Is it possible to unpassword codesys project?

[eftm8904]

Is it possible to unpassword codesys project (user group level 0-1 passwords)?
If yes, then how?

[eftm8904]

It was easy to unpassword groups. It took less than hour (If you going to do this manually)

Equal rojects with different passwords have field difference in 3 zones:
1) at address 162h 163h there is different signaturres that depends of some file parameters
2) at the end of file there is 4 bytes (apparently CRC\checksum)
3) at the tail of file there is group password fields in the structure like this:

- find label in text mode (this could be in Deutch or other language): Variable_Configuration
- then after label find in hex mode FF FF FF FF field
- after this folow fields with [lengthes+1] of group passwords (in my example 0B=11, so length 10 symbols)
- then find mark 01h after this follows encripted password
- there could be more passwords for other groups, they separated by 00h, 01h, 02h...
- end of password field markes with signature [cd cd cd cd cd cd cd cd]h

CoDeSys+ file v.2.3.9.25 example:

Show

Code: Select all

56 61 72 69 61 62 6c 65 5f 43 6f 6e 66 69 67 75
72 61 74 69 6f 6e 00 00 09 00 00 00 ff ff ff ff
00 00 0b 00 00 00 01 94 97 96 91 90 93 92 9d 9c
95 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 08
00 00 00 00 00 00 cd cd cd cd cd cd cd cd

How to decript: password encripted with symbol table. Every encripted byte matches always the same ASCII charbyte. Just create project and save it with differet passwords to see, what code mathes to what char.

Here you some chars from symboltable:

Show

Code: Select all

"1" - 94h
"2" - 97h
"3" - 96h
"4" - 91h
"5" - 90h
"6" - 93h
"7" - 92h
"8" - 9Dh
"9" - 9Ch
"0" - 95h
"a" - E4h
"s" - F6h
"d" - E1h
"f" - E3h
"g" - E2h
"h" - EDh
"j" - EFh
"k" - EEh
"l" - E9h
"q" - F4h
"w" - F2h
"e" - E0h
"r" - F7h
"t" - F1h
"y" - FCh
"u" - F0h
"i" - ECh
"o" - EAh
"p" - F5h
"z" - FFh
"x" - FDh
"c" - E6h
"v" - F3h
"b" - E7h
"n" - EBh
"m" - E8h

[la-ma]

Thanks, your method realy help me.
i have no need to crack my project. Only find what's wrong with machine it can't start.
So now it is possible to analise any condition at machine.

[raq1024]

Hello,

I have quite a few codesys libraries from Bosch I would like to unpassword
I managed to open some of them with Beckhoff keygen V2.4 but

most of them are giving me an error like this:

Show

I have also noticed that some of the libraries have different password windows than…

Show

Beckhoff Keygen V2.4 managed to solve some of the passwords for both "types" of the libraries though...

Does anyone know if there is any other/better way than Beckhoff keygen V2.4 to try and open the passwords ?

Here's the link to all the libraries:
https://easyupload.io/55hdpy

I hope someone could help with thie

[Linkinx128]

I am trying to help but the website shows "Error 1020"....
Please upload again

[raq1024]

Thank you for trying to help, here'a another link to google drive this time:
https://drive.google.com/open?id=1w6Y8R ... DzXnAFHhUj

[Linkinx128]

I see. Each file has different password and it around 50 files inside. it will be hell of work to get it done.
Which one you need most?

[raq1024]

Oh I didn't know it would be so much work - to decrypt them all 1 by 1 - that's why I uploaded all

I am mostly interested in those:

Code: Select all

AtmoProjectFile.lib
AtmoProjectBase.lib
AtmoStationV3.lib

[Linkinx128]

Done! See PM

[raq1024]

it worked, thank you!

[sergiotherock]

Additional caracters

Show

Code: Select all

"°"-15h
"!"-84h
" " "-87h
"#"-86h
"$"-81h
"%"-80h
"&"-83h
"/"-8Ah
"("-8Dh
")"-8Ch
"="-98h
"?"-9Ah
"¡"-04h
"*"-8Fh
"¨"-0Dh
"["-FEh
"]"-F8h
"_"-FAh
":"-9Fh
";"-9Eh
"¿"-1Ah
" ' "-82h

[eftm8904]

basically it's XOR operation with simmetric byte A5h.
[encrypted ASCII byte] = [ASCII byte] XOR A5h.

[cmuch]

Hello,
Does anyone know if there is any other/better way than Beckhoff keygen V2.4 to try and open the passwords ?

https://drive.google.com/open?id=1_ldZk ... geadASxowk

Thanks.

[arche]

Hi,
BOSCHDE
no tools, handmade.

[cdps]

Someone can open this 2?
https://we.tl/t-1esdooJhzY

Thank you!!

[ppp]

Someone can open this 2?
https://we.tl/t-1esdooJhzY

Thank you!!

Code: Select all

AtmoMaths.Lib	BBA0D1A9-A204-494E-98E3-C5A51843E898
AtmoMathsV2.Lib	95533A2F-D294-4F28-B7D2-8AAE76976502

[cdps]

Owww.... thanks!!! Could you give more information how you did ? Not need a step by step.. just a path... thanks again

[quangdai]

https://we.tl/t-qH0OUuxBx0

Hi all, Can u check password of this project, please?
Thank you so much

[AjaySahu]

Hello EveryOne!!

I Could not Understand the procedure ....Please Explain i need same to unpassword my project

[ciwa]

hello, could you find the password for this library??

https://drive.google.com/file/d/1jOEbFO ... sp=sharing

[Martinlehner]

1. Localizar a Área Relevante no Arquivo do Projeto

Abra o arquivo do projeto no editor hexadecimal (como o HxD, que é uma ferramenta gratuita e robusta para edição hexadecimal).
Procure pelo rótulo "Variable_Configuration" dentro do arquivo. Este rótulo pode estar em diferentes idiomas, então preste atenção a variações ou traduções possíveis.
Após encontrar o rótulo, busque pelo campo hexadecimal FF FF FF FF. Este é um marcador que indica o início das informações da senha.
2. Identificar e Analisar os Campos de Senha

Logo após FF FF FF FF, procure pelos campos que definem o comprimento e o conteúdo das senhas de grupo. No exemplo dado, o comprimento era 0B=11, o que indica que a senha tem 10 caracteres.
Anote a localização do marcador 01h, que precede diretamente a senha criptografada.
3. Decodificar a Senha

Cada byte da senha é criptografado usando uma operação XOR com o byte simétrico A5h. Para decodificar cada byte:
Use a operação XOR do byte criptografado com A5h para reverter para o byte original da senha em ASCII.
Por exemplo, se um byte criptografado é E3, a operação seria E3 XOR A5 = 46, que deve ser convertido para o caractere ASCII correspondente.
Repita para todos os bytes da senha criptografada.
4. Verificar Mais Senhas

Se o arquivo contiver várias senhas para diferentes grupos, elas podem estar separadas por 00h, 01h, 02h, etc. Continue a análise até encontrar a assinatura final [cd cd cd cd cd cd cd cd]h que marca o fim dos campos de senha.
5. Testar a Senha no Projeto

Após decodificar, teste a senha no seu projeto CODESYS para verificar se o acesso está correto.

[Woodman]

Hello, it would be possible to open encrypted codesys project?
project asks key when opened, not password.