🥇I tulagavae o Industrial Ninja: faʻafefea ona faʻafefeina se PLC ile Positive Hack Days 9

I le PHDays 9 talu ai na matou faia ai se tauvaga e ta'i ai se fale pamu kesi - tauvaga Alamanuia Ninja. E tolu tulaga i luga o le saite ma tulaga saogalemu eseese (Leai se Puipuiga, Saogalemu Maulalo, Saogalemu Maualuga), faʻataʻitaʻiina le faiga faʻapisinisi tutusa: o le ea i lalo o le mamafa na pamu i totonu o se paluni (ona faʻamalolo).

E ui lava i tulaga eseese o le saogalemu, o le tuufaatasiga o meafaigaluega o tulaga e tutusa lava: Siemens Simatic PLC S7-300 faasologa; faʻamau faʻalavelave faʻafuaseʻi ma masini e fua ai le mamafa (fesoʻotaʻi i mea faʻaoga numera PLC (DI)); valve o loʻo faʻaogaina mo le faʻatupulaia ma le faʻaitiitia o le ea (fesoʻotaʻi i galuega faʻafuainumera a le PLC (DO)) - vaʻai le ata o loʻo i lalo.

O le PLC, e faʻatatau i le faitauga o le mamafa ma e tusa ai ma lana polokalame, na faia se faʻaiuga e faʻafefe pe faʻafefe le polo (tatala ma tapuni ia valve talafeagai). Ae ui i lea, o tulaga uma sa i ai se faiga faʻatonutonu tusi, lea na mafai ai ona pulea le setete o valve e aunoa ma se faʻatapulaʻaina.

E eseese tulaga i le lavelave o le mafai ai o lenei faiga: i le tulaga le puipuia sa sili ona faigofie le faia o lenei mea, ma i le tulaga maualuga o le Puipuiga sa faapena foi ona sili atu ona faigata.

E lima mai fa'afitauli e ono na fo'ia i aso e lua; O le sui tulaga muamua na maua le 233 'ai (na ia fa'aaluina le vaiaso e sauniuni ai mo le tauvaga). Tolu manumalo: Ou tu'u - a1exdandy, II - Rubikoid, III - Ze.

Ae ui i lea, i le taimi o PHDays, e leai se tasi na auai na mafai ona manumalo i tulaga uma e tolu, o lea na matou filifili ai e faia se tauvaga i luga o le initaneti ma faʻasalalau le galuega sili ona faigata i le amataga o Iuni. E tatau i tagata auai ona faʻamaeʻaina le galuega i totonu o le masina, suʻe le fuʻa, ma faʻamatala auiliili le fofo ma i se auala manaia.

I lalo ifo o le tipi matou te lolomiina se auiliiliga o le fofo sili ona lelei i le galuega mai i latou na auina atu i luga o le masina, na maua e Alexey Kovrizhnykh (a1exdandy) mai le kamupani Digital Security, o le na maua le XNUMXst tulaga i le tauvaga i le taimi o PHDays. I lalo ifo matou te tuʻuina atu ai lana tusitusiga ma a matou faʻamatalaga.

Iloiloga muamua

O lea la, o le galuega o loʻo i ai se faʻamaumauga ma faila nei:

block_upload_traffic.pcapng
DB100.bin
hints.txt

O le faila hints.txt o loʻo i ai faʻamatalaga talafeagai ma faʻamatalaga e foia ai le galuega. O mea nei i totonu:

Na taʻu mai e Petrovich ia te aʻu ananafi e mafai ona e utaina poloka mai le PlcSim i le Step7.

O le Siemens Simatic S7-300 series PLC na faʻaaogaina i le tulaga.

PlcSim o se PLC emulator e mafai ai e oe ona faʻatautaia ma faʻapipiʻi polokalame mo Siemens S7 PLCs.

