這個程序可以用Visual Studio或EVC（Win CE）編譯，實際在Wince系統RUN過OK，有問題的可以回覆告知。
下方范例程序可以直接讀取D0000的值。
我是這個論壇的新人，不知道如何將文件上傳，我可以將完整專案文件上傳給大家參考，包刮PLC端Ethernet設定方法。


       WSADATA            wsaData;
    SOCKET            udpcmdSock;
    SOCKADDR_IN        saRecv, saSend;
    int                iLen,err,nSize;
    unsigned char    szToUdpCommand[80],szUdpResponse[100];
    struct    timeval        tv;
    fd_set    ReadFds;        //資料可讀取
    fd_set    WriteFds;        //資料可寫入
    fd_set    Exceptfds;        //錯誤檢出
    int        iRetCode;
    CString str1,str2;

    if(WSAStartup(0x0202,&wsaData) == SOCKET_ERROR)
    {
         MessageBox(_T("Startup Failure;"),_T("AMI"),MB_ICONERROR|MB_OK);
         WSACleanup();
         return;
    }

    udpcmdSock = socket ( AF_INET, SOCK_DGRAM, 0 );
    if ( INVALID_SOCKET == udpcmdSock)
    {
        MessageBox(_T("socket error;"),_T("AMI"),MB_ICONERROR|MB_OK);
        WSACleanup();
        return;
    }
    // bind to a local socket and an interface.
    saRecv.sin_family = AF_INET;
    saRecv.sin_addr.s_addr = htonl ( INADDR_ANY );
    //saSend.sin_addr.s_addr = inet_addr("172.16.50.220");
    saRecv.sin_port = htons ( 3939 );
    err = bind ( udpcmdSock, (SOCKADDR *) &saRecv, sizeof (SOCKADDR_IN) );
    if ( err==SOCKET_ERROR  )
    {
        MessageBox(_T("bind error;"),_T("AMI"),MB_ICONERROR|MB_OK);
        closesocket( udpcmdSock );
        WSACleanup();
        return;;
    }

    saSend.sin_family = AF_INET;
    saSend.sin_addr.s_addr = inet_addr("172.16.50.222");   // htonl ( INADDR_BROADCAST );
    saSend.sin_port = htons ( 3941 );
    iLen=21;
    szToUdpCommand[0]=0x50;        //SubHeader.bL
    szToUdpCommand[1]=0x00;        //SubHeader.bH
    szToUdpCommand[2]=0x00;        //NetworkNo
    szToUdpCommand[3]=0xFF;        //PCNo
    szToUdpCommand[4]=0xFF;        //IONo.bL
    szToUdpCommand[5]=0x03;        //IONo.bH
    szToUdpCommand[6]=0x00;        //StationNo
    szToUdpCommand[7]=0x0C;        //Length.bL 12 byte
    szToUdpCommand[8]=0x00;        //Length.bH
    szToUdpCommand[9]=0x10;        //Timer.bL
    szToUdpCommand[10]=0x00;    //Timer.bH
    szToUdpCommand[11]=0x01;    //Command.bL
    szToUdpCommand[12]=0x04;    //Command.bH
    szToUdpCommand[13]=0x00;    //SubCommand.bL bit0=0 -> word unit
    szToUdpCommand[14]=0x00;    //SubCommand.bH
    szToUdpCommand[15]=0x00;    //AddressL
    szToUdpCommand[16]=0x00;    //AddressNULL
    szToUdpCommand[17]=0x00;    //AddressH
    szToUdpCommand[18]=0xA8;    //DeviceCode D
    szToUdpCommand[19]=0x01;    //Points.bL    1 points
    szToUdpCommand[20]=0x00;    //Points.bH

    str1.Format(_T("L=%d,SBuf="),iLen);
    for(int i=0;i<iLen;i++) str1.AppendFormat(_T("%02hX "),(BYTE)szToUdpCommand);
    GetDlgItem(IDC_STATIC1)->SetWindowTextW(str1);

    //--- send command to PLC ---
    err = sendto ( udpcmdSock,(char*)szToUdpCommand,iLen,0,
        (SOCKADDR *) &saSend,sizeof ( SOCKADDR_IN ));
    if (  err==SOCKET_ERROR  )
    {
        MessageBox(_T("sendto error"),_T(""),MB_ICONERROR|MB_OK);
        closesocket( udpcmdSock );
        WSACleanup();
        return;
    }

/*********** receive response from Mit PLC ***********/
    tv.tv_sec = 2;//sec.
    tv.tv_usec = 0; //u-sec
    // The fd sets should be zeroed out before using them to prevent errors.
    FD_ZERO(&ReadFds);
    FD_ZERO(&WriteFds);
    FD_ZERO(&Exceptfds);
    //FD_CLR(udpcmdSock, &ReadFds );
    FD_SET(udpcmdSock, &ReadFds );

    iRetCode = select(0,&ReadFds,NULL,NULL,&tv);
    if (iRetCode == SOCKET_ERROR) {
        MessageBox(_T("select error"),_T(""),MB_ICONERROR|MB_OK);
        closesocket( udpcmdSock );
        WSACleanup();
        return;
    }

    if (FD_ISSET(udpcmdSock, &ReadFds)==0)//OnReceive
    {
        MessageBox(_T("Time Out !"),_T(""),MB_ICONERROR|MB_OK);
        closesocket( udpcmdSock );
        WSACleanup();
        return;
    }//OnReceive
    
    nSize = sizeof ( SOCKADDR_IN );
    err = recvfrom ( udpcmdSock, (char*)szUdpResponse,100, 0,
        (SOCKADDR FAR *) &saRecv, &nSize );
    if (err  ==  SOCKET_ERROR)
    {
        MessageBox(_T("recvfrom error"),_T(""),MB_ICONERROR|MB_OK);              
        closesocket( udpcmdSock );
        WSACleanup();
        return;
    }
    MessageBox(_T("recvfrom OK"),_T(""),MB_OK);

    str2.Format(_T("L=%d,RBuf="),err);
    for(int i=0;i<err;i++)    str2.AppendFormat(_T("%02hX "),(BYTE)szUdpResponse);
    GetDlgItem(IDC_STATIC2)->SetWindowTextW(str2);

    if ( udpcmdSock!=INVALID_SOCKET ){
        closesocket(udpcmdSock);
    }
    WSACleanup();

高人，這個我是學不會了