Ing PHDays 9 pungkasan kita nganakake kompetisi hack pabrik pompa gas - kompetisi . Ana telung stands ing situs kanthi paramèter keamanan sing beda (Ora Keamanan, Keamanan Kurang, Keamanan Dhuwur), niru proses industri sing padha: hawa ing tekanan dipompa menyang balon (banjur dibebasake).
Senadyan paramèter safety beda, komposisi hardware stands padha: Siemens Simatic PLC S7-300 seri; tombol deflasi darurat lan piranti pangukur tekanan (disambungake menyang input digital PLC (DI)); klep operasi kanggo inflasi lan deflation saka online (disambungake menyang output digital saka PLC (DO)) - ndeleng tokoh ing ngisor iki.
PLC, gumantung saka maca tekanan lan sesuai karo program kasebut, nggawe keputusan kanggo deflate utawa inflate bal (mbukak lan nutup katup sing cocog). Nanging, kabeh stands wis mode kontrol manual, kang ndadekake iku bisa kanggo ngontrol negara katup tanpa watesan.
Stands beda-beda ing kerumitan ngaktifake mode iki: ing stand sing ora dilindhungi iku paling gampang kanggo nindakake iki, lan ing stand High Security iku luwih angel.
Lima saka enem masalah ditanggulangi ing rong dina; Peserta pisanan entuk 233 poin (dheweke ngenteni seminggu kanggo nyiapake kompetisi). Telung pemenang: Aku Panggonan - a1exdandy, II - Rubikoid, III - Ze.
Nanging, sajrone PHDays, ora ana peserta sing bisa ngalahake kabeh telung stand, mula kita mutusake kanggo nggawe kompetisi online lan nerbitake tugas sing paling angel ing awal Juni. Peserta kudu ngrampungake tugas ing sasi, nemokake gendéra, lan njlèntrèhaké solusi kanthi rinci lan kanthi cara sing menarik.
Ing ngisor potong kita nerbitake analisis solusi sing paling apik kanggo tugas saka sing dikirim liwat sasi, ditemokake dening Alexey Kovrizhnykh (a1exdandy) saka perusahaan Keamanan Digital, sing njupuk Panggonan XNUMXst ing kompetisi sak PHDays. Ing ngisor iki kita nampilake teks kanthi komentar.
Analisis wiwitan
Dadi, tugas kasebut ngemot arsip kanthi file ing ngisor iki:
- block_upload_traffic.pcapng
- DB100.bin
- pitunjuk.txt
File hints.txt ngemot informasi lan pitunjuk sing dibutuhake kanggo ngatasi tugas kasebut. Iki isine:
- Petrovich marang kula wingi sing bisa mbukak pamblokiran saka PlcSim menyang Step7.
- Siemens Simatic S7-300 series PLC digunakake ing stand.
- PlcSim minangka emulator PLC sing ngidini sampeyan mbukak lan debug program kanggo PLC Siemens S7.
Berkas DB100.bin katon ngemot blok data DB100 PLC: 00000000: 0100 0102 6e02 0401 0206 0100 0101 0102 ....n......... 00000010: 1002 0501 0202e2002 0501 0206 0100 0102 00000020 ....n......... 0102: 7702 0401 0206e0100 0103 0102 0 02 00000030 ....n......... 0501: 0202: 1602 0501 0206 0100 0104 . ..... ......... 0102: 00000040 7502 0401 0206 0100 0105 0102 0a02 ..w............. 0501: 00000050 0202 1602 0501 0206 0100 ................ 0106: 0102 3402 4 00000060 0401 0206 0100a0107 0102 u............... 2602: 0501 0202 00000070 4 02 0501 0206 0100............0108. 0102: 3302 0401 3 00000080 0206 0100 0109 0102 .........&..... 0: 02c0501 0202 1602 00000090 0501 0206 0100 010 0102 3702. : 0401 0206 7 000000 0a0100 010 0102 2202 ................ 0501: 0202 4602 0501 000000a 0 0206 0100 010 .........0102. 3302a0401: 0206 0100b 3 000000 0 010 0102 0 ......".....F... 02b0501: 0202 1602 0501c 0206 000000 0 ........ 0100 010 ........ .. 0102c6: 02d 0401 0206a0100 010 000000 0 0102 1102 ................ 0501d0202: 2302 0501e 0206 0100d000000 0 0110 .. .... .... 0102e3502: 0401 0206 0100 0111 0102 5 00000100 1202 ........#...... 0501f0202: 2502 0501 0206 0100 0112 00000110 .. ..... 0102: 3302 0401 0206 0100 0113 0102 2602 3 ......%......... 00000120: 0501 0202 4 02 0501 0206 .. .. .....&. 0100: XNUMX XNUMX XNUMXcXNUMX XNUMX XNUMX XNUMX ....L......
