try this
System Software for S7-300/400 System and Standard Functions
Chapter 31.7 SSL-ID W#16#xy13 - Memory Areas

To read from this list you will need SFC51

2Pegaia,
>1 - Use a Knowhowprotection technology. (maybe you will say that some hackers can krack it, but if they willdo that, certainly they will kracka check summ protection).

Not quite right. I would say that searching in other's STL code for a particular part can be harder (especially if it's written in SCL).

Aret,

I think you are missing the point of my example.

Function FC1 does a simple calculation c = a + b.

1. Calculation code is hidden; all you see is CALL STP (SFC46) that by the way is never executed in the normal circumstances.

2. If you tamper with the code, then SFC46 will get executed and will tripe the CPU.

People usually protect the code for various reasons like intellectual property, liability etc.

My example FC1 guaranties that it will execute correctly only if is not altered.

Checking CPU available memory size prevents additions to the main program and require constant modifying the protection code.

Dec

Nobody figure out yet how FC1 works? Come on, there are no gimmicks, pure STL programming I swear.

Dec

Hi,
The protection is based on ussing CALL pseudo instruction:
CALL is based on native MC5 trio instructions:
BLD 7
...
UC x
...
BLD 8

Usually what is in between BLD-UC-BLD has to do with passing in/outthe parameters to function.
I exploit this "reduce" to CALL pseudo instruction to insert my hidden code and put BEU before the actual fatigue UC SFC46.

FC 1 STL source code (AWL) is as follow:

FUNCTION FC 1 : VOID
VERSION : 0.1

VAR_INPUT
a : INT ;
b : INT ;
END_VAR
VAR_OUTPUT
c : INT ;
END_VAR
BEGIN
NETWORK
TITLE =

BLD 7;
L #a;
L #b;
+I ;
T #c;
BEU ;
UC SFC 46;
BLD 8;
END_FUNCTION

The LAD/STL editor when saves / downloads the FC1, checks the “CALL” format and detects additional code and “it fixes” in its infinite wisdom.
So your hidden code goes away and UC SFC 46 gets executed.

Here is another example FC1 that wraps SFC 24 (TEST_DB). Make sure TEST_DB is in the Symbol Table & Block Folder offlinebefore compile STL source AWL

FUNCTION FC 1 : INT
TITLE =
VERSION : 0.1

VAR_INPUT
DB_NUMBER : WORD ;
END_VAR
VAR_OUTPUT
DB_LENGTH : WORD ;
WRITE_PROT : BOOL ;
END_VAR
BEGIN
NETWORK
TITLE =

BLD 7;
= L 0.0;
L #DB_NUMBER;
T LW 1;
UC "TEST_DB" {
P#L 1.0,
P#L 3.0,
P#L 5.0,
P#L 0.1};
L LW 3;
T #RET_VAL;
L LW 5;
T #DB_LENGTH;
A L 0.1;
= #WRITE_PROT;
BLD 8;
END_FUNCTION


Dec

I have not seen any MC5 opcode list from Siemenssince S5. But S5 is a good start since S7 opcodesare based on S5. Block format is as well similar to S5 (start header 0x70 0x70 etc)
Without getting into stuffy STEP7 (dbase) database formats the easy way to start is using OPC S7 &blockread () / &blockwrite(). Open the block with a binary editor. First 0x24 bytesmakes theblock header (attributes, time stamps, language, block type, number etc). MC5STLstarts at offset 0x24 and ends with 0x65 00(Block End BE). Last part is block param. and block info (author, family, name, version etc).In this example BLD 7 opcode is 0x10 0x07; BLD 8 is 0x10 0x08. To unprotect the function modify BLD 7 with NOP 0 (0x00 0x00). Write back the block with OPC S7&writeblock() and open with STEP7.The reducedCALL goes away and you will see the underlying MC5 STL code.