Industrial control system PLC control logic decompiling method and application thereof

Abstract

The invention relates to an industrial control system PLC control logic decompilation method and application thereof, and the method comprises the following steps: carrying out simulation execution on a PLC control application program, realizing memory relocation and variable initialization processing on the control application program, and extracting an executable instruction and corresponding data; converting the extracted executable instruction and data into a unified intermediate representation to obtain an IR instruction; on the basis of a heuristic data flow analysis algorithm, variables in the IR instruction sequence are identified, forward backtracking analysis is carried out starting from the output variables, the accurate dependency relationship between the variables is recorded and constructed step by step, and a complete variable dependency graph is formed; and based on the variable dependency graph, combining branch and loop structure information in a control program, and reconstructing a complete PLC control logic in a structured text language. Compared with the prior art, the method has the advantages that the positioning precision and the recovery efficiency of PLC control logic tampering are improved, and the safety and the maintenance efficiency of an industrial control system are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security of industrial control systems, and in particular to a PLC control logic decompilation method for industrial control systems and application thereof. BACKGROUND

[0002] With the advancement of the Industry 4.0 era, the networking and intelligentization trend of industrial control systems (ICS) is increasingly evident. Industrial control systems are widely used in critical infrastructure and various production scenarios, among which PLC (Programmable Logic Controller) as an important component of industrial control systems carries the core control logic, realizing the analysis of sensor data and the control of actuator actions.

[0003] Existing PLC devices of industrial control systems are usually designed to focus on industrial control functions, lacking effective security protection mechanisms, making PLCs vulnerable targets of network attacks. Once the attacker maliciously tampers with the control logic inside the PLC, it may cause abnormal device behavior or even production accidents, seriously threatening the safety of industrial production and critical infrastructure.

[0004] Existing research on PLC control logic security mainly relies on formal verification or traditional reverse analysis methods, which can detect deviations in PLC control logic execution, but it is difficult to accurately locate the tampering position and tampering content, and cannot effectively support the recovery and security reinforcement of PLC control logic.

[0005] Chinese patent CN117573141A discloses a method for PLC instruction table decompilation, comprising: S100. Analyzing the instruction table program to obtain the parsed instruction type; S200. Judging the parsed instructions according to the preset instruction type priority, and processing the data according to the preset rules according to the judgment result. This method first judges the element instruction, then judges the block instruction, and finally judges the stack instruction. The processing object of this method is the instruction table program, not the PLC code. Although it involves a decompilation process, the purpose is to convert the instruction table program into a ladder diagram for visual modification, and it cannot restore the control logic from the code, nor can it realize the security verification of the code control logic.

[0006] Therefore, there is an urgent need for a method that can accurately and effectively decompile and restore the control logic from the PLC control application program to improve the security and maintenance efficiency of industrial control systems. SUMMARY

[0007] The application aims to solve the problem that it is difficult to accurately locate and restore PLC control logic after being maliciously tampered with in the prior art, and provides an industrial control system PLC control logic decompilation method and application thereof, which accurately and effectively decompiles and restores PLC control logic.

[0008] The object of the application can be achieved by the following technical solutions.

[0009] An industrial control system PLC control logic decompilation method comprises the following steps:

[0010] Simulated execution and code extraction: simulate the execution of the PLC control application, create a memory simulation space consistent with the actual PLC running environment, load and execute the binary code of the control application, realize memory relocation and variable initialization processing of the control application, and accurately extract executable instructions and corresponding data related to the control logic;

[0011] IR conversion: convert the extracted executable instructions and data into a unified intermediate representation to obtain IR instructions, and realize unified abstract expression of heterogeneous PLC software and hardware environments;

[0012] Dependency extraction: based on a heuristic data flow analysis algorithm, analyze the variable dependency relationship of the IR instruction sequence, which specifically includes: identifying variables in the IR instruction sequence, including input variables, output variables and ordinary variables; starting from the output variable, backward analysis is performed, and the accurate dependency relationship between variables is gradually recorded and constructed to form a complete variable dependency graph;

[0013] Control logic reconstruction: based on the constructed variable dependency graph, combined with the branch and loop structure information in the control program, the complete PLC control logic is reconstructed in a structured text language.

