Tuesday, October 28, 2008

Unlock protected blocks in Siemens SIMATIC Step 7

Recently I'd been called by Hindalco's Fabrication Plant division to unlock the protected blocks in Siemens SIMATIC Step 7. They were in need to unlock those blocks since an year because of 1 million Rupees of loss per month. They want to re-program those blocks but it was locked by the man who'd done the setup. From the people working in that department, I came to know that they were trying to call that man (someone from Italy) right here but he's not coming. Actually, what he'd done was that he'd locked some of the blocks and deleted the source file. And Siemens didn't provide any feature to unlock. Department people also told me that even the people working in Siemens don't know how to do it. Being a software engineer I know that any thing can be reverse engineered. So I took up the challenge.

How did I unlocked the blocks?

The first thing I'd done was searched about this software at Google and read about what is this software all about. After that I'd explored the software. A person (might be S7 programmer) told me about 'Generate source' and shown me a sample by doing it. Further on he'd shown me how do they lock a block via KNOW_HOW_PROTECT. It was amazing, they just write this line (KNOW_HOW_PROTECT) inside a program after begin statement and compile the code. The compiled code is known as blocks. The blocks are now protected which means the code inside the block can't be seen by other. Then delete the source and your blocks are now protected.

Now my objective was to unlock those blocks. So I'd followed the steps given below to unlock those blocks,

Step 1: Download *.dbf file editor. The free DOS based dbf editor is the one I'd used. You can download it from,

Step 2: Extract dbf_edit.exe from the zipped file. Put it somewhere to easily access it. I'd put it inside a folder named dbfedit in C: drive. So path to run the editor is C:\DBFEDIT>dbfedit.exe

Step 3: To unlock the blocks, copy a file named SUBBLK.DBF from ..\PROJECT\ombstx\offline\00000001\ folder where PROJECT is the directory containing your S7 Project. Paste this file inside C:\DBFEDIT\ folder.

Step 4: Open Command Prompt (DOS window) via clicking on

Start  Run  type 'cmd'  press enter
Start  All Programs  Accessories  Command Prompt

Step 5: Follow these commands,

C:\>cd dbfedit
C:\DBFEDIT>dbfedit.exe subblk.dbf

A DOS based application will open. Search for the PASSWORD column. And change all 3 into 0 to unlock the blocks. Press Esc/F10 key to save and exit.


Step 6: Copy the SUBBLK.DBF file inside C:\DBFEDIT\ folder and paste it at it's original location. Always remember to make the backup of original SUBBLK.DBF.

Step 7: Now open the project in SIMATEC Step 7 software. All the blocks are unlocked.

So my objective is completed successfully.

It took me around 3 hours to complete this for the first time. But after that I can do it within 5 minutes.

Have fun!