I am of the opinion that without the password you cannot even read or see the program without having the original on disk. It is a total lock-out without the password. I have not password protected in a long while but I seem to remember it was an 8 No. Password using hex No's 0 to F. Agilent 54825a Service Manual here. I have found passwords written on the back of the PLC (you have to turn it around in the panel) and even tried the machine serial No.

With limited success. The person that password protected the plc either uses the same password each time or writes it down somewhere so that he does not forget it. There is always a way, if you have patience. This page may give you some guidance, Thanks for that navillusi, am very interested in that. I have downloaded the packet sniffer program and have brought some mitsi plcs home to practice on. I have a customer with an A series plc that is password protected it has 192 I/O.

We have no way of getting in without a re-write and he doesnt want to pay for that. I will keep you posted as to how I get on.

Somewhere, I have the program and documents from that site. (I shall try to find them) I did what you are proposing to do and it does work. I set up a known password and looked for it with the packet sniffer. (on both an FX and A series - as passwords are handled differently on these 2 models) Then, (and it was a little scary) I got my assistant to 1st write down, then very carefully password them with one unknown to me. I found them both (the A being much harder) and unlocked them. I actually needed to unlock a real PLC and then managed to do it. The only trouble is - the packet sniffer program only works in win 98.

I personnaly use a freeware called Portmon version 3.2 It very easy to crak a Mitsu PLC. You can find the warez at PORTMON V 3.2 for all the MS flavors. For those willing to try her what you do. Start your PLC programming ware Start Portmon. Once this is done. Try to upload the PLC program to your PC You will be asked for a password Write 00000000 in the password field Start the CAPTURE function of Portmon Click to accept password You will receive a message that its not the good password END the CAPTURE function of Portmon Now check your Portmon screen and look for a serie of 8 time the value of ZERO.

The real password is sitting right beside it. All this is in HEX of course. Edited 14 Jan 2005 by Pierre.

The supply of PLC password cracking software The supply of PLC password cracking software,. 1 EH2 ES2 SV password password cracking, Delta EH2, Delta.