O le faila DB100.bin e foliga mai o loʻo i ai le poloka faʻamaumauga a le DB100 PLC: 00000000: 0100 0102 6e02 0401 0206 0100 0101 0102 ....n......... 00000010: 1002 0501 0202e2002 0501 0206 0100 0102 00000020 ....n......... 0102: 7702 0401 . 0206 . ..... ......... 0100: 0103 0102 0 02 00000030 0501 0202 1602a0501 ..w............. 0206: 0100 0104 0102 00000040 7502 0401 0206 0100 ................ 0105: 0102 0 02 0501 00000050 0202 1602a0501 0206 u............... 0100: 0106 0102 3402 4 00000060 0401 0206 0100............0107. 0102: 2602 0501 0202 00000070 4 02 0501 0206 .........&..... 0100: 0108c0102 3302 0401 3 00000080 0206 0100 .0109 0102 : 0 02 0501 0202 1602a00000090 0501 0206 0100 ................ 010: 0102 3702 0401 0206a 7 000000 0 0100 .........010. 0102a2202: 0501 0202b 4602 0501 000000 0 0206 0100 ......".....F... 010b0102: 3302 0401 0206c 0100 3 000000 ........0 010 ........ .. 0102c0: 02d 0501 0202a1602 0501 0206 000000 0 0100 ................ 010d0102: 6 02e 0401 0206d0100 010 000000 ...... .... 0e0102: 1102 0501 0202 2302 0501 0206 0100 000000 ........#...... 0f0110: 0102 3502 0401 0206 0100 0111 ..... ..... 0102: 5 00000100 1202 0501 0202 2502 0501 0206 ......%......... 0100: 0112 00000110 0102 3302 0401 0206 .. .. ....&. 0100: 0113 0102 2602c3 00000120 0501 0202 ....L......

E pei ona taʻu mai e le igoa, o le block_upload_traffic.pcapng faila o loʻo i ai se faʻaputuga o poloka faʻapipiʻi fefaʻatauaiga i le PLC.

E taua le matauina o lenei lafoaia o taavale i le nofoaga o tauvaga i le taimi o le konafesi sa fai si faigata ona maua. Ina ia faia lenei mea, sa tatau ona malamalama i le tusitusiga mai le faila faila mo TeslaSCADA2. Mai lea mea na mafai ai ona malamalama poʻo fea na faʻapipiʻiina ai le faʻaogaina o le RC4 ma o le a le ki e manaʻomia e faʻaaoga e faʻamalo ai. Lafoai o poloka fa'amaumauga i luga ole saite e mafai ona maua ile fa'aogaina ole S7 protocol client. Mo lenei mea na ou faʻaaogaina ai le tagata faʻataʻitaʻi mai le Snap7 package.

Ave'ese mai poloka fa'ailoilo mai le lafoa'i

A'o va'ai i mea o lo'o i totonu o le otaota, e mafai ona e malamalama o lo'o i ai poloka fa'ailoga o le OB1, FC1, FC2 ma le FC3:

E tatau ona aveese ia poloka. E mafai ona faia lenei mea, mo se faʻataʻitaʻiga, faʻatasi ai ma le faʻasologa o loʻo i lalo, i le taimi muamua na liua ai le fefaʻatauaiga mai le pcapng format i le pcap:

#!/usr/bin/env python2

import struct
from scapy.all import *

packets = rdpcap('block_upload_traffic.pcap')
s7_hdr_struct = '>BBHHHHBB'
s7_hdr_sz = struct.calcsize(s7_hdr_struct)
tpkt_cotp_sz = 7
names = iter(['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin'])
buf = ''

for packet in packets:
    if packet.getlayer(IP).src == '10.0.102.11':
        tpkt_cotp_s7 = str(packet.getlayer(TCP).payload)
        if len(tpkt_cotp_s7) < tpkt_cotp_sz + s7_hdr_sz:
            continue
        s7 = tpkt_cotp_s7[tpkt_cotp_sz:]
        s7_hdr = s7[:s7_hdr_sz]
        param_sz = struct.unpack(s7_hdr_struct, s7_hdr)[4]
        s7_param = s7[12:12+param_sz]
        s7_data = s7[12+param_sz:]
        if s7_param in ('x1ex00', 'x1ex01'):  # upload
            buf += s7_data[4:]
        elif s7_param == 'x1f':
            with open(next(names), 'wb') as f:
                f.write(buf)
            buf = ''