[0014] The simulated execution and code extraction specifically comprises the following steps:

[0015] Remove the metadata in the PLC control application binary file, and only keep the code segment and data segment related to the control logic;

[0016] Create a memory simulation space consistent with the actual PLC running environment, load the code segment and data segment at the initial address in the memory simulation space, and perform relocation;

[0017] Initialize the loaded data segment to keep it consistent with the actual PLC running state, so as to accurately obtain the data of the control logic running state;

[0018] Extract executable instructions and corresponding data related to the control logic.

[0019] The IR instructions include:

[0020] The VARREAD instruction reads PLC control variables from memory into a register;

[0021] The VARWRITE instruction means writing the contents of a register into the memory corresponding to the PLC control variable.

[0022] The REGASSIGN instruction assigns a constant value from a fixed memory address to a register.

[0023] The REGMOV instruction indicates that an immediate value is assigned to a register;

[0024] The NUMOP instruction represents numerical operations, logical operations, data type conversions, and function calls between registers.

[0025] The IR conversion specifically includes the following steps:

[0026] The executable instruction sequence extracted from the simulation execution and code extraction steps is analyzed sequentially, and two consecutive memory addressing operations are identified and matched, and abstracted into VARREAD instructions or VARWRITE instructions.

[0027] The instruction that reads a fixed constant value from a memory address in a single operation is abstracted into the REGASSIGN instruction;

[0028] The instruction that assigns an immediate value to a register is abstracted into the REGMOV instruction;

[0029] The NUMOP instruction abstracts multi-register operations related to numerical computation, logical operations, type conversion, and function calls, recording the operation type, input register, and output register.

[0030] The data stream analysis algorithm employs a hierarchical labeling method, specifically including:

[0031] Starting from the end of the control application, scan backwards and mark the first-marked output variables, numerical operation result variables, and condition judgment variables as the first level;

[0032] The input variables of the first-level variables are searched in reverse and marked as the second level, and so on, until the input variables are analyzed, forming a complete variable dependency hierarchy.

[0033] The variables identified in the IR command sequence are specifically:

[0034] Record the reading and writing status of variables.

[0035] If a variable only has read operations, it is determined to be an input variable;

[0036] If a variable only has write operations, it is determined to be an output variable;

[0037] If a variable is subject to both read and write operations, it is considered a regular variable.

[0038] The control logic reconfiguration specifically includes:

[0039] Based on the variable dependency graph, the operational relationships between variables are extracted and converted into assignment expressions in the structured text language corresponding to the control logic;

[0040] By utilizing the code block relationships in the control application, the conditional judgments and loop structures of the control logic are reconstructed;

[0041] All variables are uniformly named according to their memory addresses and categorized as input, output, and ordinary variables to improve the clarity and readability of the control logic refactoring results.

[0042] The method of reconstructing the condition judgment and loop structure of the control logic by utilizing the code block relationship in the control application specifically involves: reconstructing the loop structure and conditional branch structure in sequence based on the nested structure information of the code blocks, thereby restoring the original execution order of the control logic.

[0043] The method further includes: directly importing the reconstructed structured text language code into the PLC programming workstation to realize the verification, maintenance and security hardening of the PLC control logic.

