TN - Password Search for C-Series PLC

Modified on Fri, 31 Jan at 10:13 AM

Password search for C200H(S)/Alpha/CQM1(H)/CV/CS1/CPM1(A)/CPM2* How can we investigate password for the user who forgot password and send the file to our office?

Description

How to see the pasword:

1) C seires/CS1 series : 94303 SHIFT CLR SHIFT MON <Address> Down arrow key

2) C1000H/C2000H: 9430 SHIFT CLR SHIFT MON <Address> Down arrow key

3) CV series : 94303 SHIFT 5 SHIFT MON <Address> Down arrow key

Start address of password

C200H	$4988-$4989
C200HS and Alpha	$A06BE shows start address. ex) $A06BE and F = 06 C0, See address=A06C0 Partial protect code locates at $F8290 and 1.
CQM1(H)	$586C8 and $586C9
CS1(-V1) or CJ	$0080 0098 : Whole protect (Ascii coded 8 bytes) $0080 00A0 : Partial protect (Ascii coded 8 bytes) (CF card : Offset+$C8 : Ascii coded 8 bytes)
CS1-H, CJ1-H, CJ1M, CS1D	$0800 0098 : Whole protect (Ascii coded 8 bytes) $0800 00A0 : Partial protect (Ascii coded 8 bytes) (CF card : Offset+$C8 : Ascii coded 8 bytes)
CV	Choose MPU 1. See $000EE2. ex) Total protect = 12345678, Partial protect = 23456789 ProCon shows: 1234 5678 2345 6789 0000 0000 0000 0000

Please NOT disclose to the users, if so, this protect function is not valid any more in market.

Ex) CQM1: [FUN(49) 000 000 #1234]

586C8 : 12

586C9 : 34

CPM2A/CPM2C:

UM starts when Comment area is 2KW from $FFAD58.(Default) (UM start from $FF9D58.)

Comment area	2KW	3KW	4KW	5KW
Start address contains at $FF9D56 shows	$16C0	$1EC6	$26C0	$2EC6
UM start from	$FFAD58	$FFB55E	$FFBD58	$FFC55E
Passowrd loactes at	$FFAD60	$FFB560	$FFBD60	$FFC560

Confirmation: Comment area = 2KB

@00MB0C080000FFAD6002

@00MB00840200,123469*

CPM1(A)

UM starts when Comment area is 0KW from $F92C0.(Default)

Password locates at : $F92C8

Comment area	0KW	1KW	2KW
Start address contains at $F92BE shows	$06C0	$0EC0	$16C0
UM start from	$F92C0	$F9AC0	$FA2C0
Passowrd loactes at	$F92C8	$F9AC8	$FA2C8

Confirmation: Comment area = 2KB

@00MB0C0800000FA2C802

@00MB00840200,123469*

My test reading Password by General read command:

CJ1M-CPU23 V3 and CPU12, CPU23 Non V2.

Whole passwords = #87654321, Partial password=12345678

Mutiway reports

1) Whole password read ( 8 bytes read from 0800 0098)

<-------:@00FA080000200000000000023200100000800009800087E*<CR>
------->:@00FA00C00002000000000000232001000038373635343332313C*<CR>
Asc->:___ﾀ________#____87654321<

2) Partial password read ( 8 bytes read from 0800 00A0)

<-------:@00FA08000020000000000002420010000080000A0000809*<CR>
------->:@00FA00C00002000000000000242001000031323334353637383B*<CR>
Asc->:___ﾀ________$____12345678;

Test with C200HG-CPU66

Whole protect password is 1234.

1) Read address at A06BE

<----:@00MB0C0800000A06BE0246*<CR>
---->:@00MB00840200,06C018*<CR>

2) Read password at A06C8

<----:@00MB0C0800000A06C8023A*<CR>
---->:@00MB00840200,123469*<CR>

Partial protect password is 1234.

Read password at A06CE

<----:@00MB0C0800000A06CE0247*<CR>
---->:@00MB00840200,123469*<CR>

Test with C200PC-ISA01-DRM (C200HX-CPU64)

Whole Protect
<----:25010C0800000A06C802
---->:25010000008402001234

Partial Protect
<----:25010C0800000A06CE02
---->:25010000008402001234

Test with CQM1H-CPU51

Whole protect password is 1234.

Read address at 586C8

<--:@00MB0C0800000586C80246*<CR>
-->:@00MB00840200,123469*<CR>

Partial protect password is 1234.

Read password at 586CE

<--:@00MB0C0800000586CE023B*<CR>
-->:@00MB00840200,567861*<CR>

Test with CQM1-CPU21

Whole protect password is 1234.

Read address at 586C8

<--:@00MB0C0800000586C80246*<CR>
-->:@00MB00840200,123469*<CR>

Partial protect password is 1234.

Read password at 586CE

<--:@00MB0C0800000586CE023B*<CR>
-->:@00MB00840200,567861*<CR>

Date/Revision History

First review 31/01/2025 V1.0

Author:

Jean Gervais, Technical Support Engineer