Ezinyathelweni ze-Industrial Ninja: ukuthi i-PLC yagqekezwa kanjani ku-Positive Hack Days 9

Nge-PHDays 9 yokugcina sibe nomncintiswano wokugebenga imboni yokumpompa igesi - umncintiswano I-Industrial Ninja. Kwakukhona izitendi ezintathu esizeni ezinamapharamitha okuphepha ahlukene (Akukho Ukuphepha, Ukuphepha Okuphansi, Ukuphepha Okuphezulu), okulingisa inqubo efanayo yezimboni: umoya ongaphansi kwengcindezi waphonswa ebhaluni (bese uyakhululwa).

Naphezu kwemingcele yokuphepha ehlukene, ukwakheka kwe-hardware yezitendi kwakufana: uchungechunge lwe-Siemens Simatic PLC S7-300; inkinobho yokunciphisa isimo esiphuthumayo kanye nedivayisi yokulinganisa ingcindezi (exhunywe kuma-PLC digital inputs (DI)); amavalvu asebenzela ukwehla kwamandla emali kanye nokwehliswa komoya (axhunywe emiphumeleni yedijithali ye-PLC (DO)) - bheka isibalo esingezansi.

I-PLC, kuye ngokufundwa kwengcindezi futhi ngokuhambisana nohlelo lwayo, yenza isinqumo sokukhipha umoya noma ukufutha ibhola (ivule futhi ivale ama-valve ahambisanayo). Kodwa-ke, zonke izitendi zazinemodi yokulawula ngesandla, eyenza kube nokwenzeka ukulawula izifunda zama-valve ngaphandle kwemingcele.

Izitendi zihluke ngobunkimbinkimbi bokuvumela le modi: esitendini esingavikelekile bekulula ukwenza lokhu, futhi esitendeni Sokuphepha Okuphezulu bekunzima ngokuhambisanayo.

Izinkinga ezinhlanu kweziyisithupha zaxazululwa ngezinsuku ezimbili; Umhlanganyeli osendaweni yokuqala uthole amaphuzu angama-233 (uchithe isonto lonke elungiselela umncintiswano). Abaphumelele abathathu: Ngibeka - a1exdandy, II - Rubikoid, III - Ze.

Kodwa-ke, phakathi kwama-PHDays, akekho noyedwa kwababambe iqhaza owakwazi ukunqoba zonke izinkundla ezintathu, ngakho-ke sanquma ukwenza umncintiswano we-inthanethi futhi sashicilela umsebenzi onzima kakhulu ekuqaleni kukaJuni. Abahlanganyeli kwakudingeka baqedele umsebenzi phakathi nenyanga, bathole ifulege, futhi bachaze isisombululo ngokuningiliziwe nangendlela ethakazelisayo.

Ngezansi kwesinqamuleli sishicilela ukuhlaziya kwesixazululo esingcono kakhulu somsebenzi kulabo abathunyelwe phakathi nenyanga, kutholwe u-Alexey Kovrizhnykh (a1exdandy) wenkampani yeDigital Security, othathe indawo yokuqala emqhudelwaneni phakathi nama-PHDays. Ngezansi sethula umbhalo wayo namazwana ethu.

Ukuhlaziya kokuqala

Ngakho, umsebenzi wawuqukethe ingobo yomlando enamafayela alandelayo:

• block_upload_traffic.pcapng
• DB100.bin
• Amacebo.txt

Ifayela le-hints.txt liqukethe ulwazi oludingekayo namacebiso okuxazulula umsebenzi. Nakhu elikuqukethe:

1. UPetrovich ungitshele izolo ukuthi ungalayisha amabhlogo kusuka ku-PlcSim ku-Step7.
2. Uchungechunge lwe-Siemens Simatic S7-300 PLC lusetshenziswe esitobhini.
3. I-PlcSim iyisimulator ye-PLC ekuvumela ukuthi usebenzise futhi ulungise izinhlelo zama-Siemens S7 PLC.

