Reverse analysis method and device for plc program

Abstract

The application discloses a PLC program reverse analysis method and device. The method comprises the following steps: obtaining a to-be-processed file; performing structural analysis processing on the to-be-processed file to obtain program entry address information and memory initialization information; performing subprogram identification processing on the to-be-processed file according to the program entry address information and the memory initialization information to obtain program flow feature data; performing identification processing on the program flow feature data based on a library function signature to obtain standard function block data; performing parameter extraction processing on the program flow feature data to obtain control behavior parameter data; and performing visual modeling processing on the program entry address information, the memory initialization information, the program flow feature data, the standard function block data and the control behavior parameter data to obtain reverse analysis result data. The automatic and structured control program reverse reconstruction capability is realized.

Description

Technical Field

[0001] This application relates to the field of industrial control, and more specifically, to a method and apparatus for reverse analysis of PLC programs. Background Technology

[0002] In the wave of increasing digitalization and networking of Industrial Control Systems (ICS), PLCs, as core components of industrial automation, have made the integrity and reliability of their control programs crucial to industrial information security. Due to multiple requirements including functionality, security, and version compatibility, static or dynamic reverse engineering of the binary files executed by PLCs (especially PRG files compiled by the CODESYS platform) has become one of the important fundamental research directions in industrial control security research. However, unlike the traditional IT field with its clear instruction set structure, universal compilers, and standardized file formats (such as ELF and PE), the ICS field is highly verticalized and vendor-closed. These characteristics lead to the following at the PLC level:

[0003] • Lack of standardized reverse engineering tools;

[0004] Commonly used analysis frameworks (such as IDAPro, Ghidra, and angr) cannot directly handle this;

[0005] • The control logic and data structures are heavily intertwined and lack symbolic and semantic information;

[0006] • Highly dependent on context and physical interaction (I / O).

[0007] Especially when CODESYS is widely used by 250+ global manufacturers, but its file format, symbol table, and operating specifications are not publicly available, the inability to automatically understand the structure, function, and process of PRG binary severely restricts the feasibility of tasks such as security detection, program tracing, and function restoration.

[0008] Due to these difficulties, current PLC binary analysis is still in a "semi-manual" stage, characterized by high workload, reliance on experience, and low efficiency, lacking a systematic automation method.

[0009] Therefore, this application is proposed to address the problems existing in the binary analysis of PLCs in the prior art. Summary of the Invention

[0010] The main purpose of this application is to provide a method and apparatus for reverse analysis of PLC programs to solve the above-mentioned problems and achieve the technical effect of automated reverse analysis of PLC binary files.

[0011] To achieve the above objectives, the first aspect of this application proposes a reverse analysis method for PLC programs, applied to the CODESYS platform, to realize systematic reverse analysis of industrial PLC compiler programs. The method includes:

[0012] Obtain the file to be processed, wherein the file to be processed is a PLC compiler binary file;

[0013] The file to be processed is subjected to structured parsing to obtain program entry address information and memory initialization information;

[0014] The file to be processed is subjected to subroutine identification processing based on the program entry address information and memory initialization information to obtain program flow feature data, wherein the program flow feature data is feature data used to represent the program control flow.

[0015] The program flow feature data is processed based on library function signatures to obtain standard function block data;

[0016] The program flow feature data is processed to extract parameters, thereby obtaining control behavior parameter data;

[0017] The program entry address information, memory initialization information, program flow characteristic data, standard function block data, and control behavior parameter data are visualized and modeled to obtain reverse analysis result data.

[0018] Furthermore, based on the program entry address information and memory initialization information, the file to be processed is subjected to subroutine identification processing to obtain program flow feature data, including:

[0019] The file to be processed is subjected to identification processing based on function boundaries and register call range to obtain function unit data, wherein the function unit data is data used to represent all function units in the file to be processed;

[0020] The function unit data is subjected to a first program flow analysis based on control flow reconstruction to obtain first program flow feature data, wherein the first program flow feature data is data used to represent the control flow relationship diagram in the file to be processed;

[0021] The function unit data is subjected to a second program flow analysis based on physical interaction behavior extraction to obtain second program flow feature data, wherein the second program flow feature data is feature data used to represent physical device interaction;

[0022] The program flow feature data is determined based on the first program flow feature data and the second program flow feature data.

