Demonstrating PLC decryption with Mitsubishi FX3U PLC as an example

If you're involved in automation and industrial control, have you ever faced these challenges?

1. The PLC on your machine is damaged, and you need to replace it with a new one. However, the program is password-protected and can't be read.

2. You need to perform maintenance or upgrade your equipment, but the PLC is encrypted and has no available program. It's impossible to modify or understand its logic.

3. You want to understand how the equipment works, study its process, and learn the PLC program to improve your technical skills.

4. The manufacturer’s PLC is tightly sealed, and they refuse to provide support for various reasons.

5. The touch screen needs parameter adjustments during use, or it's broken and can't function properly. The touch screen program must be uploaded, but it's set to prevent uploads.

If you’ve encountered any of these issues, this article might be exactly what you need.

While some may see this as “piracy,” we should always respect the intellectual property and labor of others. The goal of this process is not to steal or break laws, but to create value, solve real problems, and maintain operations when necessary.

Many times, old equipment breaks down, and manufacturers are unreachable or no longer in business. In such situations, having access to PLC decryption tools can be a lifesaver. Let’s take the Mitsubishi FX3U PLC as an example to walk through the process of decoding.

Step 1:

Turn off the PLC power and open the cover above the unit. You’ll see a rectangular port. Count from the left, the ninth pin is the target. Use thin tweezers or wires to short the top and bottom pins of the ninth position.

Step 2:

Power on the PLC again. The alarm light will flash. Remove the shorted wire without turning off the power. Open the decryption software, select the communication port, and click “decrypt” to read the first password. Write it down and close the software.

Step 3:

Connect the PLC via a data cable. Open the dedicated decryption tool, read the password (only one), note the case, and then close the software.

Step 4:

Open the programming software and communicate with the PLC. When prompted for a password, enter the first one. You won’t need the second. Click OK to read the program.

Step 5:

Use the programming software to log in and reset both passwords. Then power off and restart the PLC for the changes to take effect.

Note 1:

If you don’t change the password while in alarm mode, the original password remains even after power-off. Since the second password is unknown, uploading the program is still not possible.

Note 2:

The program read in alarm mode is incomplete. You must first update both passwords before the full program can be read normally after restarting. This is the key step.

Tip 1:

The FX3U example is just one method among many. Different models and brands have different approaches, but understanding the underlying principles is the most important and challenging part.

As the saying goes, “There’s no skill on the road, but it becomes clear when you practice.” Some details are intentionally omitted for practicality, so hands-on experience and problem-solving are essential.

Tip 2:

Once again, technology should serve society and progress. Using these techniques for unethical or illegal purposes is completely against the purpose of this article. We hope that professionals in electrical automation maintain strong ethical standards.

Tip 3:

Finally, here’s a collection of PLC decryption tools (note: these are from the internet, so please verify them yourself). Used wisely, they can be powerful aids in solving real-world issues.