Ifayela le-DB100.bin libonakala liqukethe ibhulokhi yedatha ye-DB100 PLC: 00000000: 0100 0102 6e02 0401 0206 0100 0101 0102 ....n......... 00000010: 1002 0501 0202 2002 0501 0206 0100 0102 00000020 . ..... ......... 0102: 7702 0401 0206 0100 0103 0102 0 02a00000030 ..w............. 0501: 0202 1602 0501 0206 0100 0104 0102 ................ 00000040: 7502 0401 0206 0100 0105 0102 0a02 0501 u............... 00000050: 0202 1602 0501 0206 0100 0106 0102 3402..........4. 00000060: 0401 0206 0100 0107 0102 2602 0501 0202 .........&..... 00000070: 4c02 0501 0206 0100 0108 0102 3302 .........&..... 0401: 3c00000080 0206 0100 0109 0102 0 02 0501 0202. 1602 L00000090. : 0501 0206 0100 010 0102a3702 0401 0206 7 ................ 000000: 0 0100 010 0102a 2202 0501 0202 4602 ............ 0501a000000: 0 0206b 0100 010 0102 3302 0401 0206 ......".....F... 0100b3: 000000 0 010c 0102 0 02 ... ... .. 0501c0202: 1602d 0501 0206a000000 0 0100 010 0102 6 ................ 02d0401: 0206 0100e 010 000000d0 0102 1102 0501......0202m .... 2302e0501: 0206 0100 000000 0 0110 0102 3502 0401 ........#...... 0206f0100: 0111 0102 5 00000100 1202 0501 ....0202. ..... 2502: 0501 0206 0100 0112 00000110 0102 3302 0401 ......%......... 0206: 0100 0113 0102 2602 3 00000120 ..... 0501 . 0202 . .....&. 4: 02 0501 0206c0100 XNUMX XNUMX XNUMX ....L......

Njengoba igama liphakamisa, ifayela elithi block_upload_traffic.pcapng liqukethe ukulahlwa kwethrafikhi yokulayishwa kwebhulokhi ku-PLC.

Kuyaphawuleka ukuthi lokhu kulahlwa kwethrafikhi endaweni yokuncintisana phakathi nengqungquthela bekunzima kakhulu ukukuthola. Ukuze wenze lokhu, kwakudingeka ukuqonda iskripthi esivela kufayela lephrojekthi le-TeslaSCADA2. Kusuka kuyo bekungenzeka ukuqonda ukuthi indawo yokulahla ebethelwe kusetshenziswa i-RC4 itholakala kuphi nokuthi yimuphi ukhiye okudingeka usetshenziselwe ukuyisusa. Ukulahlwa kwamabhulokhi wedatha esizeni kungatholwa kusetshenziswa iklayenti lephrothokholi ye-S7. Kulokhu ngisebenzise iklayenti ledemo kusuka kuphakheji le-Snap7.

Ikhipha amabhlokhi okucubungula isignali endaweni yokulahla ithrafikhi

Uma ubheka okuqukethwe kwendawo yokulahla, ungaqonda ukuthi iqukethe amabhlokhi okucubungula amasignali OB1, FC1, FC2 kanye neFC3:

Lamabhulokhi kufanele asuswe. Lokhu kungenziwa, ngokwesibonelo, ngombhalo olandelayo, njengoba ngaphambilini uguqule ithrafikhi isuka kufomethi ye-pcapng yaba i-pcap:

#!/usr/bin/env python2

import struct
from scapy.all import *

packets = rdpcap('block_upload_traffic.pcap')
s7_hdr_struct = '>BBHHHHBB'
s7_hdr_sz = struct.calcsize(s7_hdr_struct)
tpkt_cotp_sz = 7
names = iter(['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin'])
buf = ''

for packet in packets:
    if packet.getlayer(IP).src == '10.0.102.11':
        tpkt_cotp_s7 = str(packet.getlayer(TCP).payload)
        if len(tpkt_cotp_s7) < tpkt_cotp_sz + s7_hdr_sz:
            continue
        s7 = tpkt_cotp_s7[tpkt_cotp_sz:]
        s7_hdr = s7[:s7_hdr_sz]
        param_sz = struct.unpack(s7_hdr_struct, s7_hdr)[4]
        s7_param = s7[12:12+param_sz]
        s7_data = s7[12+param_sz:]
        if s7_param in ('x1ex00', 'x1ex01'):  # upload
            buf += s7_data[4:]
        elif s7_param == 'x1f':
            with open(next(names), 'wb') as f:
                f.write(buf)
            buf = ''

Ngemva kokuhlola amabhlogo avelayo, uzobona ukuthi ahlala eqala ngamabhayithi 70 70 (pp). Manje udinga ukufunda ukuthi ungazihlaziya kanjani. Iseluleko sesabelo siphakamisa ukuthi udinga ukusebenzisa i-PlcSim kulokhu.