[0023] Furthermore, the function unit data is subjected to a first program flow analysis based on control flow reconstruction to obtain first program flow feature data, including:

[0024] The function unit data is subjected to symbolic execution-based jump relationship identification processing to obtain jump relationship feature data, wherein the jump relationship feature data is feature data used to represent the pass and call target address of register and / or stack variables;

[0025] The function unit data and the jump relationship feature data are subjected to dynamic jump path generation processing to obtain the first program flow feature data.

[0026] Furthermore, the function unit data is subjected to a second program flow analysis based on physical interaction behavior extraction to obtain second program flow feature data, including:

[0027] The function unit data is processed by extracting the mapping relationship based on TRG mapping to obtain I / O address mapping relationship data;

[0028] The function unit data is extracted based on memory access operations to obtain an access instruction sequence;

[0029] The second program flow feature data is obtained by comparing the access instruction sequence with the I / O address mapping data.

[0030] Furthermore, the program flow feature data is subjected to library function signature-based identification processing to obtain standard function block data, including:

[0031] The program flow feature data is processed by function unit extraction to obtain function unit data;

[0032] The function unit data is matched based on function signatures in a preset function signature library to obtain library functions;

[0033] The function unit data is labeled with the library functions to obtain standard function block data.

[0034] Furthermore, the program flow feature data is processed to extract parameters, resulting in control behavior parameter data including:

[0035] The program flow feature data is processed to identify function execution symbols, thereby obtaining function execution symbols;

[0036] The function execution symbol is executed to obtain the position data of the passed parameters;

[0037] The parameter transmission path is modeled on the transmission parameter location data to obtain the control behavior parameter data.

[0038] Furthermore, the program entry address information, memory initialization information, program flow characteristic data, standard function block data, and control behavior parameter data are subjected to visual modeling processing to obtain reverse analysis result data, including:

[0039] The program entry address information, memory initialization information, program flow feature data, standard function block data, and control behavior parameter data are processed to generate a visual structure map, resulting in structure map data.

[0040] Node identification is performed on the structural map data to obtain map node data;

[0041] The node hyperlink loading process is performed on the graph node data to obtain the reverse analysis result data, wherein the reverse analysis result data is a graph representing the interactive PLC program analysis structure.

[0042] According to a second aspect of this application, a reverse analysis device for PLC programs is proposed, applied to the CODESYS platform, to achieve systematic reverse analysis of industrial PLC compiler programs. The device includes:

[0043] The input module is used to acquire the file to be processed, wherein the file to be processed is a PLC compiler binary file;

[0044] The structure extraction module is used to perform structured parsing on the file to be processed to obtain program entry address information and memory initialization information;

[0045] The program flow analysis module is used to perform subroutine identification processing on the file to be processed based on the program entry address information and memory initialization information to obtain program flow feature data, wherein the program flow feature data is feature data used to represent the program control flow.

[0046] The library function signature recognition module is used to perform library function signature recognition processing on the program flow feature data to obtain standard function block data.

[0047] The function parameter extraction module is used to extract parameters from the program flow feature data to obtain control behavior parameter data.

[0048] The visualization output module is used to perform visualization modeling processing on the program entry address information, memory initialization information, program flow feature data, standard function block data, and control behavior parameter data to obtain reverse analysis result data.

[0049] According to a third aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing the computer to execute the above-described reverse analysis method of the PLC program.

[0050] According to a fourth aspect of this application, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the at least one processor to perform the reverse analysis method of the PLC program described above.

[0051] The technical solutions provided by the embodiments of this application may include the following beneficial effects:

[0052] In this application, a file to be processed is obtained, wherein the file to be processed is a PLC compiler binary file; the file to be processed is subjected to structured parsing processing to obtain program entry address information and memory initialization information; the file to be processed is subjected to subroutine identification processing based on the program entry address information and memory initialization information to obtain program flow feature data, wherein the program flow feature data is feature data used to represent the program control flow; the program flow feature data is subjected to library function signature-based identification processing to obtain standard function block data; the program flow feature data is subjected to parameter extraction processing to obtain control behavior parameter data; the program entry address information, memory initialization information, program flow feature data, standard function block data, and control behavior parameter data are subjected to visualization modeling processing to obtain reverse analysis result data. By performing binary structured parsing, control flowchart reconstruction, physical interaction behavior recognition, fingerprinting of industrial control function blocks, and extraction and behavioral modeling of program logic parameters from the compiled PLC binary file, all identified function structures, function call logic relationships, I / O access annotation information, and parameter configurations are uniformly transmitted to a visualization module to generate an interactive graphical structure, completing the reverse analysis of the PLC program. This achieves automated and structured control program reverse reconstruction capabilities. Attached Figure Description

