Nan tras yo nan Ninja Endistriyèl: ki jan yo te rache yon PLC nan Positive Hack Days 9

Nan dènye PHDays 9 nou te fè yon konpetisyon pou pirate yon plant ponpe gaz - konpetisyon Endistriyèl Ninja. Te gen twa kanpe sou sit la ak paramèt sekirite diferan (Pa gen Sekirite, Sekirite ki ba, Sekirite segondè), imite menm pwosesis endistriyèl la: lè anba presyon te ponpe nan yon balon (ak Lè sa a, lage).

Malgre diferan paramèt sekirite yo, konpozisyon pyès ki nan konpitè kanpe yo te menm bagay la tou: Siemens Simatic PLC S7-300 seri; bouton deflasyon ijans ak aparèy pou mezire presyon (konekte ak PLC entrain dijital (DI)); tiyo opere pou enflasyon ak deflasyon lè (konekte ak rezilta dijital PLC a (DO)) - gade figi ki anba a.

PLC a, tou depann de lekti presyon yo ak an akò ak pwogram li yo, te pran yon desizyon pou degonfle oswa gonfle boul la (louvri epi fèmen tiyo korespondan yo). Sepandan, tout kanpe te gen yon mòd kontwòl manyèl, ki te fè li posib kontwole eta yo nan tiyo yo san okenn restriksyon.

Stands yo diferan nan konpleksite nan pèmèt mòd sa a: nan kanpe la san pwoteksyon li te pi fasil fè sa, ak nan kanpe nan Sekirite Segondè li te korespondan pi difisil.

Senk nan sis pwoblèm yo te rezoud nan de jou; Patisipan an premye plas te touche 233 pwen (li te pase yon semèn ap prepare pou konpetisyon an). Twa ganyan: mwen mete - a1exdandy, II - Rubikoid, III - Ze.

Sepandan, pandan PHDays, pa youn nan patisipan yo te kapab simonte tout twa kanpe, kidonk nou te deside fè yon konpetisyon sou entènèt epi pibliye travay ki pi difisil nan kòmansman mwa jen. Patisipan yo te oblije ranpli travay la nan yon mwa, jwenn drapo a, epi dekri solisyon an an detay ak yon fason enteresan.

Anba koupe a nou pibliye yon analiz de solisyon ki pi bon nan travay la soti nan moun ki voye sou mwa a, li te jwenn pa Alexey Kovrizhnykh (a1exdandy) nan konpayi an Sekirite dijital, ki moun ki te pran XNUMXye plas nan konpetisyon an pandan PHDays. Anba a nou prezante tèks li a ak kòmantè nou yo.

Premye analiz

Se konsa, travay la te genyen yon achiv ak dosye sa yo:

• block_upload_traffic.pcapng
• DB100.bin
• sijesyon.txt

Fichye hints.txt la gen enfòmasyon ki nesesè yo ak sijesyon pou rezoud travay la. Men kontni li yo:

1. Petrovich te di m 'yè ke ou ka chaje blòk soti nan PlcSim nan Step7.
2. Siemens Simatic S7-300 seri PLC te itilize nan kanpe la.
3. PlcSim se yon Emulation PLC ki pèmèt ou kouri ak debug pwogram pou PLC Siemens S7.

Fichye DB100.bin parèt genyen blòk done DB100 PLC: 00000000: 0100 0102 6e02 0401 0206 0100 0101 0102 ....n......... 00000010: 1002 0501 0202 2002 . ..... ......... 0501: 0206 0100 0102 00000020 0102 7702 0401 0206a0100 ..w............. 0103: 0102 0 02 00000030 0501 ................ 0202: 1602 0501 0206 0100 0104 0102 00000040a7502 0401 u............... 0206: 0100 0105 0102 0 02 0501 00000050 0202............1602. 0501: 0206 0100 0106 0102 3402 4 00000060 0401 ......... & ..... 0206: 0100C0107 0102 2602 0501 0202 00000070 4 02 L : 0501 0206 0100 0108 0102a3302 0401 3 00000080 ................ 0206: 0100 0109 0102 0a 02 0501 0202 1602 .........00000090 0501a0206: 0100 010b 0102 3702 0401 0206 7 000000 ......".....F... 0b0100: 010 0102 2202c 0501 0202 4602 ..0501 000000 ..0 0206 . .. 0100c010: 0102d 3302 0401a0206 0100 3 000000 0 010 ................ 0102d0: 02 0501e 0202 1602d0501 0206 000000 ..0 ... .... 0100e010: 0102 6 02 0401 0206 0100 010 000000 ........#...... 0f0102: 1102 0501 0202 2302 0501 0206 ..0100 . ..... 000000: 0 0110 0102 3502 0401 0206 0100 0111 ......%......... 0102: 5 00000100 1202 0501 0202 2502 ..0501 .. ....& 0206: 0100 0112 00000110c0102 3302 0401 0206 ....L......