Minangka jeneng tabet, file block_upload_traffic.pcapng ngemot mbucal lalu lintas upload pemblokiran kanggo PLC.
Wigati dicathet yen mbucal lalu lintas iki ing situs kompetisi sajrone konferensi kasebut rada angel dipikolehi. Kanggo nindakake iki, sampeyan kudu ngerti skrip saka file proyek TeslaSCADA2. Saka iku bisa kanggo ngerti ngendi mbucal ndhelik nggunakake RC4 dumunung lan apa tombol perlu digunakake kanggo decrypt. Dumps pamblokiran data ing situs bisa dipikolehi nggunakake klien protokol S7. Iki digunakake klien demo saka paket Snap7.
Extracting pamblokiran pangolahan sinyal saka mbucal lalu lintas
Deleng isi dump, sampeyan bisa ngerti manawa ngemot blok pangolahan sinyal OB1, FC1, FC2 lan FC3:
Pamblokiran iki kudu dibusak. Iki bisa ditindakake, contone, nganggo skrip ing ngisor iki, sadurunge ngonversi lalu lintas saka format pcapng menyang pcap:
#!/usr/bin/env python2
import struct
from scapy.all import *
packets = rdpcap('block_upload_traffic.pcap')
s7_hdr_struct = '>BBHHHHBB'
s7_hdr_sz = struct.calcsize(s7_hdr_struct)
tpkt_cotp_sz = 7
names = iter(['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin'])
buf = ''
for packet in packets:
if packet.getlayer(IP).src == '10.0.102.11':
tpkt_cotp_s7 = str(packet.getlayer(TCP).payload)
if len(tpkt_cotp_s7) < tpkt_cotp_sz + s7_hdr_sz:
continue
s7 = tpkt_cotp_s7[tpkt_cotp_sz:]
s7_hdr = s7[:s7_hdr_sz]
param_sz = struct.unpack(s7_hdr_struct, s7_hdr)[4]
s7_param = s7[12:12+param_sz]
s7_data = s7[12+param_sz:]
if s7_param in ('x1ex00', 'x1ex01'): # upload
buf += s7_data[4:]
elif s7_param == 'x1f':
with open(next(names), 'wb') as f:
f.write(buf)
buf = ''Sawise mriksa pamblokiran asil, sampeyan bakal sok dong mirsani sing padha tansah diwiwiti karo bita 70 70 (pp). Saiki sampeyan kudu sinau carane nganalisis. Petunjuk assignment nuduhake yen sampeyan kudu nggunakake PlcSim kanggo iki.
Njupuk instruksi sing bisa diwaca manungsa saka blok
Pisanan, ayo nyoba program S7-PlcSim kanthi ngemot pirang-pirang blok kanthi instruksi mbaleni (= Q 0.0) nggunakake piranti lunak Simatic Manager, lan nyimpen PLC sing dipikolehi ing emulator menyang file example.plc. Kanthi ndeleng isi file, sampeyan bisa kanthi gampang nemtokake wiwitan pamblokiran sing diundhuh kanthi teken 70 70, sing ditemokake sadurunge. Sadurunge pamblokiran, ketoke, ukuran pemblokiran ditulis minangka 4-byte nilai little-endian.
Sawise nampa informasi babagan struktur file plc, rencana aksi ing ngisor iki muncul kanggo maca program PLC S7:
- Nggunakake Simatic Manager, kita nggawe struktur pemblokiran ing S7-PlcSim padha karo sing ditampa saka mbucal. Ukuran blok kudu cocog (iki digayuh kanthi ngisi blok kanthi jumlah instruksi sing dibutuhake) lan pengenal (OB1, FC1, FC2, FC3).
- Simpen PLC menyang file.
- Kita ngganti isi pamblokiran ing file asil karo pamblokiran saka mbucal lalu lintas. Awal pamblokiran ditemtokake dening teken.
- Kita mbukak file asil menyang S7-PlcSim lan katon ing isi pamblokiran ing Simatic Manager.