[0053] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application. In the drawings:

[0054] Figure 1 A flowchart illustrating a reverse analysis method for a PLC program provided in this application;

[0055] Figure 2 A flowchart illustrating a reverse analysis method for a PLC program provided in this application;

[0056] Figure 3 A schematic diagram of a reverse analysis device for a PLC program provided in this application. Detailed Implementation

[0057] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0058] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0059] In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing this application and its embodiments, and are not intended to limit the indicated device, element, or component to having a specific orientation, or to be constructed and operated in a specific orientation.

[0060] Furthermore, in addition to indicating location or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in some cases to indicate a certain dependency or connection relationship. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0061] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linked," and "socketing" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral structure; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0062] Terminology Explanation

[0063] A PLC is an embedded real-time automatic control device, typically composed of a microcontroller, I / O modules, storage components, input / output interfaces, and a communication network. It is programmed according to the logic language specified in IEC 61131-3 to control switching devices, sensors, and actuators in industrial processes.

[0064] CODESYS is a general-purpose PLC programming development environment compliant with the IEC 61131-3 standard. It is a mainstream hardware-independent industrial control programming platform widely used by hundreds of equipment manufacturers worldwide. CODESYS aims to provide PLC manufacturers with a unified language development environment, with each manufacturer using "TRG files" to ensure hardware compatibility.

[0065] PRG is a binary file compiled by CODESYS IDE for a specific PLC target platform. It contains user-defined periodic control logic, library function calls, I / O read and write, etc. It is the final control program form executed by the PLC device and has a high degree of platform dependence. Its structure is not a standard format, but a closed and dedicated one.

[0066] The scan cycle is a periodic, cyclical execution logic used by the PLC, consisting of three fixed steps: 1) reading input; 2) executing control logic; and 3) updating output. This cycle is the fundamental operating mechanism of the PLC control flow, reflecting its significantly different execution semantics compared to traditional desktop programs.

[0067] In the existing technology, the following are some related technical solutions for PLC control logic analysis and reverse engineering:

[0068] Manual reverse engineering (symbol annotation-assembly analysis) involves extracting PLC binary files such as PRGs and using disassemblers like IDA Pro and Ghidra to understand the assembly code line by line. The main control flow is deduced through a complex manual process of "locating the entry point -> analyzing call relationships -> checking global variables -> outlining I / O access -> function judgment." This approach is highly experience-dependent, inefficient, difficult to scale or automate, and has poor repeatability.

[0069] PLC source code comparative analysis based on AST / symbolic recovery (such as ICSREF) uses a white-box approach to build structures such as the "Abstract Syntax Tree" (AST) of control logic for high-level semantic reconstruction. This approach constructs command-level semantic templates based on specific PLC IDE symbol files. Utilizing a static control logic instruction matching mechanism, it infers the one-to-one correspondence between binary code and modules in the IDE, capable of partially reconstructing components such as logic starting points, function calls, and timer variables. However, this approach heavily relies on external symbols and compilation metadata from the IDE; it is difficult to generalize to other vendors or platforms; and it is not suitable for the closed, general-purpose CODESYS platform.

[0070] Attempts to adapt general binary analysis frameworks (such as angr + template matching) involve building loader support or hook patches at the software layer to allow the loading of special binaries (such as PRG, S7, BIN, etc.) that are "opaque to peripherals" during execution. For example, "symbolic execution injection patches" for specific devices allow angr to accept non-standard format files and dynamically monitor I / O semantics generation and function jump chains during analysis, thereby supporting facility-specific CFG construction and data flow tracing. However, this approach suffers from high loader adaptation costs, a lack of optimization features in the PLC compilation process leading to difficulties in jump relationship analysis, and significant platform differences in I / O module configuration making adaptation challenging.

[0071] Therefore, the existing reverse engineering techniques for PLCs have the following characteristics: most of the techniques are implemented in a point-by-point manner, rely on manual analysis, lack platform universality and automated design; they focus on a certain type of platform (such as Siemens, BECKHOFF, etc.) and lack the scalability to be applied to a general framework for various manufacturers (such as CODESYS).