[0044] An application of a method for decompiling PLC control logic in industrial control systems is disclosed. The method is applied to PLC devices in various industrial control systems, including but not limited to ARM-based PLCs and PLC control applications using the CODESYS runtime environment.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] This invention can efficiently and accurately recover PLC control logic from PLC binary code, significantly improving the security of industrial control systems; effectively solving the problem that existing technologies have difficulty in accurately identifying the location and content of control logic tampering; and greatly improving the efficiency of PLC maintenance and security hardening, meeting the urgent needs of industrial production and critical infrastructure security management. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the overall process of the PLC control logic decompilation method of the present invention. Detailed Implementation

[0048] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0049] This embodiment first discloses a method for decompiling PLC control logic in industrial control systems. It accurately extracts executable instructions and data related to the control logic from the PLC control application through simulation execution and relocation techniques. A unified Intermediate Representation (IR) is used to uniformly process heterogeneous PLC architectures, abstracting and transforming the extracted content to effectively solve the heterogeneity problem of different PLC hardware and software environments. Using a heuristic algorithm based on data flow analysis, it accurately identifies input and output variables and the dependencies between variables, reconstructing the complete PLC control logic. This method improves the accuracy of locating and restoring PLC control logic tampering, significantly enhancing the security and maintenance efficiency of industrial control systems.

[0050] Specifically, such as Figure 1 The diagram illustrates the main functional modules of this invention and the complete decompilation process of a PLC control application. It includes several core steps: simulation execution and code extraction, intermediate representation (IR) conversion, dependency extraction, and control logic reconstruction. The diagram clearly presents the implementation path of this invention and the calling relationships between the modules. The specific steps are as follows:

[0051] Step 1) Simulation Execution and Code Extraction: Simulate the execution of the PLC control application, create a memory simulation space consistent with the actual operating environment of the PLC, load and execute the binary code of the control application, realize memory relocation and variable initialization of the control application, and accurately extract the executable instructions and corresponding data related to the control logic.

[0052] In one embodiment, the specific steps include:

[0053] Step 11) Remove metadata from the PLC control application binary file, keeping only the code and data segments related to the control logic;

[0054] Step 12) Create a memory simulation space that is consistent with the actual operating environment of the PLC. In the memory simulation space, load the code segment and data segment at the initial address and relocate them.

[0055] Step 13) Initialize the loaded data segment to make it consistent with the actual PLC running state, so as to accurately obtain the data of the control logic running state, ensure that the data content has been correctly initialized, and avoid data extraction deviation caused by memory randomization or other factors.

[0056] Step 14) Extract the executable instructions and corresponding data related to the control logic.

[0057] Step 2) IR Conversion: The extracted executable instructions and data are converted into a unified intermediate representation to obtain IR instructions, thereby realizing a unified abstract expression of heterogeneous PLC hardware and software environments.

[0058] In this step, a unified intermediate representation (IR) is defined to effectively shield the heterogeneity of different PLC hardware and software architectures and uniformly express variables, registers, and operations in PLC control applications under different architectures.

[0059] In this embodiment, the IR commands include:

[0060] The VARREAD instruction reads PLC control variables from memory into a register;

[0061] The VARWRITE instruction means writing the contents of a register into the memory corresponding to the PLC control variable.

[0062] The REGASSIGN instruction assigns a constant value from a fixed memory address to a register.

[0063] The REGMOV instruction indicates that an immediate value is assigned to a register;

[0064] The NUMOP instruction represents numerical operations between registers (including addition, subtraction, multiplication, division, etc.), logical operations (including logical AND, logical OR, logical NOT, etc.), data type conversion, and function calls.

[0065] Based on this, IR conversion specifically includes the following steps:

[0066] Step 21) Analyze the executable instruction sequence extracted in the simulation execution and code extraction steps in sequence, identify and match two consecutive memory addressing operations, and abstract them into VARREAD instructions or VARWRITE instructions.

[0067] Step 22) Abstract the instruction that reads a fixed constant value of a memory address in a single operation into the REGASSIGN instruction;

[0068] Step 23) The instruction that assigns an immediate value to a register is abstracted into the REGMOV instruction;

[0069] Step 24) Abstract the multi-register operations related to numerical computation, logical operations, type conversion, and function calls into NUMOP instructions, and record the operation type, input register, and output register.