Blok bisa diganti, contone, nganggo kode ing ngisor iki:
with open('original.plc', 'rb') as f:
plc = f.read()
blocks = []
for fname in ['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin']:
with open(fname, 'rb') as f:
blocks.append(f.read())
i = plc.find(b'pp')
for block in blocks:
plc = plc[:i] + block + plc[i+len(block):]
i = plc.find(b'pp', i + 1)
with open('target.plc', 'wb') as f:
f.write(plc)Alexey njupuk dalan sing luwih angel, nanging isih bener. Kita nganggep yen peserta bakal nggunakake program NetToPlcSim supaya PlcSim bisa komunikasi liwat jaringan, upload pamblokiran kanggo PlcSim liwat Snap7, lan banjur ngundhuh pamblokiran iki minangka project saka PlcSim nggunakake lingkungan pembangunan.
Kanthi mbukak file asil ing S7-PlcSim, sampeyan bisa maca pamblokiran timpa nggunakake Manager Simatic. Fungsi kontrol piranti utama dicathet ing blok FC1. Wigati khusus yaiku variabel #TEMP0, sing nalika diuripake katon nyetel kontrol PLC menyang mode manual adhedhasar nilai memori bit M2.2 lan M2.3. Nilai #TEMP0 disetel dening fungsi FC3.
Kanggo ngatasi masalah, sampeyan kudu nganalisa fungsi FC3 lan ngerti apa sing kudu ditindakake supaya bisa ngasilake logis.
Pamblokiran Processing sinyal PLC ing ngadeg Keamanan Low ing situs kompetisi padha disusun ing cara sing padha, nanging kanggo nyetel Nilai saka variabel #TEMP0, iku cukup kanggo nulis baris sandi cara ninja menyang pemblokiran DB1. Priksa nilai ing blok kasebut gampang lan ora mbutuhake kawruh sing jero babagan basa pamrograman blok. Temenan, ing tingkat Keamanan Tinggi, entuk kontrol manual bakal luwih angel lan kudu ngerti seluk-beluk basa STL (salah sawijining cara kanggo program S7 PLC).
Blok mundur FC3
Isi blok FC3 ing perwakilan STL:
L B#16#0
T #TEMP13
T #TEMP15
L P#DBX 0.0
T #TEMP4
CLR
= #TEMP14
M015: L #TEMP4
LAR1
OPN DB 100
L DBLG
TAR1
<=D
JC M016
L DW#16#0
T #TEMP0
L #TEMP6
L W#16#0
<>I
JC M00d
L P#DBX 0.0
LAR1
M00d: L B [AR1,P#0.0]
T #TEMP5
L W#16#1
==I
JC M007
L #TEMP5
L W#16#2
==I
JC M008
L #TEMP5
L W#16#3
==I
JC M00f
L #TEMP5
L W#16#4
==I
JC M00e
L #TEMP5
L W#16#5
==I
JC M011
L #TEMP5
L W#16#6
==I
JC M012
JU M010
M007: +AR1 P#1.0
L P#DBX 0.0
LAR2
L B [AR1,P#0.0]
L C#8
*I
+AR2
+AR1 P#1.0
L B [AR1,P#0.0]
JL M003
JU M001
JU M002
JU M004
M003: JU M005
M001: OPN DB 101
L B [AR2,P#0.0]
T #TEMP0
JU M006
M002: OPN DB 101
L B [AR2,P#0.0]
T #TEMP1
JU M006
M004: OPN DB 101
L B [AR2,P#0.0]
T #TEMP2
JU M006
M00f: +AR1 P#1.0
L B [AR1,P#0.0]
L C#8
*I
T #TEMP11
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9
TAR1 #TEMP4
OPN DB 101
L P#DBX 0.0
LAR1
L #TEMP11
+AR1
LAR2 #TEMP9
L B [AR2,P#0.0]
T B [AR1,P#0.0]
L #TEMP4
LAR1
JU M006
M008: +AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP3
+AR1 P#1.0
L B [AR1,P#0.0]
JL M009
JU M00b
JU M00a
JU M00c
M009: JU M005
M00b: L #TEMP3
T #TEMP0
JU M006
M00a: L #TEMP3
T #TEMP1
JU M006
M00c: L #TEMP3
T #TEMP2
JU M006
M00e: +AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP8
L P#M 100.0
LAR2
L #TEMP8
L C#8
*I
+AR2
TAR2 #TEMP10
TAR1 #TEMP4
LAR1 #TEMP9
LAR2 #TEMP10
L B [AR1,P#0.0]
L B [AR2,P#0.0]
AW
INVI
T #TEMP12
L B [AR1,P#0.0]
L B [AR2,P#0.0]