[0072] To address the aforementioned problems in existing PLC reverse engineering techniques, this application proposes a PLC program reverse engineering method applied to the CODESYS platform to achieve systematic analysis of industrial PLC compiler programs. Figure 1 A flowchart of a reverse analysis method for a PLC program provided in this application is shown below. Figure 1 As shown, the method includes the following steps:

[0073] S101: Obtain the file to be processed;

[0074] The file to be processed is a PLC compiler binary file; this application is applied to the CODESYS platform, and the .PRG binary file generated by CODESYS is used as input.

[0075] S102: Perform structured parsing on the file to be processed to obtain program entry address information and memory initialization information;

[0076] The file to be processed is subjected to structured parsing. Furthermore, the file header and paragraphs of the file to be processed are decoded. The paragraphs include function segments and global variable segments, and the program entry address and stack initialization information are extracted.

[0077] In this embodiment, by parsing and extracting the static Header structure, function segments, global variable segments, and stack initialization information of the file to be processed, subroutine segmentation, global variable identification, and module entry point determination in the case of no symbol table are realized. This method is applicable to multiple versions of CODESYS and their different target platforms, thereby achieving the technical effect of improving versatility and compatibility.

[0078] S103: Based on the program entry address information and memory initialization information, perform subroutine identification processing on the file to be processed to obtain program flow feature data;

[0079] Program flow feature data refers to the characteristic data used to represent the program control flow. After parsing the above file and extracting the program entry address and stack initialization information, subroutine identification and program flow analysis are performed on the file to be processed. The program flow analysis includes two parallel analyses: control flow graph reconstruction and I / O address identification, thus realizing the analysis of the program flow.

[0080] In some optional embodiments of this application, a method for reverse analysis of a PLC program is proposed. Figure 2 A flowchart of a reverse analysis method for a PLC program provided in this application is shown below. Figure 2 As shown, the method includes the following steps:

[0081] S201: Perform function boundary and register call range identification processing on the file to be processed to obtain function unit data;

[0082] Function unit data is data used to represent all function units in the file to be processed;

[0083] Identify the boundaries of all subroutines or functions in the file to be processed. Define the function range by tracing registers (such as R12) and identifying assembly termination instructions (such as LDMDB or BX LR). The identified logical units are clearly defined, that is, all function units in the file to be processed are determined.

[0084] S202: Perform first program flow analysis and processing on the function unit data based on control flow reconstruction to obtain first program flow feature data;

[0085] The first program flow feature data is data used to represent the control flow relationship diagram in the file to be processed;

[0086] In some optional embodiments of this application, a reverse analysis method for PLC programs is proposed to reconstruct the control flowchart of a PLC program. This method includes:

[0087] The function unit data is subjected to symbolic execution-based jump relationship identification processing to obtain jump relationship feature data, wherein the jump relationship feature data is feature data used to represent the target address of the transfer and call of register and / or stack variables; the function unit data and jump relationship feature data are subjected to dynamic jump path generation processing to obtain the first program flow feature data.

[0088] Symbolic execution techniques are used to recover (e.g., R12, SP, etc.) the pass and call target addresses of registers or stack variables; all forms of indirect jump paths are dynamically generated, a complete control flow graph is constructed, and static structure and dynamic jump simulation are integrated to generate a control flow graph (CFG) as described above, which is the first program flow characteristic data.

[0089] S203: Perform second program flow analysis and processing on the function unit data based on physical interaction behavior extraction to obtain second program flow feature data;

[0090] The second program flow feature data is feature data used to represent the interaction of physical devices;

[0091] In some optional embodiments of this application, a reverse analysis method for PLC programs is proposed to identify I / O addresses in PLC programs. The method includes:

[0092] The function unit data is processed by extracting the mapping relationship based on TRG mapping to obtain I / O address mapping relationship data; the function unit data is processed by extracting the memory access operation to obtain the access instruction sequence; the access instruction sequence is compared with the I / O address mapping relationship data to obtain the second program flow feature data.

