Fanuc 16i Ma Parameter Password... Trying to crack it

GBeaman · Mar 20, 2017

I bought this 1997 Robodrill from a man who bought it (like a dealer/trader) from Danaher (Matco Tool).

I got it up and running but the previous company put a password into the parameters. I called and talked to someone who might possibly know, he said the password would be 1111 or Kingsley. I have entered 1111 into the keyword and still can't get past it.

Another person on the internet claims to be able to crack the password if I send the SRAM back up.
Apparently the "a" version of the 16i control requires a genuine SRAM card (bought 2mb card from cnc-specialty-store.com for $130) and did an SRAM back up. But I can't figure out how to get SRAM to my PC as a send able file. CNC Specialty has a reader/writer for $405.

I may need to bite the bullet, but any ideas would be great. My understanding is the only way to get the control password free is to either crack it or wipe it. If I wipe it and I don't have all the 9000s output and certain parameters, I may end up with a fast, 4-axis, boat anchor.

Thanks for any help.
Greg

yardbird · Mar 20, 2017

I don't see how you have any choice? I would have to really trust the source if I was putting my machine in boat anchor territories. I've never seen any i series option parameters or passwords floating around. If I had to end up biting something I'd rather it be a bullet then a big weenie.

Good luck! Oh and btw you crack it make sure and let us know. :drool5:

Brent

GBeaman · Mar 20, 2017

Maybe a piece of the puzzle coming together. CNC-Specialty-Store is going to read my data off my SRAM card an put it on a flash card for a reasonable fee. Then I can access the data on the flash card. Then I don't have to buy an expensive reader for a one time use. I am going to ship it to them today. The other parts of the puzzle will have to wait until the data comes back, but I am very pleased with the solution and the help at that store.
Russ might say... To Be Continued... But I never would. ;-)
Greg

Vancbiker · Mar 20, 2017

GBeaman said:
Maybe a piece of the puzzle coming together. CNC-Specialty-Store is going to read my data off my SRAM card an put it on a flash card for a reasonable fee. Then I can access the data on the flash card. Then I don't have to buy an expensive reader for a one time use. I am going to ship it to them today. The other parts of the puzzle will have to wait until the data comes back, but I am very pleased with the solution and the help at that store.
Russ might say... To Be Continued... But I never would. ;-)
Greg

I've had success reading SRAM PCMCIA cards into an older laptop with a program called CardWizard loaded on it.

I'm suspicious that the password may be from Fanuc rather than the previous owner. IIRC Fanuc used the password function on the Robodrills. Might be worth talking to a Fanuc Robodrill service guy.

DMF_TomB · Mar 20, 2017

GBeaman said:
I bought this 1997 Robodrill from a man who bought it (like a dealer/trader) from Danaher (Matco Tool).

I got it up and running but the previous company put a password into the parameters. I called and talked to someone who might possibly know, he said the password would be 1111 or Kingsley. I have entered 1111 into the keyword and still can't get past it.

Another person on the internet claims to be able to crack the password if I send the SRAM back up.
Apparently the "a" version of the 16i control requires a genuine SRAM card (bought 2mb card from cnc-specialty-store.com for $130) and did an SRAM back up. But I can't figure out how to get SRAM to my PC as a send able file. CNC Specialty has a reader/writer for $405.

I may need to bite the bullet, but any ideas would be great. My understanding is the only way to get the control password free is to either crack it or wipe it. If I wipe it and I don't have all the 9000s output and certain parameters, I may end up with a fast, 4-axis, boat anchor.

Thanks for any help.
Greg

.
some older Fanuc machines have PWE or parameter write enable (8000) has to be turned on in mdi mode first then another parameter has to be changed to edit 8000 or 9000 program. different parameter for 8000 and different one for 9000 programs

GBeaman · Mar 20, 2017

There is surprisingly little data about the silly password online, but it has happened to others. When I try to edit 3202#4 (ne9) to unlock the 9000s I get an alarm saying "write protected" This is with PWE enabled.

This is linked to the Keyword and Password set in 3210 and 3211. I really think it is something the other company did to it.

If I were to call a knowledgeable service tech does anyone have any good contacts or references on who to call? Thanks
Greg

yardbird · Mar 20, 2017

That does sound strange, it very well may have been the last owners password and not Fanuc? I don't have that password issue on my control trying to change 3202.4.

Having said that I believe the 3202.4 parameter just unlocks and allows to output, view & edit the 9000's programs not the option parameters?

Brent

Vancbiker · Mar 20, 2017

Have you tried punching out the parameters to RS232 and checking if 3210 and 3211 are shown in the file?

GBeaman · Mar 20, 2017

I have punched out the parameters and I noted section of the parameters missing and then I punched out programs and couldn't get anything 8000-9000 out. I will double check to make sure I didn't bonehead miss that 3210 and 3211 might be shown. Thanks for the pointer.
Greg

yardbird · Mar 20, 2017

You may be aware of this already but as Tom mentioned on my 0i control and I'm thinking it is a bit in 3202 (ne8) that unlocks the 8000's stuff. I'm not at the control or manual to verify for sure witch one. I remember two separate unlock parameters one for each. I have no password to enter of either?

Brent

machtool · Mar 21, 2017

yardbird said:
You may be aware of this already but as Tom mentioned on my 0i control and I'm thinking it is a bit in 3202 (ne8) that unlocks the 8000's stuff. I'm not at the control or manual to verify for sure witch one. I remember two separate unlock parameters one for each. I have no password to enter of either?

G'day Brent.

Ne8 should be 3202 .0 (Bit Zero)
Ne9 is 3202.4 (Bit 4).

Regards Phil.

