Performing PLC Firmware Security Analysis
When to Use
- When assessing PLC security as part of an IEC 62443 component security evaluation (IEC 62443-4-2)
- When validating firmware integrity after a suspected compromise or supply chain attack
- When evaluating the security of a new PLC platform before deployment in critical infrastructure
- When performing vulnerability research on industrial control system devices in an authorized lab
- When responding to an incident where PLC logic or firmware tampering is suspected
Do not use on live production PLCs without explicit authorization and safety controls in place. Firmware extraction and analysis should be performed on lab devices or offline backups. Never upload PLC firmware to public analysis services. See performing-ics-penetration-testing for authorized live testing procedures.
Prerequisites
- Isolated lab environment with the target PLC hardware or an emulated environment
- PLC programming software for the target platform (Siemens TIA Portal, Rockwell Studio 5000, Schneider EcoStruxure)
- Firmware extraction tools (binwalk, firmware-mod-kit, JTAG/SWD debugger)
- Static analysis tools (Ghidra, IDA Pro, Binary Ninja with ARM/MIPS/PowerPC support)
- Understanding of PLC architecture (real-time OS, ladder logic execution, I/O scanning)
- Reference copy of known-good firmware for integrity comparison
Workflow
Step 1: Acquire PLC Firmware for Analysis
Extract or obtain PLC firmware through authorized methods. This can be done by downloading from the vendor, extracting from a lab device, or obtaining from a project backup.
"""PLC Firmware Acquisition and Integrity Verification.
Supports firmware extraction from project files, network downloads,
and binary image comparison against known-good baselines.
"""
import hashlib
import json
import os
import struct
import sys
import zipfile
from datetime import datetime
from pathlib import Path
class PLCFirmwareAcquisition:
"""Handles PLC firmware acquisition from various sources."""
def __init__(self, output_dir="firmware_analysis"):
self.output_dir = Path(output_dir)
self.output_dir.mkdir(exist_ok=True)
self.manifest = {
"acquisition_date": datetime.now().isoformat(),
"firmware_samples": [],
}
def extract_from_siemens_project(self, project_path):
"""Extract firmware/program blocks from Siemens TIA Portal project.
TIA Portal projects (.ap16/.ap17) are ZIP archives containing
XML-encoded PLC program blocks and system configuration.
"""
print(f"[*] Analyzing Siemens project: {project_path}")
results = {"platform": "Siemens", "blocks": []}
if zipfile.is_zipfile(project_path):
with zipfile.ZipFile(project_path, "r") as zf:
for info in zf.infolist():
if "ProgramBlocks" in info.filename or "SystemBlocks" in info.filename:
block_data = zf.read(info.filename)
block_hash = hashlib.sha256(block_data).hexdigest()
block_path = self.output_dir / info.filename.replace("/", "_")
block_path.write_bytes(block_data)
results["blocks"].append({
"name": info.filename,
"size": info.file_size,
"sha256": block_hash,
"extracted_to": str(block_path),
})
print(f" [+] Extracted: {info.filename} ({info.file_size} bytes)")
self.manifest["firmware_samples"].append(results)
return results
def extract_from_rockwell_project(self, acd_path):
"""Extract program data from Rockwell Studio 5000 ACD file.
ACD files contain controller program, tags, and configuration.
"""
print(f"[*] Analyzing Rockwell project: {acd_path}")
results = {"platform": "Rockwell/Allen-Bradley", "blocks": []}
with open(acd_path, "rb") as f:
header = f.read(256)
if b"RSLogix" in header or b"Studio 5000" in header:
f.seek(0)
full_data = f.read()
file_hash = hashlib.sha256(full_data).hexdigest()
results["blocks"].append({
"name": os.path.basename(acd_path),
"size": len(full_data),
"sha256": file_hash,
"header_signature": header[:16].hex(),
})
print(f" [+] Project hash: {file_hash}")
self.manifest["firmware_samples"].append(results)
return results
def compute_firmware_hash(self, firmware_path):
"""Compute multiple hashes of a firmware image for integrity tracking."""
data = Path(firmware_path).read_bytes()
return {
"file": str(firmware_path),
"size": len(data),
"md5": hashlib.md5(data).hexdigest(),
"sha256": hashlib.sha256(data).hexdigest(),
"sha512": hashlib.sha512(data).hexdigest(),
}
def compare_firmware_integrity(self, current_fw, baseline_fw):
"""Compare current firmware against known-good baseline."""