[0093] The .TRG file generated by the CODESYS IDE is parsed, and the I / O address mapping is restored through decoding and inverse XOR masking to recover the real device I / O address. This mapping is then compared with all memory access operations in the program to identify which code interacts with the physical device. Semantic annotation is performed on all read and write behaviors that "interact with the real device" in the program logic to obtain the aforementioned second program flow feature data.

[0094] S204: Determine the program flow characteristic data based on the first program flow characteristic data and the second program flow characteristic data.

[0095] S104: Perform recognition processing based on library function signatures on the program flow feature data to obtain standard function block data;

[0096] In some optional embodiments of this application, a reverse analysis method for PLC programs is proposed to identify whether a function is a standard function block. The method includes:

[0097] The program flow feature data is processed by extracting function units to obtain function unit data; the function unit data is then matched based on function signatures in a preset function signature library to obtain library functions; and the function unit data is then labeled with functions based on the library functions to obtain standard function block data.

[0098] In an optional embodiment of this application, the PLC control logic uses a large number of dedicated modules from standard libraries or industrial scenario libraries, such as REAL_ADD, PID_REAL, TON, GE, SEL, etc. A function signature library is established by extracting feature digests (Hash code, OpSeq, Entropy distribution, etc.) of assembly instruction sequences from known PLC standard function sets, serving as the preset function signature library in the PLC reverse engineering system. Through reverse matching of instructions within the PRG, the function signature hash is calculated using the constructed fingerprint library to identify the PLC standard library functions corresponding to the function units in the file to be processed. Based on these PLC standard library functions, the corresponding function units are functionally marked to obtain standard function block data.

[0099] S105: Perform parameter extraction processing on the program flow feature data to obtain control behavior parameter data;

[0100] In some optional embodiments of this application, a reverse analysis method for PLC programs is proposed to extract function parameters. This method includes:

[0101] The program flow feature data is processed by function execution symbol recognition to obtain function execution symbols; the function execution symbols are then executed to obtain parameter passing location data; and the parameter passing location data is then processed by parameter passing path modeling to obtain control behavior parameter data.

[0102] Symbolic inference operations are performed on the identified functions to trace the stack variable and initialization parameter push behavior, thereby modeling and extracting the parameter propagation path in the control logic. Furthermore, the function units undergo program logic parameter extraction processing based on a combination of static data segment analysis, MOV RX,#value scanning extraction in the program initialization region, and STR / POP / STMDB high-frequency write point tracking in the program execution path. Key parameter values ​​are extracted, and a modeling graph of the control function's execution behavior is constructed to obtain control behavior parameter data.

[0103] S106: Visualize and model the program entry address information, memory initialization information, program flow characteristic data, standard function block data, and control behavior parameter data to obtain reverse analysis results data.

[0104] In some optional embodiments of this application, a method for reverse analysis of PLC programs is proposed to achieve visualized output of the reverse analysis results of PLC programs. This method includes:

[0105] The program entry address information, memory initialization information, program flow characteristic data, standard function block data, and control behavior parameter data are processed to generate a visual structure map, resulting in structure map data. Node identification is performed on the structure map data to obtain map node data. Node hyperlink loading is performed on the map node data to obtain reverse analysis result data. The reverse analysis result data is used to represent the interactive PLC program analysis structure map.

[0106] After the PLC program reverse engineering in steps S101 to S105, the following data is obtained: control call diagram, I / O interaction node diagram, function parameter table, and readable disassembled logic. These are then visualized to generate a structure diagram. The structure diagram is then loaded via hyperlinks to obtain the reverse engineering results. Users can access detailed analysis pages for each function by clicking on nodes, enabling diagram browsing and sample comparison. Annotated results can be exported in JSON / XML format. Furthermore, an execution interface for patching and overwriting some functions is reserved to facilitate subsequent extended analysis.

[0107] In another optional embodiment of this application, a PLC program reverse engineering method is provided, comprising:

[0108] The system loads the user-input PLC compiled binary file (.PRG format), decodes its header and paragraphs to extract the main program's entry point, and locates the memory region used for initialization for subsequent initialization execution. Based on this, the system identifies the boundaries of all subroutines or functions, defining function ranges through register tracing (e.g., R12) and assembly termination instructions (e.g., LDMDB or BX LR). After identification, the results are input into the Control Flow Chart (CFG) to construct the flow, integrating static structure and dynamic jump simulation to generate an accurate structure diagram. Simultaneously, the angr engine is called to execute stack initialization code to extract the function pointer table and runtime call entry points. Subsequently, the analysis process uses a pre-built fingerprint library to calculate function signature hash comparisons to identify PLC standard library functions and mark their industry-standard functions. In the parallel path, the system also loads the corresponding .TRG file, decodes its XOR mask and address range, recovers the real device I / O addresses, and compares this mapping with all memory access operations in the program to identify which code interacts with the physical device. The system further performs symbolic inference operations on the identified functions, tracing stack variables and initialization parameter push behavior to model and extract parameter propagation paths in the control logic. Ultimately, the entire process outputs a complete set of analysis results and structural representations, including a control call graph, I / O interaction node graph, function parameter table, and readable disassembled logic. The system also uses an SVG visualization component to generate a structural graph. Users can click on nodes to access detailed analysis pages for each function, enabling graph browsing and sample comparison. Annotated results can be exported in JSON / XML format. An execution interface for patching and overwriting some functions is also provided for subsequent extended analysis.

[0109] In another optional embodiment of this application, an example of reverse engineering a PLC program using the method of this application is provided.

[0110] Example 1: Automatic structured parsing of CODESYS V2.3 PRG files

[0111] A power control system uses the integrated CODESYS V2.3 platform to develop PLC control logic. The logic is designed in ST language, compiled into a .PRG file by the IDE, and then distributed to a WAGO PLC device. The goal is to automatically reconstruct the control logic from this .PRG file without requiring the device or source code, and identify its safety attributes. The analysis process is as follows:

[0112] 1. Input files: Upload the .PRG file and its corresponding .TRG mapping table;

[0113] 2. Structure extraction:

[0114] Quickly identify the main entry point (e.g., address 0x48);

[0115] Extract subroutines (identifying 28 functions in total, including "MAIN", "INIT", "VISU", "_Bool_AND", etc.);

[0116] 3. Control Flowchart Reconstruction:

[0117] Automatically establish control flow (CFG), constructing dependencies for 82 jump edges and 71 basic code blocks;

[0118] 4. I / O address identification:

[0119] Restore the mapping width and mark the output address area as 0x2C00-0x2C2F;

[0120] Successfully marked the STR command for reading input signals (such as switch signals) and controlling the DO relay;

[0121] 5. Library function identification:

[0122] Successfully identified REAL_ADD, TON, GE, SEL, and PID control logic;

[0123] 6. Visualization results:

[0124] Generate call graphs and jump flowcharts (Graphviz format);

[0125] Outputs an SVG link file, allowing for interactive inspection of function jumps within the browser.

[0126] Based on this method, automatic identification of complete subroutine structures is achieved; identification of I / O behavior within all functions is achieved; shared library functions among multiple PLC samples can be analyzed; and unauthorized I / O write operations or code retention in Simulated environments can be audited.

[0127] Example 2: Logic Audit Dump in PLC Attack Forensics

[0128] In an industrial water pump control scenario, the equipment exhibited abnormal start / stop and no action signals during operation. Suspecting that the PLC program had been replaced and hidden logic injected, reverse engineering of the PLC program was performed. The analysis process is as follows:

[0129] 1. Unpack the obtained PLC archive file to obtain the .PRG file;

[0130] 2. Analyze .PRG files using the method of this invention;

[0131] 3. A new user-defined function named _ANON_SUB_2B0 was detected, which is called very infrequently;

[0132] 4. After analyzing the call point, it was found that it was only triggered by the embedded condition of MAIN_LOOP and was executed when the specific input DI[5]=1;

[0133] 5. The function contains two STR operations that enable the outputs DO[1] and DO[6] for a long time, which are not recorded in the original process document;

[0134] 6. It is inferred that this is malicious code injection, controlling the startup logic to bypass the condition mechanism.

[0135] Based on the method of this application, the hidden subroutines are automatically located, the potential code dependency graph is analyzed, and the abnormal paths are identified, providing a chain of evidence for restoring the source code logic and testing.