OW
L #TEMP12
AW
T B [AR1,P#0.0]
L DW#16#0
T #TEMP0
L MB 101
T #TEMP1
L MB 102
T #TEMP2
L #TEMP4
LAR1
JU M006
M011: +AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP8
L P#M 100.0
LAR2
L #TEMP8
L C#8
*I
+AR2
TAR2 #TEMP10
TAR1 #TEMP4
LAR1 #TEMP9
LAR2 #TEMP10
L B [AR1,P#0.0]
L B [AR2,P#0.0]
-I
T B [AR1,P#0.0]
L DW#16#0
T #TEMP0
L MB 101
T #TEMP1
L MB 102
T #TEMP2
L #TEMP4
LAR1
JU M006
M012: L #TEMP15
INC 1
T #TEMP15
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP8
L P#M 100.0
LAR2
L #TEMP8
L C#8
*I
+AR2
TAR2 #TEMP10
TAR1 #TEMP4
LAR1 #TEMP9
LAR2 #TEMP10
L B [AR1,P#0.0]
L B [AR2,P#0.0]
==I
JCN M013
JU M014
M013: L P#DBX 0.0
LAR1
T #TEMP4
L B#16#0
T #TEMP6
JU M006
M014: L #TEMP4
LAR1
L #TEMP13
L L#1
+I
T #TEMP13
JU M006
M006: L #TEMP0
T MB 100
L #TEMP1
T MB 101
L #TEMP2
T MB 102
+AR1 P#1.0
L #TEMP6
+ 1
T #TEMP6
JU M005
M010: L P#DBX 0.0
LAR1
L 0
T #TEMP6
TAR1 #TEMP4
M005: TAR1 #TEMP4
CLR
= #TEMP16
L #TEMP13
L L#20
==I
S #TEMP16
L #TEMP15
==I
A #TEMP16
JC M017
L #TEMP13
L L#20
<I
S #TEMP16
L #TEMP15
==I
A #TEMP16
JC M018
JU M019
M017: SET
= #TEMP14
JU M016
M018: CLR
= #TEMP14
JU M016
M019: CLR
O #TEMP14
= #RET_VAL
JU M015
M016: CLR
O #TEMP14
= #RET_VALKode kasebut cukup dawa lan bisa uga rumit kanggo wong sing ora ngerti STL. Ora ana gunane kanggo nganalisa saben instruksi ing kerangka artikel iki; instruksi rinci lan kemampuan basa STL bisa ditemokake ing manual sing cocog: . Ing kene aku bakal nampilake kode sing padha sawise diproses - ngganti jeneng label lan variabel lan nambah komentar sing nggambarake algoritma operasi lan sawetara konstruksi basa STL. Ayo kula langsung Wigati sing pemblokiran ing pitakonan ngemot mesin virtual sing executes sawetara bytecode dumunung ing blok DB100, isi kang kita ngerti. Instruksi mesin virtual kalebu 1 byte kode operasi lan bait argumen, siji bait kanggo saben argumen. Kabeh instruksi sing dianggep duwe rong argumen; Aku nemtokake nilai kasebut ing komentar minangka X lan Y.
Kode sawise diproses]
# Инициализация различных переменных
L B#16#0
T #CHECK_N # Счетчик успешно пройденных проверок
T #COUNTER_N # Счетчик общего количества проверок
L P#DBX 0.0
T #POINTER # Указатель на текущую инструкцию
CLR
= #PRE_RET_VAL
# Основной цикл работы интерпретатора байт-кода
LOOP: L #POINTER
LAR1
OPN DB 100
L DBLG
TAR1
<=D # Проверка выхода указателя за пределы программы
JC FINISH
L DW#16#0
T #REG0
L #TEMP6
L W#16#0
<>I
JC M00d
L P#DBX 0.0
LAR1
# Конструкция switch - case для обработки различных опкодов
M00d: L B [AR1,P#0.0]
T #OPCODE
L W#16#1
==I
JC OPCODE_1
L #OPCODE
L W#16#2
==I
JC OPCODE_2
L #OPCODE
L W#16#3
==I
JC OPCODE_3
L #OPCODE
L W#16#4
==I
JC OPCODE_4
L #OPCODE
L W#16#5
==I
JC OPCODE_5
L #OPCODE
L W#16#6
==I
JC OPCODE_6
JU OPCODE_OTHER
# Обработчик опкода 01: загрузка значения из DB101[X] в регистр Y
# OP01(X, Y): REG[Y] = DB101[X]
OPCODE_1: +AR1 P#1.0
L P#DBX 0.0
LAR2
L B [AR1,P#0.0] # Загрузка аргумента X (индекс в DB101)
L C#8
*I
+AR2
+AR1 P#1.0
L B [AR1,P#0.0] # Загрузка аргумента Y (индекс регистра)
JL M003 # Аналог switch - case на основе значения Y
JU M001 # для выбора необходимого регистра для записи.