I le suʻesuʻeina o poloka e maua mai ai, o le ae matauina e amata i taimi uma i bytes 70 70 (pp). O lea la e tatau ona e aʻoaʻoina pe faʻapefea ona suʻeina. O le faʻailoga o le tofiga e taʻu mai ai e te manaʻomia le faʻaogaina o le PlcSim mo lenei mea.

Mauaina o faatonuga e mafai ona faitau e tagata mai poloka

Muamua, seʻi o tatou taumafai e faʻapipiʻi le S7-PlcSim e ala i le faʻapipiʻiina o le tele o poloka ma faʻatonuga toe fai (= Q 0.0) i totonu e faʻaaoga ai le Simatic Manager software, ma faʻasaoina le PLC na maua i le emulator i le faila example.plc. I le vaʻavaʻai i mea o loʻo i totonu o le faila, e faigofie ona e iloa le amataga o poloka na sii mai e le saini 70 70, lea na matou mauaina muamua. I luma o poloka, e foliga mai, o le poloka poloka ua tusia e pei o le 4-byte little-endian tau.

Ina ua uma ona matou mauaina faʻamatalaga e uiga i le fausaga o faila plc, na faʻaalia le fuafuaga faʻatino mo le faitauina o polokalame PLC S7:

I le faʻaaogaina o le Simatic Manager, matou te fatuina se poloka poloka i le S7-PlcSim tutusa ma le mea na matou mauaina mai le lapisi. Ole lapopoa ole poloka e tatau ona fetaui (e maua lenei mea ile faʻatumuina o poloka ile numera manaʻomia o faʻatonuga) ma latou faʻamatalaga (OB1, FC1, FC2, FC3).
Faasaoina le PLC i se faila.
Matou te suia mea o loʻo i totonu o poloka i le faila faila ma poloka mai le lafoaia o taavale. O le amataga o poloka e fuafua e le saini.
Matou te utaina le faila faila i le S7-PlcSim ma vaʻavaʻai i mea o loʻo i totonu o poloka ile Simatic Manager.

E mafai ona suia poloka, mo se faʻataʻitaʻiga, i le tulafono lea:

with open('original.plc', 'rb') as f:
    plc = f.read()
blocks = []
for fname in ['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin']:
    with open(fname, 'rb') as f:
        blocks.append(f.read())

i = plc.find(b'pp')
for block in blocks:
    plc = plc[:i] + block + plc[i+len(block):]
    i = plc.find(b'pp', i + 1)

with open('target.plc', 'wb') as f:
    f.write(plc)

Na uia e Alexey se ala e sili atu ona faigata, ae sa'o lava. Na matou manatu o le a faʻaaogaina e le au auai le polokalame NetToPlcSim ina ia mafai e PlcSim ona fesoʻotaʻi i luga o le fesoʻotaʻiga, faʻapipiʻi poloka i PlcSim e ala i le Snap7, ona sii mai lea o poloka nei o se poloketi mai le PlcSim e faʻaaoga ai le siosiomaga atinaʻe.

E ala i le tatalaina o le faila faila i le S7-PlcSim, e mafai ona e faitau i poloka o loʻo faʻaaogaina e faʻaaoga ai le Simatic Manager. O galuega autu o le pulea o masini o loʻo faʻamauina i poloka FC1. O le faʻamatalaga faapitoa o le #TEMP0 fesuiaiga, lea pe a faʻaalia e foliga mai e setiina le pule PLC i le faʻaogaina o le tusi lesona e faʻavae i luga o le M2.2 ma le M2.3 bit memory values. Ole tau #TEMP0 e fa'atulaga ile galuega FC3.