Ukuthola imiyalelo engafundwa umuntu kumabhulokhi

Okokuqala, ake sizame ukuhlela i-S7-PlcSim ngokulayisha amabhulokhi ambalwa aneziqondiso eziphindaphindayo (= Q 0.0) kuwo sisebenzisa isofthiwe yesiphathi se-Simatic, futhi silondoloze i-PLC etholwe kusifanisi kufayela le-example.plc. Ngokubheka okuqukethwe kwefayela, ungakwazi ukunquma kalula ukuqala kwamabhulokhi alandiwe ngesiginesha ethi 70 70, esiyithole ekuqaleni. Ngaphambi kwamabhulokhi, ngokusobala, usayizi webhulokhi ubhalwe njengenani le-4-byte little-endian.

Ngemva kokuthola ulwazi mayelana nesakhiwo samafayela e-plc, uhlelo lokusebenza olulandelayo luvele lokufunda izinhlelo ze-PLC S7:

1. Sisebenzisa Umphathi we-Simatic, sakha isakhiwo sebhulokhi ku-S7-PlcSim esifana nalesi esisithole endaweni yokulahla. Osayizi bebhulokhi kufanele bahambisane (lokhu kufezwa ngokugcwalisa amabhlogo ngenombolo edingekayo yemiyalelo) kanye nezihlonzi zawo (OB1, FC1, FC2, FC3).
2. Londoloza i-PLC efayeleni.
3. Sibuyisela okuqukethwe kwamabhulokhi efayeleni eliwumphumela ngamabhulokhi avela endaweni yokulahla ithrafikhi. Ukuqala kwamabhulokhi kunqunywa isiginesha.
4. Silayisha ifayela eliwumphumela ku-S7-PlcSim futhi sibheke okuqukethwe kwamabhulokhi ku-Simatic Manager.

Amabhulokhi angashintshwa, isibonelo, ngekhodi elandelayo:

with open('original.plc', 'rb') as f:
    plc = f.read()
blocks = []
for fname in ['OB1.bin', 'FC1.bin', 'FC2.bin', 'FC3.bin']:
    with open(fname, 'rb') as f:
        blocks.append(f.read())

i = plc.find(b'pp')
for block in blocks:
    plc = plc[:i] + block + plc[i+len(block):]
    i = plc.find(b'pp', i + 1)

with open('target.plc', 'wb') as f:
    f.write(plc)

U-Alexey wathatha indlela enzima kakhulu, kodwa elungile. Sicabange ukuthi ababambiqhaza bazosebenzisa uhlelo lwe-NetToPlcSim ukuze i-PlcSim ikwazi ukuxhumana ngenethiwekhi, ilayishe amabhulokhi ku-PlcSim nge-Snap7, bese ilanda la mabhulokhi njengephrojekthi evela ku-PlcSim isebenzisa indawo yokuthuthukisa.

Ngokuvula ifayela eliwumphumela ku-S7-PlcSim, ungafunda amabhulokhi abhalwe ngaphezulu usebenzisa Isiphathi Se-Simatic. Imisebenzi yokulawula idivayisi eyinhloko irekhodwa kubhulokhi FC1. Okuphawuleka ngokukhethekile ukuguquguquka kwe-#TEMP0, okuthi uma kuvuliwe kubonakale kusetha isilawuli se-PLC kumodi yezandla ngokusekelwe kumanani ememori ye-M2.2 kanye ne-M2.3 bit. Inani #TEMP0 lisethwa umsebenzi FC3.

Ukuze uxazulule inkinga, udinga ukuhlaziya umsebenzi we-FC3 futhi uqonde ukuthi yini okufanele yenziwe ukuze ibuyisele okunengqondo.