Kòm non an sijere, fichye block_upload_traffic.pcapng la gen yon pil fatra nan trafik Upload blòk nan PLC la.

Li se vo anyen ke pil fatra trafik sa a nan sit konpetisyon an pandan konferans la te yon ti kras pi difisil jwenn. Pou fè sa, li te nesesè yo konprann script la nan dosye a pwojè pou TeslaSCADA2. Soti nan li li te posib yo konprann ki kote pil fatra a ankripte lè l sèvi avèk RC4 te lokalize ak ki kle ki te bezwen yo dwe itilize dechifre li. Yo ka jwenn pil fatra nan blòk done sou sit lè l sèvi avèk kliyan pwotokòl S7 la. Pou sa mwen te itilize kliyan Demo a soti nan pake Snap7 la.

Ekstrè blòk pwosesis siyal nan yon pil fatra trafik

Gade nan sa ki nan pil fatra a, ou ka konprann ke li gen blòk pwosesis siyal OB1, FC1, FC2 ak FC3:

Blòk sa yo dwe retire. Sa a ka fè, pou egzanp, ak script sa a, li te deja konvèti trafik la soti nan fòma pcapng nan pcap:

#!/usr/bin/env python2

import struct
from scapy.all import *

packets = rdpcap('block_upload_traffic.pcap')
s7_hdr_struct = '>BBHHHHBB'
s7_hdr_sz = struct.calcsize(s7_hdr_struct)
tpkt_cotp_sz = 7
names = iter(['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin'])
buf = ''

for packet in packets:
    if packet.getlayer(IP).src == '10.0.102.11':
        tpkt_cotp_s7 = str(packet.getlayer(TCP).payload)
        if len(tpkt_cotp_s7) < tpkt_cotp_sz + s7_hdr_sz:
            continue
        s7 = tpkt_cotp_s7[tpkt_cotp_sz:]
        s7_hdr = s7[:s7_hdr_sz]
        param_sz = struct.unpack(s7_hdr_struct, s7_hdr)[4]
        s7_param = s7[12:12+param_sz]
        s7_data = s7[12+param_sz:]
        if s7_param in ('x1ex00', 'x1ex01'):  # upload
            buf += s7_data[4:]
        elif s7_param == 'x1f':
            with open(next(names), 'wb') as f:
                f.write(buf)
            buf = ''

Lè w fin egzamine blòk yo, w ap remake ke yo toujou kòmanse ak bytes 70 70 (pp). Koulye a, ou bezwen aprann kijan pou analize yo. Sijesyon plasman an sijere ke ou bezwen sèvi ak PlcSim pou sa.

Jwenn enstriksyon moun lizib nan blòk yo

Premyèman, ann eseye pwograme S7-PlcSim nan chaje plizyè blòk ak enstriksyon repete (= Q 0.0) nan li lè l sèvi avèk lojisyèl Manadjè Simatic, epi sove PLC ki te jwenn nan emulateur la nan dosye example.plc la. Lè w gade sa ki nan dosye a, ou ka fasilman detèmine kòmansman an nan blòk yo telechaje pa siyati a 70 70, ke nou dekouvri pi bonè. Anvan blòk yo, aparamman, gwosè blòk la ekri kòm yon valè ti kras-endian 4-byte.

Apre nou te resevwa enfòmasyon sou estrikti dosye plc, plan aksyon sa a te parèt pou li pwogram PLC S7:

1. Sèvi ak Manadjè Simatic, nou kreye yon estrikti blòk nan S7-PlcSim ki sanble ak sa nou te resevwa nan pil fatra a. Gwosè blòk yo dwe matche (sa a reyalize lè w ranpli blòk yo ak kantite enstriksyon ki nesesè yo) ak idantifyan yo (OB1, FC1, FC2, FC3).
2. Sove PLC a nan yon dosye.
3. Nou ranplase sa ki nan blòk yo nan dosye a ki kapab lakòz ak blòk yo soti nan pil fatra trafik la. Kòmansman blòk yo detèmine pa siyati a.
4. Nou chaje fichye a ki kapab lakòz nan S7-PlcSim epi gade sa ki nan blòk yo nan Manadjè Simatic.