JU M002 # Подобные конструкции используются и в других
JU M004 # операциях ниже для аналогичных целей
M003: JU LOOPEND
M001: OPN DB 101
L B [AR2,P#0.0]
T #REG0 # Запись значения DB101[X] в REG[0]
JU PRE_LOOPEND
M002: OPN DB 101
L B [AR2,P#0.0]
T #REG1 # Запись значения DB101[X] в REG[1]
JU PRE_LOOPEND
M004: OPN DB 101
L B [AR2,P#0.0]
T #REG2 # Запись значения DB101[X] в REG[2]
JU PRE_LOOPEND
# Обработчик опкода 02: загрузка значения X в регистр Y
# OP02(X, Y): REG[Y] = X
OPCODE_2: +AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP3
+AR1 P#1.0
L B [AR1,P#0.0]
JL M009
JU M00b
JU M00a
JU M00c
M009: JU LOOPEND
M00b: L #TEMP3
T #REG0
JU PRE_LOOPEND
M00a: L #TEMP3
T #REG1
JU PRE_LOOPEND
M00c: L #TEMP3
T #REG2
JU PRE_LOOPEND
# Опкод 03 не используется в программе, поэтому пропустим его
...
# Обработчик опкода 04: сравнение регистров X и Y
# OP04(X, Y): REG[0] = 0; REG[X] = (REG[X] == REG[Y])
OPCODE_4: +AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7 # первый аргумент - X
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9 # REG[X]
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP8
L P#M 100.0
LAR2
L #TEMP8
L C#8
*I
+AR2
TAR2 #TEMP10 # REG[Y]
TAR1 #POINTER
LAR1 #TEMP9 # REG[X]
LAR2 #TEMP10 # REG[Y]
L B [AR1,P#0.0]
L B [AR2,P#0.0]
AW
INVI
T #TEMP12 # ~(REG[Y] & REG[X])
L B [AR1,P#0.0]
L B [AR2,P#0.0]
OW
L #TEMP12
AW # (~(REG[Y] & REG[X])) & (REG[Y] | REG[X]) - аналог проверки на равенство
T B [AR1,P#0.0]
L DW#16#0
T #REG0
L MB 101
T #REG1
L MB 102
T #REG2
L #POINTER
LAR1
JU PRE_LOOPEND
# Обработчик опкода 05: вычитание регистра Y из X
# OP05(X, Y): REG[0] = 0; REG[X] = REG[X] - REG[Y]
OPCODE_5: +AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9 # REG[X]
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP8
L P#M 100.0
LAR2
L #TEMP8
L C#8
*I
+AR2
TAR2 #TEMP10 # REG[Y]
TAR1 #POINTER
LAR1 #TEMP9
LAR2 #TEMP10
L B [AR1,P#0.0]
L B [AR2,P#0.0]
-I # ACCU1 = ACCU2 - ACCU1, REG[X] - REG[Y]
T B [AR1,P#0.0]
L DW#16#0
T #REG0
L MB 101
T #REG1
L MB 102
T #REG2
L #POINTER
LAR1
JU PRE_LOOPEND
# Обработчик опкода 06: инкремент #CHECK_N при равенстве регистров X и Y
# OP06(X, Y): #CHECK_N += (1 if REG[X] == REG[Y] else 0)
OPCODE_6: L #COUNTER_N
INC 1
T #COUNTER_N
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP7 # REG[X]
L P#M 100.0
LAR2
L #TEMP7
L C#8
*I
+AR2
TAR2 #TEMP9 # REG[X]
+AR1 P#1.0
L B [AR1,P#0.0]
T #TEMP8
L P#M 100.0
LAR2
L #TEMP8
L C#8
*I
+AR2
TAR2 #TEMP10 # REG[Y]
TAR1 #POINTER
LAR1 #TEMP9 # REG[Y]
LAR2 #TEMP10 # REG[X]
L B [AR1,P#0.0]
L B [AR2,P#0.0]
==I
JCN M013
JU M014
M013: L P#DBX 0.0
LAR1
T #POINTER
L B#16#0
T #TEMP6
JU PRE_LOOPEND
M014: L #POINTER
LAR1
# Инкремент значения #CHECK_N
L #CHECK_N
L L#1
+I
T #CHECK_N
JU PRE_LOOPEND
PRE_LOOPEND: L #REG0
T MB 100
L #REG1
T MB 101
L #REG2
T MB 102
+AR1 P#1.0
L #TEMP6
+ 1
T #TEMP6
JU LOOPEND
OPCODE_OTHER: L P#DBX 0.0
LAR1
L 0
T #TEMP6
TAR1 #POINTER
LOOPEND: TAR1 #POINTER
CLR
= #TEMP16
L #CHECK_N
L L#20
==I
S #TEMP16
L #COUNTER_N
==I
A #TEMP16
# Все проверки пройдены, если #CHECK_N == #COUNTER_N == 20
JC GOOD