Amabhulokhi wokucubungula amasignali we-PLC endaweni yokuma Yezokuphepha Eziphansi endaweni yokuncintisana ahlelwe ngendlela efanayo, kodwa ukusetha inani lokuguquguquka kwe-#TEMP0, kwanele ukubhala umugqa indlela yami ye-ninja ku-DB1 block. Ukuhlola inani kubhulokhi kwakuqondile futhi kwakungadingi ulwazi olujulile lolimi lohlelo lwebhulokhi. Ngokusobala, ezingeni Lokuphepha Okuphezulu, ukuzuza ukulawula okwenziwa ngesandla kuzoba nzima kakhulu futhi kuyadingeka ukuqonda ubunkimbinkimbi bolimi lwe-STL (enye yezindlela zokuhlela i-S7 PLC).

Buyela emuva block FC3

Okuqukethwe kwebhulokhi ye-FC3 ekumelelweni kwe-STL:

      L     B#16#0
      T     #TEMP13
      T     #TEMP15
      L     P#DBX 0.0
      T     #TEMP4
      CLR   
      =     #TEMP14
M015: L     #TEMP4
      LAR1  
      OPN   DB   100
      L     DBLG
      TAR1  
      <=D   
      JC    M016
      L     DW#16#0
      T     #TEMP0
      L     #TEMP6
      L     W#16#0
      <>I   
      JC    M00d
      L     P#DBX 0.0
      LAR1  
M00d: L     B [AR1,P#0.0]
      T     #TEMP5
      L     W#16#1
      ==I   
      JC    M007
      L     #TEMP5
      L     W#16#2
      ==I   
      JC    M008
      L     #TEMP5
      L     W#16#3
      ==I   
      JC    M00f
      L     #TEMP5
      L     W#16#4
      ==I   
      JC    M00e
      L     #TEMP5
      L     W#16#5
      ==I   
      JC    M011
      L     #TEMP5
      L     W#16#6
      ==I   
      JC    M012
      JU    M010
M007: +AR1  P#1.0
      L     P#DBX 0.0
      LAR2  
      L     B [AR1,P#0.0]
      L     C#8
      *I    
      +AR2  
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M003
      JU    M001
      JU    M002
      JU    M004
M003: JU    M005
M001: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP0
      JU    M006
M002: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP1
      JU    M006
M004: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #TEMP2
      JU    M006
M00f: +AR1  P#1.0
      L     B [AR1,P#0.0]
      L     C#8
      *I    
      T     #TEMP11
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      TAR1  #TEMP4
      OPN   DB   101
      L     P#DBX 0.0
      LAR1  
      L     #TEMP11
      +AR1  
      LAR2  #TEMP9
      L     B [AR2,P#0.0]
      T     B [AR1,P#0.0]
      L     #TEMP4
      LAR1  
      JU    M006
M008: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP3
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M009
      JU    M00b
      JU    M00a
      JU    M00c
M009: JU    M005
M00b: L     #TEMP3
      T     #TEMP0
      JU    M006
M00a: L     #TEMP3
      T     #TEMP1
      JU    M006
M00c: L     #TEMP3
      T     #TEMP2
      JU    M006
M00e: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      AW    
      INVI  
      T     #TEMP12
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      OW    
      L     #TEMP12
      AW    
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #TEMP0
      L     MB   101
      T     #TEMP1
      L     MB   102
      T     #TEMP2
      L     #TEMP4
      LAR1  
      JU    M006
M011: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      -I    
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #TEMP0
      L     MB   101
      T     #TEMP1
      L     MB   102
      T     #TEMP2
      L     #TEMP4
      LAR1  
      JU    M006
M012: L     #TEMP15
      INC   1
      T     #TEMP15
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10
      TAR1  #TEMP4
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      ==I   
      JCN   M013
      JU    M014
M013: L     P#DBX 0.0
      LAR1  
      T     #TEMP4
      L     B#16#0
      T     #TEMP6
      JU    M006
M014: L     #TEMP4
      LAR1  
      L     #TEMP13
      L     L#1
      +I    
      T     #TEMP13
      JU    M006
M006: L     #TEMP0
      T     MB   100
      L     #TEMP1
      T     MB   101
      L     #TEMP2
      T     MB   102
      +AR1  P#1.0
      L     #TEMP6
      +     1
      T     #TEMP6
      JU    M005
M010: L     P#DBX 0.0
      LAR1  
      L     0
      T     #TEMP6
      TAR1  #TEMP4
M005: TAR1  #TEMP4
      CLR   
      =     #TEMP16
      L     #TEMP13
      L     L#20
      ==I   
      S     #TEMP16
      L     #TEMP15
      ==I   
      A     #TEMP16
      JC    M017
      L     #TEMP13
      L     L#20
      <I    
      S     #TEMP16
      L     #TEMP15
      ==I   
      A     #TEMP16
      JC    M018
      JU    M019
M017: SET   
      =     #TEMP14
      JU    M016
M018: CLR   
      =     #TEMP14
      JU    M016
M019: CLR   
      O     #TEMP14
      =     #RET_VAL
      JU    M015
M016: CLR   
      O     #TEMP14
      =     #RET_VAL

