If the PLC is locked but you have the original project file (.prj or .dld), you can often bypass the password within the programming software (DirectSOFT or Do-more Designer) by using the "Clear Password" function under the PLC > Security menu. This requires the file to be open and writable.

Usually requires a user-defined password, but check documentation for a "Master" override if your company has one. 3. The "Nuclear Option": Factory Reset

: Older firmware versions for certain Koyo/DirectLogic PLCs had vulnerabilities (like CVE-2022-2003) that allowed attackers to extract the password over serial or Ethernet using specific byte sequences. While these are generally patched in newer units, they may still work on legacy field equipment.

: Standard "unlocking" usually results in the total loss of the existing program to protect intellectual property.

If you cannot unlock the device yourself, specialized industrial automation services can often assist: Unlock PLC (Hanoi/Global)

If memory location 0x2000 holds the password in plaintext, a custom serial tool can request a memory read. This is not possible with standard software, but custom firmware or direct hardware access could retrieve it.