Ina ia foia le faafitauli, e tatau ona e suʻesuʻeina le galuega a le FC3 ma malamalama i mea e manaʻomia ona fai ina ia toe foʻi mai ai se mea talafeagai.

O poloka faʻailoga PLC i le tulaga Low Security i le nofoaga o le tauvaga sa faʻatulagaina i se auala talitutusa, ae o le setiina o le tau o le #TEMP0 fesuiaiga, na lava e tusi ai le laina o loʻu ala ninja i le poloka DB1. O le siakiina o le tau i totonu o se poloka sa tuusaʻo ma e le manaʻomia se malamalama loloto i le gagana poloka poloka. E manino lava, i le maualuga o le Saogalemu, o le ausiaina o le faʻatonuga o le tusi lesona o le a sili atu ona faigata ma e manaʻomia le malamalama i le lavelave o le gagana STL (o se tasi o auala e faʻapipiʻi ai le S7 PLC).

Su'e poloka FC3

O mea i totonu ole poloka FC3 ile sui ole STL:

      L     B#16#0
      T     #TEMP13
      T     #TEMP15
      L     P#DBX 0.0
      T     #TEMP4
      CLR   
      =     #TEMP14
M015: L     #TEMP4
      LAR1  
      OPN   DB   100
      L     DBLG
      TAR1  
      <=D   
      JC    M016
      L     DW#16#0
      T     #TEMP0
      L     #TEMP6
      L     W#16#0
      <>I   
      JC    M00d
      L     P#DBX 0.0
      LAR1  
M00d: L     B [AR1,P#0.0]
      T     #TEMP5
      L     W#16#1
      ==I   
      JC    M007
      L     #TEMP5
      L     W#16#2
      ==I   
      JC    M008
      L     #TEMP5
      L     W#16#3
      ==I   
      JC    M00f
      L     #TEMP5
      L     W#16#4
      ==I   
      JC    M00e
      L     #TEMP5
      L     W#16#5
      ==I   
      JC    M011
      L     #TEMP5
      L     W#16#6
      ==I   
      JC    M012
      JU    M010
M007: +AR1  P#1.0
      L     P#DBX 0.0
      LAR2  
      L     B [AR1,P#0.0]
      L     C#8
      *I    
      +AR2  
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M003
      JU    M001
      JU    M002
      JU    M004
M003: JU    M005
M001: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP0
      JU    M006
M002: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP1
      JU    M006
M004: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP2
      JU    M006
M00f: +AR1  P#1.0
      L     B [AR1,P#0.0]
      L     C#8
      *I    
      T     #TEMP11
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      TAR1  #TEMP4
      OPN   DB   101
      L     P#DBX 0.0
      LAR1  
      L     #TEMP11
      +AR1  
      LAR2  #TEMP9
      L     B [AR2,P#0.0]
      T     B [AR1,P#0.0]
      L     #TEMP4
      LAR1  
      JU    M006
M008: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP3
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M009
      JU    M00b
      JU    M00a
      JU    M00c
M009: JU    M005
M00b: L     #TEMP3
      T     #TEMP0
      JU    M006
M00a: L     #TEMP3
      T     #TEMP1
      JU    M006
M00c: L     #TEMP3
      T     #TEMP2
      JU    M006
M00e: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      AW    
      INVI  
      T     #TEMP12
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      OW    
      L     #TEMP12
      AW    
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #TEMP0
      L     MB   101
      T     #TEMP1
      L     MB   102
      T     #TEMP2
      L     #TEMP4
      LAR1  
      JU    M006
M011: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      -I    
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #TEMP0
      L     MB   101
      T     #TEMP1
      L     MB   102
      T     #TEMP2
      L     #TEMP4
      LAR1  
      JU    M006
M012: L     #TEMP15
      INC   1
      T     #TEMP15
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      ==I   
      JCN   M013
      JU    M014
M013: L     P#DBX 0.0
      LAR1  
      T     #TEMP4
      L     B#16#0
      T     #TEMP6
      JU    M006
M014: L     #TEMP4
      LAR1  
      L     #TEMP13
      L     L#1
      +I    
      T     #TEMP13
      JU    M006
M006: L     #TEMP0
      T     MB   100
      L     #TEMP1
      T     MB   101
      L     #TEMP2
      T     MB   102
      +AR1  P#1.0
      L     #TEMP6
      +     1
      T     #TEMP6
      JU    M005
M010: L     P#DBX 0.0
      LAR1  
      L     0
      T     #TEMP6
      TAR1  #TEMP4
M005: TAR1  #TEMP4
      CLR   
      =     #TEMP16
      L     #TEMP13
      L     L#20
      ==I   
      S     #TEMP16
      L     #TEMP15
      ==I   
      A     #TEMP16
      JC    M017
      L     #TEMP13
      L     L#20
      <I    
      S     #TEMP16
      L     #TEMP15
      ==I   
      A     #TEMP16
      JC    M018
      JU    M019
M017: SET   
      =     #TEMP14
      JU    M016
M018: CLR   
      =     #TEMP14
      JU    M016
M019: CLR   
      O     #TEMP14
      =     #RET_VAL
      JU    M015
M016: CLR   
      O     #TEMP14
      =     #RET_VAL