Ikhodi yinde impela futhi ingase ibonakale iyinkimbinkimbi kumuntu ongayazi i-STL. Asikho isidingo sokuhlaziya umyalelo ngamunye ngaphakathi kohlaka lwalesi sihloko; imiyalelo enemininingwane namandla olimi lwe-STL angatholakala kumanuwali ahambisanayo: Uhlu Lwesitatimende (STL) lwe-S7-300 kanye ne-S7-400 Programming. Lapha ngizokwethula ikhodi efanayo ngemva kokucubungula - ukuqamba kabusha amalebula nokuguquguquka nokungeza amazwana achaza i-algorithm yokusebenza kanye nokwakhiwa kolimi lwe-STL. Ake ngiqaphele ngokushesha ukuthi ibhulokhi okukhulunywa ngayo iqukethe umshini obonakalayo osebenzisa i-bytecode ethile etholakala kubhulokhi ye-DB100, okuqukethwe esikwaziyo. Imiyalo yomshini obonakalayo iqukethe ibhayithi elingu-1 lekhodi yokusebenza namabhayithi wama-agumenti, ibhayithi elilodwa ku-agumenti ngayinye. Yonke imiyalo ecatshangelwayo inezimpikiswano ezimbili; ngiqoke amanani abo kumazwana njengo-X no-Y.

Ikhodi ngemva kokucubungula]

# Инициализация различных переменных
      L     B#16#0
      T     #CHECK_N        # Счетчик успешно пройденных проверок
      T     #COUNTER_N      # Счетчик общего количества проверок
      L     P#DBX 0.0
      T     #POINTER        # Указатель на текущую инструкцию
      CLR   
      =     #PRE_RET_VAL

# Основной цикл работы интерпретатора байт-кода
LOOP: L     #POINTER
      LAR1  
      OPN   DB   100
      L     DBLG
      TAR1  
      <=D                   # Проверка выхода указателя за пределы программы
      JC    FINISH
      L     DW#16#0
      T     #REG0
      L     #TEMP6
      L     W#16#0
      <>I   
      JC    M00d
      L     P#DBX 0.0
      LAR1  

# Конструкция switch - case для обработки различных опкодов
M00d: L     B [AR1,P#0.0]
      T     #OPCODE
      L     W#16#1
      ==I   
      JC    OPCODE_1
      L     #OPCODE
      L     W#16#2
      ==I   
      JC    OPCODE_2
      L     #OPCODE
      L     W#16#3
      ==I   
      JC    OPCODE_3
      L     #OPCODE
      L     W#16#4
      ==I   
      JC    OPCODE_4
      L     #OPCODE
      L     W#16#5
      ==I   
      JC    OPCODE_5
      L     #OPCODE
      L     W#16#6
      ==I   
      JC    OPCODE_6
      JU    OPCODE_OTHER

# Обработчик опкода 01: загрузка значения из DB101[X] в регистр Y
# OP01(X, Y): REG[Y] = DB101[X]
OPCODE_1: +AR1  P#1.0
      L     P#DBX 0.0
      LAR2  
      L     B [AR1,P#0.0]   # Загрузка аргумента X (индекс в DB101)
      L     C#8
      *I    
      +AR2  
      +AR1  P#1.0
      L     B [AR1,P#0.0]   # Загрузка аргумента Y (индекс регистра)
      JL    M003            # Аналог switch - case на основе значения Y
      JU    M001            # для выбора необходимого регистра для записи.
      JU    M002            # Подобные конструкции используются и в других
      JU    M004            # операциях ниже для аналогичных целей
M003: JU    LOOPEND
M001: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG0           # Запись значения DB101[X] в REG[0]
      JU    PRE_LOOPEND
M002: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG1           # Запись значения DB101[X] в REG[1]
      JU    PRE_LOOPEND
M004: OPN   DB   101
      L     B [AR2,P#0.0]
      T     #REG2           # Запись значения DB101[X] в REG[2]
      JU    PRE_LOOPEND