Blòk yo ka ranplase, pou egzanp, ak kòd sa a:

with open('original.plc', 'rb') as f:
    plc = f.read()
blocks = []
for fname in ['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin']:
    with open(fname, 'rb') as f:
        blocks.append(f.read())

i = plc.find(b'pp')
for block in blocks:
    plc = plc[:i] + block + plc[i+len(block):]
    i = plc.find(b'pp', i + 1)

with open('target.plc', 'wb') as f:
    f.write(plc)

Alexey te pran yon chemen petèt pi difisil, men yo toujou kòrèk. Nou te sipoze ke patisipan yo ta itilize pwogram NetToPlcSim pou PlcSim te kapab kominike sou rezo a, telechaje blòk yo nan PlcSim atravè Snap7, epi telechaje blòk sa yo kòm yon pwojè nan PlcSim lè l sèvi avèk anviwònman devlopman an.

Lè w louvri fichye a ki kapab lakòz nan S7-PlcSim, ou ka li blòk yo ranplase lè l sèvi avèk Manadjè Simatic la. Fonksyon prensipal kontwòl aparèy yo anrejistre nan blòk FC1. Yon nòt patikilye se varyab #TEMP0, ki lè li limen an parèt pou mete kontwòl PLC a nan mòd manyèl ki baze sou valè memwa ti jan M2.2 ak M2.3. Fonksyon FC0 tabli valè #TEMP3.

Pou rezoud pwoblèm nan, ou bezwen analize fonksyon FC3 la epi konprann sa ki dwe fè pou li retounen yon sèl ki lojik.

Blòk pwosesis siyal PLC yo nan kanpe Sekirite Ba a nan sit konpetisyon an te ranje nan yon fason menm jan an, men yo mete valè a nan #TEMP0 varyab la, li te ase yo ekri liy lan fason Ninja mwen an nan blòk la DB1. Tcheke valè a nan yon blòk te senp epi li pa t mande pou konesans pwofon nan lang pwogramasyon blòk la. Li evidan, nan nivo Sekirite Segondè, reyalize kontwòl manyèl yo pral pi difisil epi li nesesè yo konprann sibtilite yo nan lang STL la (youn nan fason yo pwogram S7 PLC la).

Blòk ranvèse FC3

Sa ki nan blòk FC3 nan reprezantasyon STL:

      L     B#16#0
      T     #TEMP13
      T     #TEMP15
      L     P#DBX 0.0
      T     #TEMP4
      CLR   
      =     #TEMP14
M015: L     #TEMP4
      LAR1  
      OPN   DB   100
      L     DBLG
      TAR1  
      <=D   
      JC    M016
      L     DW#16#0
      T     #TEMP0
      L     #TEMP6
      L     W#16#0
      <>I   
      JC    M00d
      L     P#DBX 0.0
      LAR1  
M00d: L     B [AR1,P#0.0]
      T     #TEMP5
      L     W#16#1
      ==I   
      JC    M007
      L     #TEMP5
      L     W#16#2
      ==I   
      JC    M008
      L     #TEMP5
      L     W#16#3
      ==I   
      JC    M00f
      L     #TEMP5
      L     W#16#4
      ==I   
      JC    M00e
      L     #TEMP5
      L     W#16#5
      ==I   
      JC    M011
      L     #TEMP5
      L     W#16#6
      ==I   
      JC    M012
      JU    M010
M007: +AR1  P#1.0
      L     P#DBX 0.0
      LAR2  
      L     B [AR1,P#0.0]
      L     C#8
      *I    
      +AR2  
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M003
      JU    M001
      JU    M002
      JU    M004
M003: JU    M005
M001: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP0
      JU    M006
M002: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP1
      JU    M006
M004: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP2
      JU    M006
M00f: +AR1  P#1.0
      L     B [AR1,P#0.0]
      L     C#8
      *I    
      T     #TEMP11
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      TAR1  #TEMP4
      OPN   DB   101
      L     P#DBX 0.0
      LAR1  
      L     #TEMP11
      +AR1  
      LAR2  #TEMP9
      L     B [AR2,P#0.0]
      T     B [AR1,P#0.0]
      L     #TEMP4
      LAR1  
      JU    M006
M008: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP3
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M009
      JU    M00b
      JU    M00a
      JU    M00c
M009: JU    M005
M00b: L     #TEMP3
      T     #TEMP0
      JU    M006
M00a: L     #TEMP3
      T     #TEMP1
      JU    M006
M00c: L     #TEMP3
      T     #TEMP2
      JU    M006
M00e: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      AW    
      INVI  
      T     #TEMP12
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      OW    
      L     #TEMP12
      AW    
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #TEMP0
      L     MB   101
      T     #TEMP1
      L     MB   102
      T     #TEMP2
      L     #TEMP4
      LAR1  
      JU    M006
M011: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      -I    
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #TEMP0
      L     MB   101
      T     #TEMP1
      L     MB   102
      T     #TEMP2
      L     #TEMP4
      LAR1  
      JU    M006
M012: L     #TEMP15
      INC   1
      T     #TEMP15
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      ==I   
      JCN   M013
      JU    M014
M013: L     P#DBX 0.0
      LAR1  
      T     #TEMP4
      L     B#16#0
      T     #TEMP6
      JU    M006
M014: L     #TEMP4
      LAR1  
      L     #TEMP13
      L     L#1
      +I    
      T     #TEMP13
      JU    M006
M006: L     #TEMP0
      T     MB   100
      L     #TEMP1
      T     MB   101
      L     #TEMP2
      T     MB   102
      +AR1  P#1.0
      L     #TEMP6
      +     1
      T     #TEMP6
      JU    M005
M010: L     P#DBX 0.0
      LAR1  
      L     0
      T     #TEMP6
      TAR1  #TEMP4
M005: TAR1  #TEMP4
      CLR   
      =     #TEMP16
      L     #TEMP13
      L     L#20
      ==I   
      S     #TEMP16
      L     #TEMP15
      ==I   
      A     #TEMP16
      JC    M017
      L     #TEMP13
      L     L#20
      <I    
      S     #TEMP16
      L     #TEMP15
      ==I   
      A     #TEMP16
      JC    M018
      JU    M019
M017: SET   
      =     #TEMP14
      JU    M016
M018: CLR   
      =     #TEMP14
      JU    M016
M019: CLR   
      O     #TEMP14
      =     #RET_VAL
      JU    M015
M016: CLR   
      O     #TEMP14
      =     #RET_VAL

Kòd la byen long epi li ka sanble konplike pou yon moun ki pa abitye ak STL. Pa gen okenn pwen nan analize chak enstriksyon nan kad atik sa a enstriksyon detaye ak kapasite nan lang STL ka jwenn nan manyèl ki koresponn lan: Lis deklarasyon (STL) pou pwogramasyon S7-300 ak S7-400. Isit la mwen pral prezante kòd la menm apre pwosesis - chanje non etikèt yo ak varyab epi ajoute kòmantè ki dekri algorithm nan operasyon ak kèk konstwi lang STL. Kite m 'imedyatman sonje ke blòk la nan kesyon an gen yon machin vityèl ki egzekite kèk bytecode ki sitiye nan blòk la DB100, sa ki nan ki nou konnen. Enstriksyon machin Virtual konpoze de 1 byte nan kòd fonksyone ak byte nan agiman, yon byte pou chak agiman. Tout enstriksyon konsidere gen de agiman mwen deziyen valè yo nan kòmantè yo kòm X ak Y.