GBeaman · Mar 23, 2017

Well CNC Specialty Store said that my card was unreadable and probably needed to be formatted. Eeeeek!!! Glad to know the data is possibly corrupt before I desperately need it. I think, at this point, I need to find a way to read an SRAM card myself. I think I will try a cheap adapter and Vancbiker's suggestion of card wizard.

Does anyone know the correct procedure for inputting the password if I were to venture guesses? There is both password and keyword 3210 and 3211 respectively. Do I just enter my best guess into 3210? Will I get a different display if I nail it? I think 3220 is where the password actually resides, but I don't know nuttin'!! Thanks again fellas.
Greg

Vancbiker · Mar 23, 2017

To unlock it you change 3211 to match what was stored in 3210. I do not recall any lights flashing or bells ringing when it unlocks.

The laptop and CardWizard setup I used was set up on an old NEC laptop with a built-in PCMCIA slot. I'm not sure if an adapter (USB to PCMCIA?) will work. CardWizard was made by a company called SystemSoft. They don't appear to be around any more. This looks like it might work to download an old copy...

SystemSoft PCMCIA Card Wizard , v.5.2.6, A Driver Details | Dell US

Hope it helps. Good luck!

yardbird · Mar 23, 2017

Vancbiker is more knowledge on things like this so this is just me thinking out loud here so take it for what it's worth.

It doesn't seem all that secure of a Fanuc password system if all you have to do is output the system parameters them just read the password? I gonna hazard to guess that without having the password only system parameters not password protected would be able to be output?

I have hunch it's going to take a Fanuc tech with some sort of top secret administrative privileges type procedure to access the protected system information especially the passwords?

For your sake I hope I'm wrong and it's very likely I am?

Brent

Vancbiker · Mar 23, 2017

yardbird said:
Vancbiker is more knowledge on things like this so this is just me thinking out loud here so take it for what it's worth.

It doesn't seem all that secure of a Fanuc password system if all you have to do is output the system parameters them just read the password? I gonna hazard to guess that without having the password only system parameters not password protected would be able to be output?

I have hunch it's going to take a Fanuc tech with some sort of top secret administrative privileges type procedure to access the protected system information especially the passwords?

I've never had to "crack" the password so not sure how. Just guessing about ways to try. I've only had one instance where the 3210 and 3211 password/keyword scenario was used. On an Okuma Howa mill there was a toolchange macro that did not have provision for handling a large tool by keeping the adjacent pots empty. Had to unlock the builders (possibly dealers) password (they provided it) to edit the macro. This password system is for machine builder/user use so I doubt that it's all that secure. I'd be phoning a Fanuc tech, hopefully someone with Robodrill knowledge, about cracking this. I wish I had access to a 16i control to play around with to try and figure this out.

GBeaman · Mar 29, 2017

I found an old Sony VAIO laptop that has a network card plugged into a PCMCIA port. It is cheap off of craigslist. I think I am going to buy it and give it a whirl. There appears to be a work around in for Windows XP to read/write to the SRAM cards. I think XP is as new an operating system as you can go without buying the expensive Omni drive. I wonder if the PCMCIA port can be used to read/write even though it was installed for the intent of a wireless network card. I guess I'll have to gamble and see. The laptop is only $30, but I have to drive an hour each way to go pick it up. Shrug...
Keep you guys posted. Maybe the mystery will some day be solved.

PS on a funny note. My wife posted a question on Slick Deals technical forum about reading SRAM and the helpful guys over there found this thread and linked back to it. They asked if "any of this information was helpful". Helpful YES. Complete answer, not yet. :-)

Vancbiker · Mar 29, 2017

Bring your SRAM card with you and be sure it fits. One of my laptops has a slot that outwardly appears to be a regular PCMCIA slot but actually is a PCMCIA Express slot which uses a different shape card.

ExpressCard

GBeaman · Mar 29, 2017

Vancbiker said:
Bring your SRAM card with you and be sure it fits. One of my laptops has a slot that outwardly appears to be a regular PCMCIA slot but actually is a PCMCIA Express slot which uses a different shape card.

ExpressCard

That's an outstanding idea! Thank you very much. I am going to do that!!

GBeaman · Apr 7, 2017

Progress so far:
I picked up the old-ish Sony VAIO laptop from craigslist and it works quite the treat. Plugged the card in and immediately it went to work. Recognized the device copied the file and pasted to my flash drive. Wham-Bam-Thank You- Ma'am. This was the Fanuc SRAM Backup which has a file format of .FDB When I open this file in TXT there is some intelligible data there but mostly hieroglyphic appearing symbols.

Emailed to person who claims to be able to extract the password. He promptly sends a reply with password is 1518. Tried backwards, forwards, upside-down, and with my mouth open. NO LUCK! I tell him no luck and he sends a different number to try. No luck either. Poking through the parameters I notice that the part count is set to 1518. Hmmm... I haven't spotted the second number yet, but. The guy asks for the "FROM" files instead of the SRAM. Once I figure out what he is referring to I try to write them to my SRAM card. Some seem locked. There are 15 options and these files all end in extension .000 I can extract 4 of the 5 that don't appear locked. The final one is too big for my 2MB (expensive) SRAM card, even when empty. It is likely that the password would be tied up in the remaining locked back up files.

When I select their option and write I get: "FILE SAVE ERROR HIT SELECT KEY"

PROTECT FILE

~

Fanuc 16i Ma Parameter Password... Trying to crack it

Hot Rolled

Titanium

Hot Rolled

Diamond

Diamond

Hot Rolled

Titanium

Diamond

Hot Rolled

Titanium

Diamond

Hot Rolled

Diamond

Titanium

Diamond

Hot Rolled

Diamond

Hot Rolled

Hot Rolled

Attachments

Similar threads