momalab / icsref Goto Github PK
View Code? Open in Web Editor NEWA tool for reverse engineering industrial control systems binaries.
License: MIT License
A tool for reverse engineering industrial control systems binaries.
License: MIT License
I met a KeyError while running analyze 2.PRG, and I found many samples has the same error. I wonder how to deal with this problem, it seems like an error of finding the function call.
The error and traceback is here
reversing@icsref:$ analyze /home/ye/ICSREF/samples/PRG_binaries/GitHub/2.PRG
Working on /home/ye/ICSREF/samples/PRG_binaries/GitHub/2.PRG.
DONE: Hexdump generation
DONE: Header analysis
DONE: String analysis
DONE: I/O analysis
DONE: Find function boundaries
DONE: Function disassembly
DONE: Find dynamic calls
DONE: Find static calls
Traceback (most recent call last):
File "/home/ye/.virtualenvs/icsref/local/lib/python2.7/site-packages/cmd2.py", line 2476, in onecmd_plus_hooks
stop = self.onecmd(statement)
File "/home/ye/.virtualenvs/icsref/local/lib/python2.7/site-packages/cmd2.py", line 2675, in onecmd
stop = func(statement)
File "/home/ye/ICSREF/icsref/icsref.py", line 75, in do_analyze
self.prg = Program(filename)
File "/home/ye/ICSREF/icsref/PRG_analysis.py", line 107, in init
self.__find_libcalls()
File "/home/ye/ICSREF/icsref/PRG_analysis.py", line 281, in __find_libcalls
lib_name = self.libs_dict[jump]
KeyError: 21676
EXCEPTION of type 'KeyError' occurred with message: '21676'
To enable full traceback, run the following command: 'set debug true'`
hello,can you help me ? I want to know your codesys 2.3's specific version, because i can not open your *.pro files successfully. I get error "Description file for module 'Module.root' not found".Thanks
Hi! I want to know it can be use to MC7 bytecode? If not, what do I need to do? Can you help me.
Hi @tkeliris,
When I was trying to reproduce things you did in your demo video, I find a problem in hashmatch stage:
Environment: Clean Ubuntu 16.04 and 18.04
reversing@icsref:$ analyze samples/PRG_binaries/In-house/TE.PRG
Working on samples/PRG_binaries/In-house/TE.PRG.
DONE: Hexdump generation
DONE: Header analysis
DONE: String analysis
DONE: I/O analysis
DONE: Find function boundaries
DONE: Function disassembly
DONE: Find dynamic calls
DONE: Find static calls
DONE: Call offsets renaming
Analysis of TE finished.
Total analysis time: 25.6079239845
reversing@icsref:$ !ls results/TE
TE_init_analysis.dat
reversing@icsref:$ hashmatch
Hashmatch module (MAY HAVE) found function maybe_DERIVATIVE_INIT at 0x1150
Hashmatch module (MAY HAVE) found function maybe_INTEGRAL_INIT at 0x15d4
reversing@icsref:$ pidargs
No PID_FIXCYCLE functions identified. Cannot extract arguments.
reversing@icsref:$ graphbuilder
Cleanup complete
Generated graph_TE.svg
Even I could build the CFG, the CFG itself was not 100% identical with the picture listed on the paper.
I was not sure how this happened, since everything is okay in your demo video.
Any help will be appreciated!
I built an icsref environment on Ubuntu desktop 16.04 lts and all went good. The problem is that running analyze on a real Wago 750-881 prg file never end. System uptime is more than one day with this result log:
/ _/ ___/ // __ / / /
/ // / _ / // / / / /
/ // / / / , / // /
//_//// |/_____//
author: Tasos Keliris (@koukouviou)
Type if you need a nudge
reversing@icsref:$ history
reversing@icsref:$ analize /home/clientsam/ICSREF/PLC/default.prg
*** Unknown syntax: analize /home/clientsam/ICSREF/PLC/default.prg
reversing@icsref:$ analyze /home/clientsam/ICSREF/PLC/default.prg
Working on /home/clientsam/ICSREF/PLC/default.prg.
DONE: Hexdump generation
DONE: Header analysis
DONE: String analysis
DONE: I/O analysis
DONE: Find function boundaries
(and nothing more)
Given command was: analyze /home/clientsam/ICSREF/PLC/default.prg
default.prg is coming from wago plc memory by ftp get.
It seems that program is locked in an endless loop, and top reveals CPU is 100% most of the time running python command.
Can you give any suggestion?
Many thanks
Hi! I'm wondering how would you approach binaries with targets memory layout being dynamically allocated?
I've been playing around trying to reverse some HMI+PLC -type of devices.
To be more exact, Exor eTOP50x-series devices. These utilize ARM core on SoC.
They run Exor's own "jMobile" generated project files to handle the HMI side and majority of anything else, anything not UI-related, are plain old CODESYS V2.3 binaries. Oh, and all this mess is running on top of WinCE6.
Those CODESYS files are compiled as armv7 binaries but only way to make any sense of the binaries is to manually identify allocated memory layout (codesys only tells that the memory is automatically allocated and nothing more). And most of the things ICSREF automatically identifies (such as function boundaries & header information) are there and mostly in such a way one would expect... but header addresses don't make any sense and those strings used as identifiers are different than the ones used in the PRG_analysis.py ... I made some progress by manually identifying forementioned addresses & strings... And by modifying the PRG_analysis.py accordingly, but never got the analysis to complete successfully.. most far I've gotten it to run was up to 'find static libraries' -routine... nevertheless, the generaterd work-in-progress HEX proved to be very useful.
Anyway, I believe this situation / class of devices are out of scope for ICSREF anyway - at least for now? And since I got satisfactory results anyway, this is query is mostly just out of curiosity.
Anyway, very impressive & interesting work! I sure hope this project has a future!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.