[0070] The extracted low-level assembly instructions are sequentially converted into the above IR instruction sequence, preserving all semantic information of the underlying code, and abstracting information such as control logic jumps, condition judgments, and loop structures into code block relationships.

[0071] Step 3) Dependency Extraction: Based on heuristic data flow analysis algorithms, variable dependency analysis is performed on the IR instruction sequence. Specifically, this includes: identifying input variables, output variables, and ordinary variables in the IR instruction sequence; starting from the output variables, backtracking analysis is performed to gradually record and construct the precise dependencies between variables, forming a complete variable dependency graph.

[0072] The data flow analysis algorithm employs a hierarchical labeling method, specifically including:

[0073] Starting from the end of the control application, scan backwards and mark the first-marked output variables, numerical operation result variables, and condition judgment variables as the first level;

[0074] The input variables of the first-level variables are searched in reverse and marked as the second level, and so on, until the input variables are analyzed, forming a complete variable dependency hierarchy.

[0075] The specific steps for identifying variables in an IR instruction sequence are as follows:

[0076] Record the reading and writing status of variables.

[0077] If a variable only has read operations, it is determined to be an input variable;

[0078] If a variable only has write operations, it is determined to be an output variable;

[0079] If a variable is subject to both read and write operations, it is considered a regular variable.

[0080] Step 4) Control logic reconstruction: Based on the constructed variable dependency graph and combined with the branch and loop structure information in the control program, the complete PLC control logic is reconstructed using structured text language.

[0081] Finally, based on the variable dependency graph obtained from the aforementioned analysis and the nesting and sequence relationships between code blocks, the complete PLC control logic is reconstructed to generate readable Structured Text (ST) language code. The specific process is as follows:

[0082] Step 41) Based on the variable dependency graph, extract the operational relationships between variables and convert them into assignment expressions in the structured text language corresponding to the control logic;

[0083] Step 42) Based on the nested structure information of the code blocks, reconstruct the loop structure and conditional branch structure in sequence to restore their original control logic execution order;

[0084] Step 43) Name all variables uniformly according to their memory addresses and classify them into input, output and ordinary variables to improve the clarity and readability of the control logic refactoring results.

[0085] In one embodiment, the reconstructed structured text language code can be directly imported into the PLC programming workstation to realize the verification, maintenance and security hardening of the PLC control logic.

[0086] This embodiment also provides an application of the industrial control system PLC control logic decompilation method. The method is applied to PLC devices in various industrial control systems. The PLC devices include, but are not limited to, ARM-based PLCs and PLC control applications using the CODESYS runtime environment.

[0087] Using the method of this invention, after decompiling and reconstructing a PLC control application program that has been tampered with in a typical industrial scenario, complete and clear control logic code can be accurately recovered. The recovered control logic code can be directly used for the safety maintenance of PLC equipment and the updating and reinforcement of control logic, effectively improving the security and operation and maintenance efficiency of industrial control systems.

[0088] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for decompiling the control logic of an industrial control system PLC, characterized in that, Includes the following steps: Simulation execution and code extraction: Simulate the execution of the PLC control application, create a memory simulation space consistent with the actual PLC operating environment, load and execute the binary code of the control application, realize memory relocation and variable initialization of the control application, and accurately extract executable instructions and corresponding data related to the control logic; IR Conversion: The extracted executable instructions and data are converted into a unified intermediate representation to obtain IR instructions, thereby realizing a unified abstract expression of heterogeneous PLC hardware and software environments; Dependency Extraction: Based on a heuristic data flow analysis algorithm, variable dependency analysis is performed on the IR instruction sequence, specifically including: identifying variables in the IR instruction sequence, including input variables, output variables, and ordinary variables; Starting from the output variable, we backtrack and analyze, gradually recording and building the precise dependencies between variables to form a complete variable dependency graph. Control logic refactoring: Based on the constructed variable dependency graph and combined with the branch and loop structure information in the control program, the complete PLC control logic is refactored using a structured text language.

