To read Mitsubishi PLC password - Database & Sql Blog Articles

1. First, select a serial port debugging tool. It's recommended to use Multi-Serial Debugger (MultiCOMWatch).
2. For Mitsubishi FX series PLCs, the password verification process uses a clear code method. This means that the password can be obtained by monitoring the communication process. When the programming software connects to the PLC, the PLC sends the password to the computer and waits for a correct match.
Method: Open MultiCOMWatch and connect to Com1 (or the appropriate port connected to the PLC).
Determine the model of the Mitsubishi PLC. Based on the model, enter the corresponding string in the text field of the debugger. (Note: STX = 02, ETX = 03)

PLC Model	Text String	HEX Format
FX2	\STX0700808\ETX6A	02 30 37 30 30 38 30 38 03 36 41 32
FX2N	\STX0300808\ETX66	02 30 33 30 30 38 30 38 03 36 36 32
FX2_EPROM	\STX0800808\ETX6B	02 30 38 30 30 38 30 38 03 36 42
FXON/FXOX	\STX0800808\ETX6B	02 30 38 30 30 38 30 38 03 36 42
FX1N/FX1X	\STX0800808\ETX6B	02 30 38 30 30 38 30 38 03 36 42

Example: Send: A2 07 00 FF 02 05 AE 00 08 C3
Receive: 0B 00 FF 02 00 AA 77 55 BB EF CD AB A4 00
Password: ABCDEF

Send: A2 07 00 FF 02 05 AE 00 08 C3
Receive: 0B 00 FF 02 00 AA 77 55 BB C1 B1 A1 A4
Password: A1B1C1

Analysis: The password is located between "BB" and "A4" in the received data. Read the characters in pairs from right to left.

Once you understand these strings, you can write a program in VB or other languages to read and write passwords. If you want to learn more about how the PLC communicates with the computer, you can use a hardware monitoring method to capture the entire communication process.

3. After sending the command, a string will appear in the receiving window — this is the returned password. If you can't see it clearly, copy the string and convert it to HEX format before sending again. Remember to disconnect the PLC before sending any commands.