[0136] Example 3: Control function parameter extraction supports security auditing and simulation

[0137] A rail transit signaling company needs to extract parameters from the PID closed-loop controller in its PLC to assess whether the current oscillation control is caused by abnormal parameters. The analysis process is as follows:

[0138] 1. Use this system to perform structured analysis on .PRG files;

[0139] 2. Locate the PID function used, and automatically obtain the calling statement from the disassembly, which is located at offset 118 of the subroutine "CTRL_LOOP_7";

[0140] 3. Mark the data segment with MOV R0,#Kp_FloatValue;

[0141] 4. During symbolic execution, the floating-point values ​​at the corresponding addresses were identified as Kp = 4.25, Ki = 2.6, and Kd = 0.11;

[0142] 5. Export the value and process it in the simulation environment to complete the response time simulation.

[0143] Based on the method of this application, the analyzed and identified parameters are consistent with the values ​​measured manually using a debugger, reducing analysis time and improving the accuracy of parameter identification.

[0144] In some optional embodiments of this application, a reverse analysis device for PLC programs is proposed, applied to the CODESYS platform, to achieve systematic reverse analysis of industrial PLC compiler programs. Figure 3 A schematic diagram of a reverse analysis device for a PLC program provided in this application is shown below. Figure 3 As shown, the device includes:

[0145] Input module 31 is used to obtain the file to be processed, wherein the file to be processed is a binary file of the PLC compiler;

[0146] The structure extraction module 32 is used to perform structured parsing on the file to be processed, and obtain program entry address information and memory initialization information;

[0147] The program flow analysis module 33 is used to perform subroutine identification processing on the file to be processed based on the program entry address information and memory initialization information to obtain program flow feature data, wherein the program flow feature data is feature data used to represent the program control flow.

[0148] The library function signature recognition module 34 is used to perform library function signature recognition processing on program flow feature data to obtain standard function block data.

[0149] The function parameter extraction module 35 is used to extract parameters from the program flow feature data to obtain control behavior parameter data.

[0150] The visualization output module 36 is used to perform visualization modeling processing on program entry address information, memory initialization information, program flow characteristic data, standard function block data and control behavior parameter data to obtain reverse analysis result data.

[0151] The specific methods of execution of each unit in the above embodiments have been described in detail in the embodiments of the method, and will not be elaborated here.

[0152] In summary, this application involves: obtaining a file to be processed, wherein the file to be processed is a PLC compiler binary file; performing structured parsing processing on the file to be processed to obtain program entry address information and memory initialization information; performing subroutine identification processing on the file to be processed based on the program entry address information and memory initialization information to obtain program flow feature data, wherein the program flow feature data is feature data used to represent the program control flow; performing library function signature-based identification processing on the program flow feature data to obtain standard function block data; performing parameter extraction processing on the program flow feature data to obtain control behavior parameter data; and performing visualization modeling processing on the program entry address information, memory initialization information, program flow feature data, standard function block data, and control behavior parameter data to obtain reverse analysis result data. By performing binary structured parsing, control flowchart reconstruction, physical interaction behavior recognition, fingerprinting of industrial control function blocks, and extraction and behavioral modeling of program logic parameters from the compiled PLC binary file, all identified function structures, function call logic relationships, I / O access annotation information, and parameter configurations are uniformly transmitted to a visualization module to generate an interactive graphical structure, completing the reverse analysis of the PLC program. This achieves automated and structured control program reverse reconstruction capabilities.

[0153] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0154] Obviously, those skilled in the art should understand that the various units or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps into a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0155] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for reverse engineering a PLC program, characterized in that, The method, applied to the CODESYS platform, enables system analysis of industrial PLC compiler reverse engineering, and includes: Obtain the file to be processed, wherein the file to be processed is a PLC compiler binary file; The file to be processed is subjected to structured parsing to obtain program entry address information and memory initialization information; The file to be processed is subjected to subroutine identification processing based on the program entry address information and memory initialization information to obtain program flow feature data. The program flow feature data represents the program control flow and includes: identifying the file to be processed based on function boundaries and register call ranges to obtain function unit data, which represents all function units in the file to be processed; identifying the boundaries of all subroutines or functions in the file to be processed, defining the function range through register tracing and assembly termination instruction identification, and determining all function units in the file to be processed. The function unit data is subjected to a first program flow analysis based on control flow reconstruction to obtain first program flow feature data, wherein the first program flow feature data is data used to represent the control flow relationship diagram in the file to be processed; the function unit data is subjected to a second program flow analysis based on physical interaction behavior extraction to obtain second program flow feature data, wherein the second program flow feature data is feature data used to represent physical device interaction; the program flow feature data is determined based on the first program flow feature data and the second program flow feature data. The program flow feature data is processed based on library function signatures to obtain standard function block data; The program flow feature data is processed to extract parameters, thereby obtaining control behavior parameter data; The program entry address information, memory initialization information, program flow characteristic data, standard function block data, and control behavior parameter data are visualized and modeled to obtain reverse analysis result data.