O le code e fai si umi ma atonu e foliga faigata i se tasi e le masani ile STL. E leai se aoga o le su'esu'eina o fa'atonuga ta'itasi i totonu o le auivi o lenei tusiga fa'amatalaga auiliili ma agava'a o le gagana STL e mafai ona maua i le tusi fa'atatau; Lisi Fa'amatalaga (STL) mo S7-300 ma S7-400 Polokalama. O iinei o le a ou tuʻuina atu ai le code tutusa pe a uma ona faʻaogaina - toe faʻaigoaina igoa ma fesuiaiga ma faʻaopoopo faʻamatalaga e faʻamatala ai le gaioiga algorithm ma nisi gagana STL fausia. Sei ou vave matauina o le poloka o loʻo fesiligia o loʻo i ai se masini komepiuta e faʻatinoina nisi o bytecode o loʻo i totonu o le poloka DB100, o mea o loʻo tatou iloa. Fa'atonuga masini masini e aofia ai le 1 byte o le fa'aogaina o code ma bytes o finauga, tasi le paita mo finauga ta'itasi. O faʻatonuga uma e mafaufauina e lua finauga; Na ou filifilia o latou tulaga taua i faʻamatalaga o X ma Y.

Fa'ailoga pe a uma ona fa'agaoioia]

# Инициализация различных переменных
      L     B#16#0
      T     #CHECK_N        # Счетчик успешно пройденных проверок
      T     #COUNTER_N      # Счетчик общего количества проверок
      L     P#DBX 0.0
      T     #POINTER        # Указатель на текущую инструкцию
      CLR   
      =     #PRE_RET_VAL

# Основной цикл работы интерпретатора байт-кода
LOOP: L     #POINTER
      LAR1  
      OPN   DB   100
      L     DBLG
      TAR1  
      <=D                   # Проверка выхода указателя за пределы программы
      JC    FINISH
      L     DW#16#0
      T     #REG0
      L     #TEMP6
      L     W#16#0
      <>I   
      JC    M00d
      L     P#DBX 0.0
      LAR1  

# Конструкция switch - case для обработки различных опкодов
M00d: L     B [AR1,P#0.0]
      T     #OPCODE
      L     W#16#1
      ==I   
      JC    OPCODE_1
      L     #OPCODE
      L     W#16#2
      ==I   
      JC    OPCODE_2
      L     #OPCODE
      L     W#16#3
      ==I   
      JC    OPCODE_3
      L     #OPCODE
      L     W#16#4
      ==I   
      JC    OPCODE_4
      L     #OPCODE
      L     W#16#5
      ==I   
      JC    OPCODE_5
      L     #OPCODE
      L     W#16#6
      ==I   
      JC    OPCODE_6
      JU    OPCODE_OTHER

