Skip to Content

SiePortal

The integrated platform for your product selection, buying and support workflow - bringing together Industry Mall and Online Support.

SiePortalDeutsch

Search

Home
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menu temporary not available
- Menue temporary not available
- {{item.title}}

Products & Services
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
MySiePortal MySiePortal
{{(apiData.MySiePortal | filter:{'rank':1}:true)[0].title}} MySiePortal
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Cart ({{apiData.CartCount}})

Navigation

Check FB/FC code at runtime?

Created by: krushia at: 8/31/2006 7:28 AM (26 Replies)

Rating (13)

Thanks 1

Result pages:: |; 1 | 2; |

27 Entries

Entries per page: 10 | 20 | all

9/11/2006 9:44 PM	Rate (2)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/21/2025 Posts: 550 Rating: (107)	I have not seen any MC5 opcode list from Siemenssince S5. But S5 is a good start since S7 opcodesare based on S5. Block format is as well similar to S5 (start header 0x70 0x70 etc) Without getting into stuffy STEP7 (dbase) database formats the easy way to start is using OPC S7 &blockread () / &blockwrite(). Open the block with a binary editor. First 0x24 bytesmakes theblock header (attributes, time stamps, language, block type, number etc). MC5STLstarts at offset 0x24 and ends with 0x65 00(Block End BE). Last part is block param. and block info (author, family, name, version etc).In this example BLD 7 opcode is 0x10 0x07; BLD 8 is 0x10 0x08. To unprotect the function modify BLD 7 with NOP 0 (0x00 0x00). Write back the block with OPC S7&writeblock() and open with STEP7.The reducedCALL goes away and you will see the underlying MC5 STL code. Good look.
	Last edited by: Dec at: 9/11/2006 11:54 PM Last edited by: Dec at: 9/11/2006 11:50 PM
Suggestion To thank Quote Answer

9/12/2006 8:49 AM	Rate (0)
Remark Bronze Member Joined: 9/1/2006 Last visit: 8/21/2025 Posts: 193 Rating: (13)	Hi Dec, I will look at the OPC way.. that might speedthings with (investigating mnemonics). TheDelphi program i made to investigate your 'trick' can already find the codes... Last night i found out aboutreplacing then BLD 7 by a NOP 0 is enough to unhide code... Now i want to figure out all the opcodes so i can disassemble and later on use it to assemble a S7-blockmyself. Finally i want to create a tool program which creates S7-blocks from text-macro's without using 'source code' files. I already madea tool-program to easily set/reset knowhow protection, this will be a nice extra featurefor useonour library files. Thanks again for sharing info....was a nicepuzzle [:)] regards, Remark
	Last edited by: Remark at: 9/12/2006 9:25 AM Last edited by: Remark at: 9/12/2006 9:21 AM
Suggestion To thank Quote Answer

9/14/2006 1:20 PM	Rate (0)
Ates Posts: 198 Rating: (19)	very nice trick but i couldnt understand how it will protect your code ? other users can comment it out the line cant they ?
Ates Posts: 198 Rating: (19)
Suggestion To thank Quote Answer

9/14/2006 1:52 PM	Rate (0)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/21/2025 Posts: 550 Rating: (107)	They can't unless you supply the AWL STL source code so they can recompile it. Dec

Suggestion To thank Quote Answer

2/26/2007 8:49 PM	Rate (0)
Marcio R. Santos Silver Member Joined: 12/5/2005 Last visit: 9/4/2025 Posts: 239 Rating: (9)	Dec, In which planet you find those information???????. Man, exist only 3 threads"about" MC5 code in the forum, and all is yours...I talked with peoples in my company, and all guys of S5 age(not my case) used the instructions of MC5 to block/unblock programs bursting the length of network. Well, I don't know what to do to create a checksum of program, but to block/unblock the programyou can make this modifying the file in ..\ombstx\offline\IDOFS7PROGRAM\SUBBLK.DBF. I remember, that in 2002, the instructor of my S7-Basic course, said "It's impossible to open a block with a KNOW_HOW_PROTECT", and in the final of day, I had already opened a block with a Hexadecimal Editor. And today, I prefer made this with MS-ACCESS, a drink to old DBASE. Jokingwith this file, I saw that is possible to change the language that the block has been created, and in my tests, once time, in the S7 lang field, appeared something as "Assembly" (I don't remember if was DB Assembler, or something like that)! I was surprised. I don't know that existed this language in S7, then mycoin downed...
	Márcio Santos www.marcioroberto.wordpress.com
Suggestion To thank Quote Answer

2/28/2007 3:12 PM	Rate (0)
Ates Posts: 198 Rating: (19)	actually yeah mc5 codes, bld functions.. but there are many other s7 programs liks ibh , pg2000 how can they know it? is there an engineer who worked in developping of step7 and now selling secret information for money ? :) is he dec ? :)
Ates Posts: 198 Rating: (19)
Suggestion To thank Quote Answer

2/28/2007 6:29 PM	Rate (1)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/21/2025 Posts: 550 Rating: (107)	Ates ... is there an engineer who worked in developping of step7 and now selling secret information for money ? :) is he dec ? :) Lol, I never worked for Siemens and I don't have any secret information(to share) and I don't sell any information to anybody. All I know is from personal research (over 10 years) including complete S7-Protocol implementationon MPI/PB IE, MC5(7) instruction list down to PLC(S7-300) FW intimate functionality. As far as Industrial Software & HMImy knowledge are based on my PC programming skills (Assembler, C/C++ etc). I am glad to share all I know with any users interested in implementing Siemens Automation products. Just ask and if I know I share. Dec PS There are many companies that know how to communicate to S7-PLCs (S7-Protocol) and for example VIPA makes”Like S7-300" PLCs. How do you think these guys know this information? To figure out a "Proprietary protocol" like S7you need a goodbus analyzer and some helper software (S7-API) and in 2-monts you are up and running. To figure out the intimate PLC functionality (S7-300 old style not MMC) you need a good C165 Emulator andlots ofcoffee and cigarettes and you have all approximately 1M (~3k functions) of firmware documented. If you want to know the guys name (Credits)of the PLC-300 Team read SZL 0x1FE index 0x4344 and make sure you have enoughroom for DR (make 1k bytes charDB). The hardest part is to figure out the legal aspects of your commercial business after you go on the market because you don't expect that Siemens will congratulate you for your work
	Last edited by: Dec at: 01.03.2007 00:23 Last edited by: Dec at: 28.02.2007 18:50
Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users hosein8419

|

Share this page:

Share this page on...

Follow us on