第1段密就和FX2N的一样，加的是明码，第2段就不一样了，密码加上后都变了，算法也完全变了，但在网上有高手能做到直读密码，我们被FX3U这种PLC的强大功能所吸引，对三菱PLC大家都用习惯了，觉的用起来顺手，在整个工控行业中用的比例很大，所以对破解这款PLC产生的浓厚的性趣，FX3U有的可以2个口编程，一个是我们通常用的圆口，还有个可以扩展个232接口，我先试圆口，通过串口软件监控的数椐，以下是我调试监控的数据。
#TimeFunctionData(Hex)
1[00000000]IRP_MJ_CREATEPortOpened-Gppw.exe
2[00000000]IOCTL_SERIAL_SET_BAUD_RATEBaudRate:115200
3[00000000]IOCTL_SERIAL_SET_LINE_CONTROLStopBits:1,Parity:Even,DataBits:7
4[00000001]IRP_MJ_WRITELength:0001,data:05
5[00000002]IRP_MJ_READLength:0001,data:06
6[00000002]IRP_MJ_WRITELength:0011,data:0230304530323032033643
7[00000003]IRP_MJ_READLength:0001,data:02
8[00000003]IRP_MJ_READLength:0001,data:42
9[00000003]IRP_MJ_READLength:0001,data:31
10[00000003]IRP_MJ_READLength:0001,data:35
11[00000003]IRP_MJ_READLength:0001,data:45
12[00000003]IRP_MJ_READLength:0001,data:03
13[00000003]IRP_MJ_READLength:0001,data:46
14[00000003]IRP_MJ_READLength:0001,data:30
15[00000004]IRP_MJ_WRITELength:0011,data:0230304543413032033845
16[00000004]IRP_MJ_READLength:0001,data:02
17[00000004]IRP_MJ_READLength:0001,data:37
18[00000004]IRP_MJ_READLength:0001,data:31
19[00000004]IRP_MJ_READLength:0001,data:33
20[00000004]IRP_MJ_READLength:0001,data:46
21[00000004]IRP_MJ_READLength:0001,data:03
22[00000004]IRP_MJ_READLength:0001,data:45
23[00000004]IRP_MJ_READLength:0001,data:34
24[00000005]IRP_MJ_WRITELength:0011,data:0230304530323032033643
25[00000006]IRP_MJ_READLength:0001,data:02
26[00000006]IRP_MJ_READLength:0001,data:42
27[00000006]IRP_MJ_READLength:0001,data:31
28[00000006]IRP_MJ_READLength:0001,data:35
29[00000006]IRP_MJ_READLength:0001,data:45
30[00000006]IRP_MJ_READLength:0001,data:03
31[00000006]IRP_MJ_READLength:0001,data:46
32[00000006]IRP_MJ_READLength:0001,data:30
33[00000006]IRP_MJ_WRITELength:0011,data:0230304543413032033845
34[00000007]IRP_MJ_READLength:0001,data:02
35[00000007]IRP_MJ_READLength:0001,data:37
36[00000007]IRP_MJ_READLength:0001,data:31
37[00000007]IRP_MJ_READLength:0001,data:33
38[00000007]IRP_MJ_READLength:0001,data:46
39[00000007]IRP_MJ_READLength:0001,data:03
40[00000007]IRP_MJ_READLength:0001,data:45
41[00000007]IRP_MJ_READLength:0001,data:34
42[00000015]IRP_MJ_CLOSEPortClosed
6、上述从串口监控到的数据是十六进制的数据，还真不好看，先转换成ASC码，就好看多了。
#TimeFunctionData(String)
1[00000000]IRP_MJ_CREATEPortOpened-Gppw.exe
2[00000000]IOCTL_SERIAL_SET_BAUD_RATEBaudRate:115200
3[00000000]IOCTL_SERIAL_SET_LINE_CONTROLStopBits:1,Parity:Even,DataBits:7
4[00000001]IRP_MJ_WRITELength:0001,data:
5[00000002]IRP_MJ_READLength:0001,data:
6[00000002]IRP_MJ_WRITELength:0011,data:00E02026C
7[00000003]IRP_MJ_READLength:0001,data:
8[00000003]IRP_MJ_READLength:0001,data:B
9[00000003]IRP_MJ_READLength:0001,data:1
10[00000003]IRP_MJ_READLength:0001,data:5
11[00000003]IRP_MJ_READLength:0001,data:E
12[00000003]IRP_MJ_READLength:0001,data:
13[00000003]IRP_MJ_READLength:0001,data:F
14[00000003]IRP_MJ_READLength:0001,data:0
15[00000004]IRP_MJ_WRITELength:0011,data:00ECA028E
16[00000004]IRP_MJ_READLength:0001,data:
17[00000004]IRP_MJ_READLength:0001,data:7
18[00000004]IRP_MJ_READLength:0001,data:1
19[00000004]IRP_MJ_READLength:0001,data:3
20[00000004]IRP_MJ_READLength:0001,data:F
21[00000004]IRP_MJ_READLength:0001,data:
22[00000004]IRP_MJ_READLength:0001,data:E
23[00000004]IRP_MJ_READLength:0001,data:4
24[00000005]IRP_MJ_WRITELength:0011,data:00E02026C
25[00000006]IRP_MJ_READLength:0001,data:
26[00000006]IRP_MJ_READLength:0001,data:B
27[00000006]IRP_MJ_READLength:0001,data:1
28[00000006]IRP_MJ_READLength:0001,data:5
29[00000006]IRP_MJ_READLength:0001,data:E
30[00000006]IRP_MJ_READLength:0001,data:
31[00000006]IRP_MJ_READLength:0001,data:F
32[00000006]IRP_MJ_READLength:0001,data:0
33[00000006]IRP_MJ_WRITELength:0011,data:00ECA028E
34[00000007]IRP_MJ_READLength:0001,data:
35[00000007]IRP_MJ_READLength:0001,data:7
36[00000007]IRP_MJ_READLength:0001,data:1
37[00000007]IRP_MJ_READLength:0001,data:3
38[00000007]IRP_MJ_READLength:0001,data:F
39[00000007]IRP_MJ_READLength:0001,data:
40[00000007]IRP_MJ_READLength:0001,data:E
41[00000007]IRP_MJ_READLength:0001,data:4
42[00000015]IRP_MJ_CLOSEPortClosed
电脑发：00E0202’查询D8001的值
PLC回：B15E‘回复为5EB1，回复的数据高位在后、低位在前，所以要对调个位，
5EB1转为10进数据值为：24241，24表示PLC型号FX2N或3U，241表示版本号，
电脑发：00ECA02码’查询D8101的值
PLC回：713F‘回复为3F71转为10进数据值为：16241，16表示PLC型号为FX3U，241表示版本号
以上这一大段数据也就是编程软件查询一下PLC的型号，以便接下来按相应的通迅协议进行通迅。这些数据是花了大量时间测试出来的，
这次就讲到这里，望朋友多多指点。
水电之家为您提供最全面的管材,管件,水电,电线,电工,管材水电品牌的装修知识点和各种管材水电的导购与在线购买服务,拥有最便宜的管材水电价格和最优质的售后服务,每天都有秒杀的抢购活动哦！敬请登陆水电之家：http://shuidian.jc68.com/