current_hash = self.compute_firmware_hash(current_fw)
baseline_hash = self.compute_firmware_hash(baseline_fw)
match = current_hash["sha256"] == baseline_hash["sha256"]
result = {
"comparison_date": datetime.now().isoformat(),
"current_firmware": current_hash,
"baseline_firmware": baseline_hash,
"integrity_match": match,
"verdict": "PASS - Firmware matches baseline" if match else "FAIL - Firmware modified!",
}
if not match:
current_data = Path(current_fw).read_bytes()
baseline_data = Path(baseline_fw).read_bytes()
min_len = min(len(current_data), len(baseline_data))
first_diff = None
diff_count = 0
for i in range(min_len):
if current_data[i] != baseline_data[i]:
if first_diff is None:
first_diff = i
diff_count += 1
result["first_difference_offset"] = f"0x{first_diff:08x}" if first_diff else None
result["total_different_bytes"] = diff_count
result["size_difference"] = len(current_data) - len(baseline_data)
return result
def save_manifest(self):
"""Save acquisition manifest."""
manifest_path = self.output_dir / "acquisition_manifest.json"
with open(manifest_path, "w") as f:
json.dump(self.manifest, f, indent=2)
print(f"\n[*] Manifest saved: {manifest_path}")
if __name__ == "__main__":
acq = PLCFirmwareAcquisition()
if len(sys.argv) < 2:
print("Usage:")
print(" python process.py extract-siemens <project.ap17>")
print(" python process.py extract-rockwell <project.acd>")
print(" python process.py compare <current.bin> <baseline.bin>")
sys.exit(1)
cmd = sys.argv[1]
if cmd == "extract-siemens" and len(sys.argv) > 2:
acq.extract_from_siemens_project(sys.argv[2])
elif cmd == "extract-rockwell" and len(sys.argv) > 2:
acq.extract_from_rockwell_project(sys.argv[2])
elif cmd == "compare" and len(sys.argv) > 3:
result = acq.compare_firmware_integrity(sys.argv[2], sys.argv[3])
print(json.dumps(result, indent=2))
else:
print("Invalid command")
sys.exit(1)
acq.save_manifest()
Step 2: Perform Static Analysis of Firmware Image
Use binwalk for firmware unpacking and Ghidra for disassembly to identify security issues in the firmware binary.
binwalk -e firmware.bin
binwalk firmware.bin
strings -n 8 firmware.bin > firmware_strings.txt
grep -iE "(password|passwd|pwd|secret|key|credential|login|admin|root)" firmware_strings.txt
grep -iE "(http|ftp|telnet|ssh|snmp|modbus|192\.168|10\.|172\.)" firmware_strings.txt
grep -iE "(debug|backdoor|test_mode|factory|service_port|hidden)" firmware_strings.txt
grep -iE "(BEGIN RSA|BEGIN CERTIFICATE|AES|DES|private.key)" firmware_strings.txt
binwalk -E firmware.bin
analyzeHeadless /tmp/ghidra_project PLC_FW \
-import firmware.bin \
-processor ARM:LE:32:Cortex \
-postScript FindCryptoConstants.java \
-postScript FindHardcodedStrings.java \
-log /tmp/ghidra_analysis.log
Step 3: Analyze PLC Communication Stack Security
Examine how the PLC handles industrial protocol requests, focusing on authentication bypass, buffer overflows in packet parsing, and command injection vulnerabilities.
"""PLC Protocol Security Analyzer.
Tests PLC protocol implementation for common vulnerabilities
including authentication bypass, malformed packet handling,
and function code access control.
WARNING: Only run against lab/test PLCs, never production systems.
