Many of these tools do not "crack" the password through brute force. Instead, they exploit specific firmware vulnerabilities to trigger the HMI into revealing its password in clear text over a serial or Ethernet connection.
Many of these tools are remarkably simple. You connect your PC via a serial or Ethernet cable, run the utility, and it attempts to find the vulnerability that leaks the security key. The "Shadow" Side: Security & Safety Delta Hmi Password Unlock Software
A food packaging plant in Ohio had a critical line down because the sole HMI programmer left the company without handing over the DOP-B10 HMI password. The OEM had gone bankrupt. The maintenance team tried random guesses for 6 hours. Unlocking the Secrets: A Comprehensive Guide to Delta
The glowing blue screen of the Delta DOP-B terminal stared back at You connect your PC via a serial or
A: For critical production machinery, $500 is reasonable. They have liability insurance and guarantee the result. A $20 tool from a random website offers no guarantee and may infect your OT network.
More advanced tools attempt to read the hex code directly from the HMI's memory dump to identify the password string.