L #CHECK_N
L L#20
<I
S #TEMP16
L #COUNTER_N
==I
A #TEMP16
JC FAIL
JU M019
GOOD: SET
= #PRE_RET_VAL
JU FINISH
FAIL: CLR
= #PRE_RET_VAL
JU FINISH
M019: CLR
O #PRE_RET_VAL
= #RET_VAL
JU LOOP
FINISH: CLR
O #PRE_RET_VAL
= #RET_VALSawise entuk ide babagan instruksi mesin virtual, ayo nulis disassembler cilik kanggo ngurai bytecode ing blok DB100:
import string
alph = string.ascii_letters + string.digits
with open('DB100.bin', 'rb') as f:
m = f.read()
pc = 0
while pc < len(m):
op = m[pc]
if op == 1:
print('R{} = DB101[{}]'.format(m[pc + 2], m[pc + 1]))
pc += 3
elif op == 2:
c = chr(m[pc + 1])
c = c if c in alph else '?'
print('R{} = {:02x} ({})'.format(m[pc + 2], m[pc + 1], c))
pc += 3
elif op == 4:
print('R0 = 0; R{} = (R{} == R{})'.format(
m[pc + 1], m[pc + 1], m[pc + 2]))
pc += 3
elif op == 5:
print('R0 = 0; R{} = R{} - R{}'.format(
m[pc + 1], m[pc + 1], m[pc + 2]))
pc += 3
elif op == 6:
print('CHECK (R{} == R{})n'.format(
m[pc + 1], m[pc + 2]))
pc += 3
else:
print('unk opcode {}'.format(op))
breakAkibaté, kita entuk kode mesin virtual ing ngisor iki:
Kode mesin virtual
R1 = DB101[0]
R2 = 6e (n)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[1]
R2 = 10 (?)
R0 = 0; R1 = R1 - R2
R2 = 20 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[2]
R2 = 77 (w)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[3]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[4]
R2 = 75 (u)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[5]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[6]
R2 = 34 (4)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[7]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[8]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[9]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[10]
R2 = 37 (7)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[11]
R2 = 22 (?)
R0 = 0; R1 = R1 - R2
R2 = 46 (F)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[12]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[13]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[14]
R2 = 6d (m)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[15]
R2 = 11 (?)
R0 = 0; R1 = R1 - R2
R2 = 23 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[16]
R2 = 35 (5)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[17]
R2 = 12 (?)
R0 = 0; R1 = R1 - R2
R2 = 25 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)
R1 = DB101[18]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)
R1 = DB101[19]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)Kaya sing sampeyan ngerteni, program iki mung mriksa saben karakter saka DB101 kanggo kesetaraan karo nilai tartamtu. Baris pungkasan kanggo ngliwati kabeh mriksa yaiku: n0w u 4r3 7h3 m4573r. Yen baris iki diselehake ing pemblokiran DB101, banjur kontrol PLC manual diaktifake lan bakal bisa kanggo njeblug utawa deflate balon.
Iku kabeh! Alexey nuduhake tingkat dhuwur kawruh sing pantes kanggo ninja industri :) Kita ngirim hadiah paweling kanggo juara. Many thanks kanggo kabeh peserta!
Source: www.habr.com