# Обработчик опкода 02: загрузка значения X в регистр Y
# OP02(X, Y): REG[Y] = X
OPCODE_2: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP3
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      JL    M009
      JU    M00b
      JU    M00a
      JU    M00c
M009: JU    LOOPEND
M00b: L     #TEMP3
      T     #REG0
      JU    PRE_LOOPEND
M00a: L     #TEMP3
      T     #REG1
      JU    PRE_LOOPEND
M00c: L     #TEMP3
      T     #REG2
      JU    PRE_LOOPEND

# Опкод 03 не используется в программе, поэтому пропустим его
...

# Обработчик опкода 04: сравнение регистров X и Y
# OP04(X, Y): REG[0] = 0; REG[X] = (REG[X] == REG[Y])
OPCODE_4: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7          # первый аргумент - X
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          # REG[X]
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9          # REG[X]
      LAR2  #TEMP10         # REG[Y]
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      AW    
      INVI  
      T     #TEMP12         # ~(REG[Y] & REG[X])
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      OW    
      L     #TEMP12
      AW                    # (~(REG[Y] & REG[X])) & (REG[Y] | REG[X]) - аналог проверки на равенство
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #REG0
      L     MB   101
      T     #REG1
      L     MB   102
      T     #REG2
      L     #POINTER
      LAR1  
      JU    PRE_LOOPEND

# Обработчик опкода 05: вычитание регистра Y из X
# OP05(X, Y): REG[0] = 0; REG[X] = REG[X] - REG[Y]
OPCODE_5: +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          # REG[X]
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9
      LAR2  #TEMP10
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      -I                    # ACCU1 = ACCU2 - ACCU1, REG[X] - REG[Y]
      T     B [AR1,P#0.0]
      L     DW#16#0
      T     #REG0
      L     MB   101
      T     #REG1
      L     MB   102
      T     #REG2
      L     #POINTER
      LAR1  
      JU    PRE_LOOPEND

# Обработчик опкода 06: инкремент #CHECK_N при равенстве регистров X и Y
# OP06(X, Y): #CHECK_N += (1 if REG[X] == REG[Y] else 0)
OPCODE_6: L     #COUNTER_N
      INC   1
      T     #COUNTER_N
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP7          #  REG[X]     
      L     P#M 100.0
      LAR2  
      L     #TEMP7
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP9          #  REG[X]  
      +AR1  P#1.0
      L     B [AR1,P#0.0]
      T     #TEMP8
      L     P#M 100.0
      LAR2  
      L     #TEMP8
      L     C#8
      *I    
      +AR2  
      TAR2  #TEMP10         # REG[Y]
      TAR1  #POINTER
      LAR1  #TEMP9          # REG[Y]
      LAR2  #TEMP10         # REG[X]
      L     B [AR1,P#0.0]
      L     B [AR2,P#0.0]
      ==I   
      JCN   M013
      JU    M014
M013: L     P#DBX 0.0
      LAR1  
      T     #POINTER
      L     B#16#0
      T     #TEMP6
      JU    PRE_LOOPEND
M014: L     #POINTER
      LAR1  
# Инкремент значения #CHECK_N
      L     #CHECK_N
      L     L#1
      +I    
      T     #CHECK_N
      JU    PRE_LOOPEND

PRE_LOOPEND: L     #REG0
      T     MB   100
      L     #REG1
      T     MB   101
      L     #REG2
      T     MB   102
      +AR1  P#1.0
      L     #TEMP6
      +     1
      T     #TEMP6
      JU    LOOPEND