# Обработчик опкода 01: загрузка значения из DB101[X] в регистр Y
# OP01(X, Y): REG[Y] = DB101[X]
OPCODE_1: +AR1  P#1.0
      L     P#DBX 0.0
      LAR2  
      L     B [AR1,P#0.0]   # Загрузка аргумента X (индекс в DB101)
      L     C#8
      *I    
      +AR2  
      +AR1  P#1.0
      L     B [AR1,P#0.0]   # Загрузка аргумента Y (индекс регистра)
      JL    M003            # Аналог switch - case на основе значения Y
      JU    M001            # для выбора необходимого регистра для записи.
      JU    M002            # Подобные конструкции используются и в других
      JU    M004            # операциях ниже для аналогичных целей
M003: JU    LOOPEND
M001: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG0           # Запись значения DB101[X] в REG[0]
      JU    PRE_LOOPEND
M002: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG1           # Запись значения DB101[X] в REG[1]
      JU    PRE_LOOPEND
M004: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG2           # Запись значения DB101[X] в REG[2]
      JU    PRE_LOOPEND

# Обработчик опкода 02: загрузка значения X в регистр Y
# OP02(X, Y): REG[Y] = X
OPCODE_2: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP3
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M009
      JU    M00b
      JU    M00a
      JU    M00c
M009: JU    LOOPEND
M00b: L     #TEMP3
      T     #REG0
      JU    PRE_LOOPEND
M00a: L     #TEMP3
      T     #REG1
      JU    PRE_LOOPEND
M00c: L     #TEMP3
      T     #REG2
      JU    PRE_LOOPEND

# Опкод 03 не используется в программе, поэтому пропустим его
...

# Обработчик опкода 04: сравнение регистров X и Y
# OP04(X, Y): REG[0] = 0; REG[X] = (REG[X] == REG[Y])
OPCODE_4: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7          # первый аргумент - X
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          # REG[X]
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9          # REG[X]
      LAR2  #TEMP10         # REG[Y]
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      AW    
      INVI  
      T     #TEMP12         # ~(REG[Y] & REG[X])
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      OW    
      L     #TEMP12
      AW                    # (~(REG[Y] & REG[X])) & (REG[Y] | REG[X]) - аналог проверки на равенство
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #REG0
      L     MB   101
      T     #REG1
      L     MB   102
      T     #REG2
      L     #POINTER
      LAR1  
      JU    PRE_LOOPEND

# Обработчик опкода 05: вычитание регистра Y из X
# OP05(X, Y): REG[0] = 0; REG[X] = REG[X] - REG[Y]
OPCODE_5: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          # REG[X]
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      -I                    # ACCU1 = ACCU2 - ACCU1, REG[X] - REG[Y]
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #REG0
      L     MB   101
      T     #REG1
      L     MB   102
      T     #REG2
      L     #POINTER
      LAR1  
      JU    PRE_LOOPEND

# Обработчик опкода 06: инкремент #CHECK_N при равенстве регистров X и Y
# OP06(X, Y): #CHECK_N += (1 if REG[X] == REG[Y] else 0)
OPCODE_6: L     #COUNTER_N
      INC   1
      T     #COUNTER_N
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7          #  REG[X]     
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          #  REG[X]  
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9          # REG[Y]
      LAR2  #TEMP10         # REG[X]
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      ==I   
      JCN   M013
      JU    M014
M013: L     P#DBX 0.0
      LAR1  
      T     #POINTER
      L     B#16#0
      T     #TEMP6
      JU    PRE_LOOPEND
M014: L     #POINTER
      LAR1  
# Инкремент значения #CHECK_N
      L     #CHECK_N
      L     L#1
      +I    
      T     #CHECK_N
      JU    PRE_LOOPEND

PRE_LOOPEND: L     #REG0
      T     MB   100
      L     #REG1
      T     MB   101
      L     #REG2
      T     MB   102
      +AR1  P#1.0
      L     #TEMP6
      +     1
      T     #TEMP6
      JU    LOOPEND