2. The reverse analysis method according to claim 1, characterized in that, The function unit data is subjected to a first program flow analysis based on control flow reconstruction to obtain first program flow feature data, including: The function unit data is subjected to symbolic execution-based jump relationship identification processing to obtain jump relationship feature data, wherein the jump relationship feature data is feature data used to represent the pass and call target address of register and / or stack variables; The function unit data and the jump relationship feature data are subjected to dynamic jump path generation processing to obtain the first program flow feature data.

3. The reverse analysis method according to claim 1, characterized in that, The function unit data is subjected to a second program flow analysis based on physical interaction behavior extraction to obtain second program flow feature data, including: The function unit data is processed by extracting the mapping relationship based on TRG mapping to obtain I / O address mapping relationship data; The function unit data is extracted based on memory access operations to obtain an access instruction sequence; The second program flow feature data is obtained by comparing the access instruction sequence with the I / O address mapping data.

4. The reverse analysis method according to claim 1, characterized in that, The program flow feature data is processed based on library function signatures to obtain standard function block data, including: The program flow feature data is processed by function unit extraction to obtain function unit data; The function unit data is matched based on function signatures in a preset function signature library to obtain library functions; The function unit data is labeled with the library functions to obtain standard function block data.

5. The reverse analysis method according to claim 1, characterized in that, The program flow feature data is processed to extract parameters, resulting in control behavior parameter data including: The program flow feature data is processed to identify function execution symbols, thereby obtaining function execution symbols; The function execution symbol is executed to obtain the position data of the passed parameters; The parameter transmission path is modeled on the transmission parameter location data to obtain the control behavior parameter data.

6. The reverse analysis method according to claim 1, characterized in that, The program entry address information, memory initialization information, program flow characteristic data, standard function block data, and control behavior parameter data are visualized and modeled to obtain reverse analysis results, including: The program entry address information, memory initialization information, program flow feature data, standard function block data, and control behavior parameter data are processed to generate a visual structure map, resulting in structure map data. Node identification is performed on the structural map data to obtain map node data; The node hyperlink loading process is performed on the graph node data to obtain the reverse analysis result data, wherein the reverse analysis result data is a graph representing the interactive PLC program analysis structure.

7. A reverse analysis device for PLC programs, characterized in that, An apparatus for reverse engineering industrial PLC compilers, applied to the CODESYS platform, includes: The input module is used to acquire the file to be processed, wherein the file to be processed is a PLC compiler binary file; The structure extraction module is used to perform structured parsing on the file to be processed to obtain program entry address information and memory initialization information; The program flow analysis module is used to perform subroutine identification processing on the file to be processed based on the program entry address information and memory initialization information to obtain program flow feature data. The program flow feature data represents the program control flow and includes: identifying the file to be processed based on function boundaries and register call ranges to obtain function unit data, which represents all function units in the file to be processed; identifying the boundaries of all subroutines or functions in the file to be processed, defining the function range through register tracing and assembly termination instruction identification, and determining all function units in the file to be processed. The function unit data is subjected to a first program flow analysis based on control flow reconstruction to obtain first program flow feature data, wherein the first program flow feature data is data used to represent the control flow relationship diagram in the file to be processed; the function unit data is subjected to a second program flow analysis based on physical interaction behavior extraction to obtain second program flow feature data, wherein the second program flow feature data is feature data used to represent physical device interaction; the program flow feature data is determined based on the first program flow feature data and the second program flow feature data. The library function signature recognition module is used to perform library function signature recognition processing on the program flow feature data to obtain standard function block data. The function parameter extraction module is used to extract parameters from the program flow feature data to obtain control behavior parameter data. The visualization output module is used to perform visualization modeling processing on the program entry address information, memory initialization information, program flow feature data, standard function block data, and control behavior parameter data to obtain reverse analysis result data.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the reverse analysis method of the PLC program according to any one of claims 1-6.

9. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the at least one processor to perform the reverse analysis method of the PLC program according to any one of claims 1-6.

Images