROM chip is 24C64, CPU224 CN, CPU224XP CN EEPROM chip is 24C256, CPU226 CN, CPU226XP CN EEPROM chip is 24C512, recently Siemens company adopted 4256BWP (24C256) chip also supported, other types of PLC You can decrypt without disassembly)

Seven Step: The next step is to start reading the EEPROM chip. See the figure below. The digital mark of the EEPROM chip pin should be inserted into the same digital mark on the programmer. In fact, the chip cannot be directly inserted into the programmer because of the EEPROM. The chip is a patch, the chip is too small, so an 8-pin chip adapter is attached, and the EEPROM chip is placed directly on the chip adapter.

The reader of this shop has a protection function. If the LED light does not light up after the IC is inserted into the computer, please remove the USB immediately and put the IC back again. If other ICs are plugged into the computer and the IC is burned out immediately, it will make you too late to unplug the USB.

Eight Step: Now you can open the “S7-200 chip data reading and writing software” in the EEPROM chip programmer folder in the software package, and follow the step-by-step operation according to the operation steps of the EEPROM chip Chinese programmer tutorial! “You have to choose the size and model of the chip correctly, otherwise the read file is wrong and the decryption will fail. The specific size depends on the chip’s logo, and you can’t click the wrong write button. After reading the data, please click Save as Keep the BIN file properly to prevent any accidents. You can read the device multiple times and save the BIN file several times.

Nine Step: S7-200CN (new version PLC) decryption is divided into 3 levels of decryption and 4 levels of decryption: Level 3 password cracking is relatively simple. After the chip reads the data and saves it as a BIN file, you can directly run the ” Level 3 decryption software can display the password directly after reading the BIN file.

Ten Step: The new version of S7-200plc has newly added level 4 protection, which prohibits reading and writing, regardless of whether you know the password or not. None of the programs in the PLC can be uploaded. Cracking this encrypted PLC does have some difficulty. Our idea of cracking level 4 passwords is that everyone knows that Siemens programs are divided into program blocks, data blocks, and system blocks. The passwords are stored in the system blocks and stored separately in BIN files.

However, you cannot upload the program after reading the password at level 4, so you must change level 4 to level 3 or lower, but if you only modify the password protection level, it involves a problem with the check code of the block. The error check can also not upload the program or the upload is a blank program, and the PLC fault lamp reports an error. Can we replace the entire unknown level 4 encryption system block with the known level 3 encryption entire system block, and the program block and data block will not move? In this way, we can crack the encryption protection of level 4 of S7-200CN plc. This is the easiest and easiest way to crack the 4-level protection.

The new BIN file saved after decryption by the intelligent four-level decryption software is a level 1 encryption program, which can be uploaded directly

After this step to save the new BIN file, use the S7-200 chip data reading and writing software to write the new BIN file to the chip. Then use a hot air gun or an electric soldering iron to solder, install and power on, then the PLC can upload the program.
So far. S7-200CN (new version PLC) level 4 encryption has been successfully cracked. In addition, the software for cracking project passwords, non-disassembly decryption software for PLCs.Below version 2.0, and some classic applications are also presented.

Need to know before buying: Many friends respond that the decryption software has a virus (misreported as a virus by the antivirus software). I declare that all decryption software and registration machines will be characterized by antivirus software as viruses and Trojans ( if you care about antivirus Please do not shoot false positives of the software,), so some users are afraid to use the computer because they are afraid of computer poisoning. When you receive the decryption software, if you are very concerned about the anti-virus software’s reporting behavior, please do not use it and delete it immediately to avoid harm to your computer. If you apply for a refund, for this reason, we refuse to refund!! (Because the software can be copied, some unqualified people copy the software and use the virus as an excuse to apply for a refund)

I finally solemnly declare: this set of decryption software is absolutely virus-free, please rest assured to use. If need any help please contact 8801712506181

UrbanObserver