OPCODE_OTHER: L     P#DBX 0.0
      LAR1  
      L     0
      T     #TEMP6
      TAR1  #POINTER

LOOPEND: TAR1  #POINTER
      CLR   
      =     #TEMP16
      L     #CHECK_N
      L     L#20
      ==I   
      S     #TEMP16
      L     #COUNTER_N
      ==I   
      A     #TEMP16
# Все проверки пройдены, если #CHECK_N == #COUNTER_N == 20
      JC    GOOD
      L     #CHECK_N
      L     L#20
      <I    
      S     #TEMP16
      L     #COUNTER_N
      ==I   
      A     #TEMP16
      JC    FAIL
      JU    M019
GOOD: SET   
      =     #PRE_RET_VAL
      JU    FINISH
FAIL: CLR   
      =     #PRE_RET_VAL
      JU    FINISH
M019: CLR   
      O     #PRE_RET_VAL
      =     #RET_VAL
      JU    LOOP
FINISH: CLR   
      O     #PRE_RET_VAL
      =     #RET_VAL

O le i ai o se manatu i le masini masini faʻatonuga, seʻi o tatou tusia se tamaʻi faʻasese e faʻasalalau le bytecode i le poloka DB100:

import string
alph = string.ascii_letters + string.digits

with open('DB100.bin', 'rb') as f:
    m = f.read()

pc = 0

while pc < len(m):
    op = m[pc]
    if op == 1:
        print('R{} = DB101[{}]'.format(m[pc + 2], m[pc + 1]))
        pc += 3
    elif op == 2:
        c = chr(m[pc + 1])
        c = c if c in alph else '?'
        print('R{} = {:02x} ({})'.format(m[pc + 2], m[pc + 1], c))
        pc += 3
    elif op == 4:
        print('R0 = 0; R{} = (R{} == R{})'.format(
            m[pc + 1], m[pc + 1], m[pc + 2]))
        pc += 3
    elif op == 5:
        print('R0 = 0; R{} = R{} - R{}'.format(
            m[pc + 1], m[pc + 1], m[pc + 2]))
        pc += 3
    elif op == 6:
        print('CHECK (R{} == R{})n'.format(
            m[pc + 1], m[pc + 2]))
        pc += 3
    else:
        print('unk opcode {}'.format(op))
        break

O le iʻuga, matou te maua le faʻailoga masini masini komepiuta:

Fa'ailoga masini masini

R1 = DB101[0]
R2 = 6e (n)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[1]
R2 = 10 (?)
R0 = 0; R1 = R1 - R2
R2 = 20 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[2]
R2 = 77 (w)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[3]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[4]
R2 = 75 (u)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[5]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[6]
R2 = 34 (4)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[7]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[8]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[9]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[10]
R2 = 37 (7)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[11]
R2 = 22 (?)
R0 = 0; R1 = R1 - R2
R2 = 46 (F)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[12]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[13]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[14]
R2 = 6d (m)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[15]
R2 = 11 (?)
R0 = 0; R1 = R1 - R2
R2 = 23 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[16]
R2 = 35 (5)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[17]
R2 = 12 (?)
R0 = 0; R1 = R1 - R2
R2 = 25 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[18]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[19]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

E pei ona e vaʻaia, o lenei polokalame e naʻo le siakiina o uiga taʻitasi mai le DB101 mo le tutusa i se tau faʻapitoa. Ole laina mulimuli mo le pasia o siaki uma ole: n0w u 4r3 7h3 m4573r. Afai e tu'u le laina lea i le poloka DB101, ona fa'agaoioia lea o le fa'atonuga o le PLC ma e mafai ona pa pe fa'afefe le paluni. 

Pau lava lena! Na fa'aalia e Alexey se tulaga maualuga o le malamalama e tatau ai mo se ninja fa'apisinisi :) Na matou lafo fa'ailoga fa'amanatu i le manumalo. Faafetai tele i sui uma!

puna: www.habr.com