OPCODE_OTHER: L     P#DBX 0.0
      LAR1  
      L     0
      T     #TEMP6
      TAR1  #POINTER

LOOPEND: TAR1  #POINTER
      CLR   
      =     #TEMP16
      L     #CHECK_N
      L     L#20
      ==I   
      S     #TEMP16
      L     #COUNTER_N
      ==I   
      A     #TEMP16
# Все проверки пройдены, если #CHECK_N == #COUNTER_N == 20
      JC    GOOD
      L     #CHECK_N
      L     L#20
      <I    
      S     #TEMP16
      L     #COUNTER_N
      ==I   
      A     #TEMP16
      JC    FAIL
      JU    M019
GOOD: SET   
      =     #PRE_RET_VAL
      JU    FINISH
FAIL: CLR   
      =     #PRE_RET_VAL
      JU    FINISH
M019: CLR   
      O     #PRE_RET_VAL
      =     #RET_VAL
      JU    LOOP
FINISH: CLR   
      O     #PRE_RET_VAL
      =     #RET_VAL

Njengoba sesinombono wemiyalo yomshini obonakalayo, masibhale i-disassembler encane ukuze sihlukanise i-bytecode kubhlokhi ye-DB100:

import string
alph = string.ascii_letters + string.digits

with open('DB100.bin', 'rb') as f:
    m = f.read()

pc = 0

while pc < len(m):
    op = m[pc]
    if op == 1:
        print('R{} = DB101[{}]'.format(m[pc + 2], m[pc + 1]))
        pc += 3
    elif op == 2:
        c = chr(m[pc + 1])
        c = c if c in alph else '?'
        print('R{} = {:02x} ({})'.format(m[pc + 2], m[pc + 1], c))
        pc += 3
    elif op == 4:
        print('R0 = 0; R{} = (R{} == R{})'.format(
            m[pc + 1], m[pc + 1], m[pc + 2]))
        pc += 3
    elif op == 5:
        print('R0 = 0; R{} = R{} - R{}'.format(
            m[pc + 1], m[pc + 1], m[pc + 2]))
        pc += 3
    elif op == 6:
        print('CHECK (R{} == R{})n'.format(
            m[pc + 1], m[pc + 2]))
        pc += 3
    else:
        print('unk opcode {}'.format(op))
        break

Ngenxa yalokho, sithola ikhodi yomshini elandelayo elandelayo:

Ikhodi yomshini ebonakalayo

R1 = DB101[0]
R2 = 6e (n)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[1]
R2 = 10 (?)
R0 = 0; R1 = R1 - R2
R2 = 20 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[2]
R2 = 77 (w)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[3]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[4]
R2 = 75 (u)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[5]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[6]
R2 = 34 (4)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[7]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[8]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[9]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[10]
R2 = 37 (7)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[11]
R2 = 22 (?)
R0 = 0; R1 = R1 - R2
R2 = 46 (F)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[12]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[13]
R2 = 0a (?)
R0 = 0; R1 = R1 - R2
R2 = 16 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[14]
R2 = 6d (m)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[15]
R2 = 11 (?)
R0 = 0; R1 = R1 - R2
R2 = 23 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[16]
R2 = 35 (5)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[17]
R2 = 12 (?)
R0 = 0; R1 = R1 - R2
R2 = 25 (?)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

R1 = DB101[18]
R2 = 33 (3)
R0 = 0; R1 = (R1 == R2)
CHECK (R1 == R0)

R1 = DB101[19]
R2 = 26 (?)
R0 = 0; R1 = R1 - R2
R2 = 4c (L)
R0 = 0; R1 = R1 - R2
CHECK (R1 == R0)

Njengoba ubona, lolu hlelo luvele luhlole uhlamvu ngalunye olusuka ku-DB101 ngokulingana nenani elithile. Umugqa wokugcina wokuphasa wonke amasheke uthi: n0w u 4r3 7h3 m4573r. Uma lo mugqa ubekwe kubhulokhi ethi DB101, khona-ke ukulawula kwe-PLC okwenziwa ngesandla kuyasebenza futhi kuzokwazi ukuqhuma noma ukucekela phansi ibhaluni.


Yilokho kuphela! U-Alexey ubonise izinga eliphezulu lolwazi olufanele i-ninja yezimboni :) Sithumele imiklomelo ekhumbulekayo kowinile. Sibonga kakhulu kubo bonke ababambiqhaza!

Source: www.habr.com