Kòd apre pwosesis]

# Инициализация различных переменных
      L     B#16#0
      T     #CHECK_N        # Счетчик успешно пройденных проверок
      T     #COUNTER_N      # Счетчик общего количества проверок
      L     P#DBX 0.0
      T     #POINTER        # Указатель на текущую инструкцию
      CLR   
      =     #PRE_RET_VAL

# Основной цикл работы интерпретатора байт-кода
LOOP: L     #POINTER
      LAR1  
      OPN   DB   100
      L     DBLG
      TAR1  
      <=D                   # Проверка выхода указателя за пределы программы
      JC    FINISH
      L     DW#16#0
      T     #REG0
      L     #TEMP6
      L     W#16#0
      <>I   
      JC    M00d
      L     P#DBX 0.0
      LAR1  

# Конструкция switch - case для обработки различных опкодов
M00d: L     B [AR1,P#0.0]
      T     #OPCODE
      L     W#16#1
      ==I   
      JC    OPCODE_1
      L     #OPCODE
      L     W#16#2
      ==I   
      JC    OPCODE_2
      L     #OPCODE
      L     W#16#3
      ==I   
      JC    OPCODE_3
      L     #OPCODE
      L     W#16#4
      ==I   
      JC    OPCODE_4
      L     #OPCODE
      L     W#16#5
      ==I   
      JC    OPCODE_5
      L     #OPCODE
      L     W#16#6
      ==I   
      JC    OPCODE_6
      JU    OPCODE_OTHER

# Обработчик опкода 01: загрузка значения из DB101[X] в регистр Y
# OP01(X, Y): REG[Y] = DB101[X]
OPCODE_1: +AR1  P#1.0
      L     P#DBX 0.0
      LAR2  
      L     B [AR1,P#0.0]   # Загрузка аргумента X (индекс в DB101)
      L     C#8
      *I    
      +AR2  
      +AR1  P#1.0
      L     B [AR1,P#0.0]   # Загрузка аргумента Y (индекс регистра)
      JL    M003            # Аналог switch - case на основе значения Y
      JU    M001            # для выбора необходимого регистра для записи.
      JU    M002            # Подобные конструкции используются и в других
      JU    M004            # операциях ниже для аналогичных целей
M003: JU    LOOPEND
M001: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG0           # Запись значения DB101[X] в REG[0]
      JU    PRE_LOOPEND
M002: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG1           # Запись значения DB101[X] в REG[1]
      JU    PRE_LOOPEND
M004: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG2           # Запись значения DB101[X] в REG[2]
      JU    PRE_LOOPEND

# Обработчик опкода 02: загрузка значения X в регистр Y
# OP02(X, Y): REG[Y] = X
OPCODE_2: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP3
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M009
      JU    M00b
      JU    M00a
      JU    M00c
M009: JU    LOOPEND
M00b: L     #TEMP3
      T     #REG0
      JU    PRE_LOOPEND
M00a: L     #TEMP3
      T     #REG1
      JU    PRE_LOOPEND
M00c: L     #TEMP3
      T     #REG2
      JU    PRE_LOOPEND

# Опкод 03 не используется в программе, поэтому пропустим его
...

# Обработчик опкода 04: сравнение регистров X и Y
# OP04(X, Y): REG[0] = 0; REG[X] = (REG[X] == REG[Y])
OPCODE_4: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7          # первый аргумент - X
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          # REG[X]
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9          # REG[X]
      LAR2  #TEMP10         # REG[Y]
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      AW    
      INVI  
      T     #TEMP12         # ~(REG[Y] & REG[X])
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      OW    
      L     #TEMP12
      AW                    # (~(REG[Y] & REG[X])) & (REG[Y] | REG[X]) - аналог проверки на равенство
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #REG0
      L     MB   101
      T     #REG1
      L     MB   102
      T     #REG2
      L     #POINTER
      LAR1  
      JU    PRE_LOOPEND

# Обработчик опкода 05: вычитание регистра Y из X
# OP05(X, Y): REG[0] = 0; REG[X] = REG[X] - REG[Y]
OPCODE_5: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          # REG[X]
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      -I                    # ACCU1 = ACCU2 - ACCU1, REG[X] - REG[Y]
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #REG0
      L     MB   101
      T     #REG1
      L     MB   102
      T     #REG2
      L     #POINTER
      LAR1  
      JU    PRE_LOOPEND

# Обработчик опкода 06: инкремент #CHECK_N при равенстве регистров X и Y
# OP06(X, Y): #CHECK_N += (1 if REG[X] == REG[Y] else 0)
OPCODE_6: L     #COUNTER_N
      INC   1
      T     #COUNTER_N
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7          #  REG[X]     
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          #  REG[X]  
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9          # REG[Y]
      LAR2  #TEMP10         # REG[X]
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      ==I   
      JCN   M013
      JU    M014
M013: L     P#DBX 0.0
      LAR1  
      T     #POINTER
      L     B#16#0
      T     #TEMP6
      JU    PRE_LOOPEND
M014: L     #POINTER
      LAR1  
# Инкремент значения #CHECK_N
      L     #CHECK_N
      L     L#1
      +I    
      T     #CHECK_N
      JU    PRE_LOOPEND