"""
import socket
import struct
import sys
import time
from dataclasses import dataclass
@dataclass
class ProtocolTestResult:
test_name: str
target: str
protocol: str
result: str
severity: str
detail: str
class ModbusSecurityTester:
"""Tests Modbus/TCP implementation security."""
def __init__(self, target_ip, target_port=502):
self.target = target_ip
self.port = target_port
self.results = []
def _send_modbus(self, unit_id, func_code, data=b""):
"""Send a Modbus/TCP request and return response."""
mbap = struct.pack(">HHHB", 0x0001, 0x0000, len(data) + 2, unit_id)
pdu = struct.pack("B", func_code) + data
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout()
sock.connect((.target, .port))
sock.send(mbap + pdu)
response = sock.recv()
sock.close()
response
Exception e:
():
read_data = struct.pack(, , )
response = ._send_modbus(, , read_data)
response (response) > response[] != :
.results.append(ProtocolTestResult(
test_name=,
target=.target,
protocol=,
result=,
severity=,
detail=,
))
write_data = struct.pack(, , )
response = ._send_modbus(, , write_data)
response (response) > response[] != :
.results.append(ProtocolTestResult(
test_name=,
target=.target,
protocol=,
result=,
severity=,
detail=,
))
():
dangerous_funcs = {
: ,
: ,
: ,
}
fc, desc dangerous_funcs.items():
response = ._send_modbus(, fc, )
response (response) > :
error_code = response[]
error_code != (fc | ):
.results.append(ProtocolTestResult(
test_name=,
target=.target,
protocol=,
result=,
severity=,
detail=,
))
():
read_data = struct.pack(, , )
response = ._send_modbus(, , read_data)
response (response) > response[] != :
.results.append(ProtocolTestResult(
test_name=,
target=.target,
protocol=,
result=,
severity=,
detail=,
))
():
malformed = struct.pack(, , , ) +
:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout()
sock.connect((.target, .port))
sock.send(malformed)
time.sleep()
read_data = struct.pack(, , )
response = ._send_modbus(, , read_data)
sock.close()
response :
.results.append(ProtocolTestResult(
test_name=,
target=.target,
protocol=,
result=,
severity=,
detail=,
))
:
.results.append(ProtocolTestResult(
test_name=,
target=.target,
protocol=,
result=,
severity=,
detail=,
))
Exception e:
():
()
()
()
.test_authentication_required()
.test_function_code_access_control()
.test_invalid_unit_id()
.test_malformed_packet_handling()
r .results:
icon = r.result ==
()
()
()
.results
__name__ == :
(sys.argv) < :
()
()
sys.exit()
target = sys.argv[]
port = (sys.argv[]) (sys.argv) >
tester = ModbusSecurityTester(target, port)
tester.run_all_tests()
Key Concepts
| Term | Definition |
|---|
| PLC Firmware | The embedded software running on a Programmable Logic Controller, including the real-time operating system, protocol stacks, and I/O drivers |
| Ladder Logic | Graphical programming language for PLCs that represents relay logic circuits, stored as program blocks in PLC memory |
| Function Block | Reusable PLC programming element that encapsulates logic with defined inputs/outputs, can be analyzed for malicious modifications |
| Firmware Integrity | Verification that PLC firmware has not been modified from the vendor-supplied or approved version using cryptographic hash comparison |
| IEC 62443-4-2 | Component security requirements in the IEC 62443 standard, defining security capabilities required for IACS components including PLCs |
| JTAG/SWD | Hardware debug interfaces (Joint Test Action Group / Serial Wire Debug) used for firmware extraction and low-level analysis |
Tools & Systems
- Binwalk: Firmware analysis tool for scanning, extracting, and analyzing embedded firmware images
- Ghidra: NSA-developed reverse engineering framework supporting ARM, MIPS, PowerPC architectures common in PLCs
- EMUX/FIRMADYNE: Firmware emulation frameworks for dynamic analysis of embedded device firmware
- PLCinject: Research tool for analyzing PLC logic injection vulnerabilities (use only in authorized lab settings)
- OpenPLC: Open-source PLC platform useful as a test target for security research
Output Format
PLC Firmware Security Analysis Report
=======================================
Device: [PLC Model and Firmware Version]
Analysis Date: YYYY-MM-DD
Methodology: Static + Dynamic Analysis
FIRMWARE INTEGRITY:
SHA-256: [hash]
Baseline Match: [Yes/No]
Vendor Signature Valid: [Yes/No/Not Signed]
VULNERABILITIES FOUND:
[PLC-001] [Severity] [Title]
CWE: [CWE-ID]
Detail: [Technical description]
Impact: [Operational impact]
Remediation: [Fix or mitigation]