2. The method for decompiling PLC control logic of an industrial control system according to claim 1, characterized in that, The simulated execution and code extraction specifically include the following steps: Remove metadata from the PLC control application binary file, keeping only the code and data segments related to the control logic; Create a memory simulation space that matches the actual operating environment of the PLC. In the memory simulation space, load the code segment and data segment at the initial address and relocate them. The loaded data segment is initialized to match the actual PLC operating state in order to accurately obtain the data of the control logic running state. Extract the executable instructions and corresponding data related to the control logic.

3. The method for decompiling the PLC control logic of an industrial control system according to claim 1, characterized in that, The IR commands include: The VARREAD instruction reads PLC control variables from memory into a register; The VARWRITE instruction means writing the contents of a register into the memory corresponding to the PLC control variable. The REGASSIGN instruction assigns a constant value from a fixed memory address to a register. The REGMOV instruction indicates that an immediate value is assigned to a register; The NUMOP instruction represents numerical operations, logical operations, data type conversions, and function calls between registers.

4. The method for decompiling the PLC control logic of an industrial control system according to claim 3, characterized in that, The IR conversion specifically includes the following steps: The executable instruction sequence extracted from the simulation execution and code extraction steps is analyzed sequentially, and two consecutive memory addressing operations are identified and matched, and abstracted into VARREAD instructions or VARWRITE instructions. The instruction that reads a fixed constant value from a memory address in a single operation is abstracted into the REGASSIGN instruction; The instruction that assigns an immediate value to a register is abstracted into the REGMOV instruction; The NUMOP instruction abstracts multi-register operations related to numerical computation, logical operations, type conversion, and function calls, recording the operation type, input register, and output register.

5. The method for decompiling the PLC control logic of an industrial control system according to claim 1, characterized in that, The data stream analysis algorithm employs a hierarchical labeling method, specifically including: Starting from the end of the control application, scan backwards and mark the first-marked output variables, numerical operation result variables, and condition judgment variables as the first level; The input variables of the first-level variables are searched in reverse and marked as the second level, and so on, until the input variables are analyzed, forming a complete variable dependency hierarchy.

6. The method for decompiling the PLC control logic of an industrial control system according to claim 1, characterized in that, The variables identified in the IR command sequence are specifically: Record the reading and writing status of variables. If a variable only has read operations, it is determined to be an input variable; If a variable only has write operations, it is determined to be an output variable; If a variable is subject to both read and write operations, it is considered a regular variable.

7. The method for decompiling PLC control logic of an industrial control system according to claim 1, characterized in that, The control logic reconfiguration specifically includes: Based on the variable dependency graph, the operational relationships between variables are extracted and converted into assignment expressions in the structured text language corresponding to the control logic; By utilizing the code block relationships in the control application, the conditional judgments and loop structures of the control logic are reconstructed; All variables are uniformly named according to their memory addresses and categorized as input, output, and ordinary variables to improve the clarity and readability of the control logic refactoring results.

8. The method for decompiling the PLC control logic of an industrial control system according to claim 6, characterized in that, The method of reconstructing the condition judgment and loop structure of the control logic by utilizing the code block relationship in the control application specifically involves: reconstructing the loop structure and conditional branch structure in sequence based on the nested structure information of the code blocks, thereby restoring the original execution order of the control logic.

9. The method for decompiling the PLC control logic of an industrial control system according to claim 1, characterized in that, The method further includes: directly importing the reconstructed structured text language code into the PLC programming workstation to realize the verification, maintenance and security hardening of the PLC control logic.

10. An application of a method for decompiling the control logic of an industrial control system PLC, characterized in that, The method described in any one of claims 1-9 can be applied to PLC devices in various industrial control systems, including but not limited to ARM-based PLCs and PLC control applications using the CODESYS runtime environment.

Images