PRE_LOOPEND: L     #REG0
      T     MB   100
      L     #REG1
      T     MB   101
      L     #REG2
      T     MB   102
      +AR1  P#1.0
      L     #TEMP6
      +     1
      T     #TEMP6
      JU    LOOPEND

OPCODE_OTHER: L     P#DBX 0.0
      LAR1  
      L     0
      T     #TEMP6
      TAR1  #POINTER

LOOPEND: TAR1  #POINTER
      CLR   
      =     #TEMP16
      L     #CHECK_N
      L     L#20
      ==I   
      S     #TEMP16
      L     #COUNTER_N
      ==I   
      A     #TEMP16
# Все проверки пройдены, если #CHECK_N == #COUNTER_N == 20
      JC    GOOD
      L     #CHECK_N
      L     L#20
      <I    
      S     #TEMP16
      L     #COUNTER_N
      ==I   
      A     #TEMP16
      JC    FAIL
      JU    M019
GOOD: SET   
      =     #PRE_RET_VAL
      JU    FINISH
FAIL: CLR   
      =     #PRE_RET_VAL
      JU    FINISH
M019: CLR   
      O     #PRE_RET_VAL
      =     #RET_VAL
      JU    LOOP
FINISH: CLR   
      O     #PRE_RET_VAL
      =     #RET_VAL

Lè w gen yon lide sou enstriksyon machin vityèl yo, ann ekri yon ti demonte pou analize bytecode nan blòk DB100 la:

import string
alph = string.ascii_letters + string.digits

with open('DB100.bin', 'rb') as f:
    m = f.read()

pc = 0

while pc < len(m):
    op = m[pc]
    if op == 1:
        print('R{} = DB101[{}]'.format(m[pc + 2], m[pc + 1]))
        pc += 3
    elif op == 2:
        c = chr(m[pc + 1])
        c = c if c in alph else '?'
        print('R{} = {:02x} ({})'.format(m[pc + 2], m[pc + 1], c))
        pc += 3
    elif op == 4:
        print('R0 = 0; R{} = (R{} == R{})'.format(
            m[pc + 1], m[pc + 1], m[pc + 2]))
        pc += 3
    elif op == 5:
        print('R0 = 0; R{} = R{} - R{}'.format(
            m[pc + 1], m[pc + 1], m[pc + 2]))
        pc += 3
    elif op == 6:
        print('CHECK (R{} == R{})n'.format(
            m[pc + 1], m[pc + 2]))
        pc += 3
    else:
        print('unk opcode {}'.format(op))
        break

Kòm yon rezilta, nou jwenn kòd machin vityèl sa a:

Kòd machin vityèl

R1 = DB101[0]
R2 = 6e (n)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[1]
R2 = 10 (?)
R0 = 0; R1 = R1 - R2
R2 = 20 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[2]
R2 = 77 (w)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[3]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[4]
R2 = 75 (u)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[5]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[6]
R2 = 34 (4)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[7]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[8]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[9]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[10]
R2 = 37 (7)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[11]
R2 = 22 (?)
R0 = 0; R1 = R1 - R2
R2 = 46 (F)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[12]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[13]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[14]
R2 = 6d (m)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[15]
R2 = 11 (?)
R0 = 0; R1 = R1 - R2
R2 = 23 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[16]
R2 = 35 (5)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[17]
R2 = 12 (?)
R0 = 0; R1 = R1 - R2
R2 = 25 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[18]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[19]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

Kòm ou ka wè, pwogram sa a tou senpleman tcheke chak karaktè soti nan DB101 pou egalite nan yon valè sèten. Liy final la pou pase tout chèk la se: n0w u 4r3 7h3 m4573r. Si yo mete liy sa a nan blòk DB101, Lè sa a, manyèl kontwòl PLC aktive epi li pral posib pou eksploze oswa degonfle balon an.


Se tout! Alexey te demontre yon wo nivo konesans ki merite pou yon Ninja endistriyèl :) Nou te voye pri memorab bay gayan an. Mèsi anpil ak tout patisipan yo!

Sous: www.habr.com