Is it possible to unpassword codesys project?

[eftm8904]

Is it possible to unpassword codesys project (user group level 0-1 passwords)?
If yes, then how?

[eftm8904]

It was easy to unpassword groups. It took less than hour (If you going to do this manually)

Equal rojects with different passwords have field difference in 3 zones:
1) at address 162h 163h there is different signaturres that depends of some file parameters
2) at the end of file there is 4 bytes (apparently CRC\checksum)
3) at the tail of file there is group password fields in the structure like this:

- find label in text mode (this could be in Deutch or other language): Variable_Configuration
- then after label find in hex mode FF FF FF FF field
- after this folow fields with [lengthes+1] of group passwords (in my example 0B=11, so length 10 symbols)
- then find mark 01h after this follows encripted password
- there could be more passwords for other groups, they separated by 00h, 01h, 02h...
- end of password field markes with signature [cd cd cd cd cd cd cd cd]h

CoDeSys+ file v.2.3.9.25 example:

Show

Code: Select all

56 61 72 69 61 62 6c 65 5f 43 6f 6e 66 69 67 75
72 61 74 69 6f 6e 00 00 09 00 00 00 ff ff ff ff
00 00 0b 00 00 00 01 94 97 96 91 90 93 92 9d 9c
95 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 08
00 00 00 00 00 00 cd cd cd cd cd cd cd cd

How to decript: password encripted with symbol table. Every encripted byte matches always the same ASCII charbyte. Just create project and save it with differet passwords to see, what code mathes to what char.

Here you some chars from symboltable:

Show

Code: Select all

"1" - 94h
"2" - 97h
"3" - 96h
"4" - 91h
"5" - 90h
"6" - 93h
"7" - 92h
"8" - 9Dh
"9" - 9Ch
"0" - 95h
"a" - E4h
"s" - F6h
"d" - E1h
"f" - E3h
"g" - E2h
"h" - EDh
"j" - EFh
"k" - EEh
"l" - E9h
"q" - F4h
"w" - F2h
"e" - E0h
"r" - F7h
"t" - F1h
"y" - FCh
"u" - F0h
"i" - ECh
"o" - EAh
"p" - F5h
"z" - FFh
"x" - FDh
"c" - E6h
"v" - F3h
"b" - E7h
"n" - EBh
"m" - E8h

[la-ma]

Thanks, your method realy help me.
i have no need to crack my project. Only find what's wrong with machine it can't start.
So now it is possible to analise any condition at machine.

[sergiotherock]

Additional caracters

Show

Code: Select all

"°"-15h
"!"-84h
" " "-87h
"#"-86h
"$"-81h
"%"-80h
"&"-83h
"/"-8Ah
"("-8Dh
")"-8Ch
"="-98h
"?"-9Ah
"¡"-04h
"*"-8Fh
"¨"-0Dh
"["-FEh
"]"-F8h
"_"-FAh
":"-9Fh
";"-9Eh
"¿"-1Ah
" ' "-82h

[eftm8904]

basically it's XOR operation with simmetric byte A5h.
[encrypted ASCII byte] = [ASCII byte] XOR A5h.

[AjaySahu]

Hello EveryOne!!

I Could not Understand the procedure ....Please Explain i need same to unpassword my project