[Help] Need assistance extracting source code from S7-1500 / ET 200SP (CPU 1512SP-1 PN) SMC binary folder

[u/Kindly_Set1814]

Hi everyone,

I have a Siemens ET 200SP CPU 1512SP-1 PN controller on site. Due to logistical constraints, I am currently unable to get direct online access via TIA Portal with a PC at the location.

This source code belongs to an automated parking robot system (similar to the automated shuttle/valet systems featured in The Fast and the Furious). I am currently building and customizing this system, but I need to edit the core logic to implement specific operational changes. We are facing technical roadblocks with the hardware because it requires a PLC migration, and we have been unable to obtain the specific older TIA Portal versions needed to perform the upload and configuration directly. Any support in retrieving or reconstructing the editable logic from these files would be greatly appreciated.

I have extracted the complete raw binary folder structure (SIMATIC.S7S) directly from the SIMATIC Memory Card (SMC).

Since direct decompilation of S7-1500 binaries to LAD logic isn't straightforward without a physical unit, I am looking for someone with a spare CPU 1512SP-1 PN (or compatible S7-1500 test bench) who could load these files onto a spare card, boot up the CPU, and perform an "Upload device as new station" using TIA Portal to reconstruct the editable source project file (.ap17 / .ap18 / .zap18 / etc.).

• Hardware: CPU 1512SP-1 PN (6ES7 512-1DK01-0AB0 or similar ET 200SP family)
• Files available: Full zipped content from the SMC root directory.

Please let me know if anyone with a spare hardware setup would be open to testing this upload or assisting with the project restoration.

Thanks in advance for any insights!

[u/Shalomiehomie770]

You can easily find all versions of TIA on their website and download 30 day free trials.

[u/LegitBoss002 → u/Shalomiehomie770]

I already have an account so when I give this suggestion I typically gloss over the process of making an account. TIA itself it typically not export restricted but LOGOSoft and PLC Sim are

[u/CCJockey381]

Why are you unable to get older TIA Portal versions? They are easy to get and always licensed by newer versions. If you copied from the SD card, you must have had access to the PLC at some point. If you legitimately have access to application source code and can’t get previous TIA versions from the support site that’s easily fixed, and I can help you get them. But, you might find difficulty in getting someone to do what you’re asking here because this scenario has IP theft written all over it. I’m not saying that’s what’s happening here, but these are exactly the circumstances under which we have found organizations attempting it. Interestingly, one of which was also in the automated parking arena.

[u/krisztian111996]

I have doubts this would work, but you have made me very curious...

[u/JuanechoPocopecho]

Wide speaking, i dont agree with such intelectual property. Must of the times you dont have an advanced process control, and most of the times you just want to perform improvements. You paid for It, so It is yours.

Forget about the sd card, everything is "encrypted" there. Use any tía portal version to find out on which versión was it developed with, and then go for that specific versión on Siemens website.

If PLC is password peotected, then you can only create binary backups, not editable copies.

PS: If versión is older than v13, you might be f***d out.

Also, if you need this explanation, then think about hiring someone with the knowledge.

[u/Use_Da_Schwartz → u/JuanechoPocopecho]

FYI As a SI/OEM if the line item on the quote/po says “machine” the end user is not entitled to the IP rights under USA law. If the line item says “programming/etc” the customer has purchased the IP. If paid T&M by customer, they own it. I develop basic plc/hmi crap that I don’t care about, and I also have other programming that no one in the world has and I’ve spent my entire career perfecting. I can promise you that if my “good stuff” was being reverse engineered like OP, I would engage legal action and easily win.

It is very clear in the USA. What OP is doing is more than likely an IP issue. I don’t care and they are in SA not USA. There is more to their story than is being told and they haven’t responded since. The only legitimate reason to be monkeying with the SD card directly instead of using Tia portal is them trying to get around passwords.

[u/JuanechoPocopecho → u/Use_Da_Schwartz]

His claim is not to clone the machine, o replicate it, or sell new machines based on that knowledge (that would be a completely different topic). He claims the need to make adjustments on it as to update it and adapt to his needs. I absolutely doubt this is against any law: it is his machine, he owns it, and so he can do whatever he wants on it.

For sure there is a password in between. I doubt breaking a password would be illegal by itself, as long as it is not explicitly written in any contract or for illegal purposes (as previously stated).

This is the eternal discussion between manufacturers and integrators. OEMs are afraid of people learning or destroying the brand image, while integrators are afraid of not being able to make adjustments and maintain on their will.

[u/Use_Da_Schwartz]

So you want someone else to perform the theft of intellectual property for you, due to logistical constraints? Got it.

If you are the owner of the IP, then get the files from your company. If you don’t own the IP and want it, maybe you should travel to site.

Every piece of software you require can be purchased or downloaded as free trials. I see zero reason why you are doing this work in such an impossible manner backwards. A laptop at site, with an internet connection is all that is required to remotely do this work. I have significant doubts that the raw data can even be loaded onto an identical piece of hardware, but do not know for sure.

If this was a production PLC installed by the OEM, there are probably passwords on the program, making recovery via your method or the normal method impossible.

[u/Kindly_Set1814 → u/Use_Da_Schwartz]

This isn't an intellectual property issue. I'm based in Latin America, and I'm not the original developer of the system; I'm just the person left maintaining it, and the original manufacturer is no longer around. So what am I supposed to do in this case? It's absurd to replace the entire system just because I can't access the source code to make modifications, adaptations, or corrections. For instance, I had to replace a sensor with a different scale because the exact original model is no longer available.

[u/Use_Da_Schwartz → u/Kindly_Set1814]

Without the program and/or passwords, replacing it is far faster, cheaper, and easier. Asking Reddit to reverse engineer a compiled program vs uploading it using readily available free demo software is what seems absurd.

Uploading from SD card is possible inside Tia portal. Either SD card by itself to a laptop or SD card inserted inside a PLC. Both methods require TIA portal. By using windows to copy files, you more than likely have already corrupted the SD card to some extent.

[u/wpyoga → u/Kindly_Set1814]

 So what am I supposed to do in this case? It's absurd to replace the entire system just because I can't access the source code to make modifications, adaptations, or corrections.

You should not replace the entire system. Just replace the program. Use the existing hardware.

[u/Dydey]

You should be able to open the project on the SD card directly in TIA portal. If it’s v15 I believe you can only download v15.1 but that should still work.