ICSREF：一个工业控制系统二进制文件自动化逆向工程框架
ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries
摘要：
工业控制系统（ICS）的安全性在过去几年中受到越来越多的关注，因为发现了针对工业环境的真正威胁。尽管有这种关注，但用于可编程逻辑控制器的ICS二进制文件的逆向工程过程的自动化仍然是一个开放的问题，这主要是由于ICS供应商使用专有编译器。这种自动化可能是一把双刃剑;一方面，它可以加速数字取证调查和事件响应行动，另一方面，它可以动态生成恶意ICS有效载荷。在这项工作中，我们提出了一个结构化的方法，自动化的逆向工程过程中ICS二进制文件，考虑到其独特的特定领域的特点。我们应用这种方法来开发模块化的工业控制系统逆向工程框架（ICSREF），并实例化ICSREF模块，用于反转编译的二进制代码，广泛使用的软件栈和编译器的PLC。为了评估我们的框架，我们通过从公共代码库收集真实的PLC二进制文件以及内部开发二进制文件来创建样本数据库。我们的研究结果表明，ICSREF可以成功地处理不同的PLC二进制从不同的行业部门，无论使用的程序设计语言。此外，我们还在商用智能手机上部署了ICSREF，该智能手机可以针对化学过程测试平台编排和发起完全自动化的过程感知攻击。这个动态负载生成的示例展示了ICSREF如何在没有任何先验知识的情况下实现复杂的攻击。
英文摘要：
The security of Industrial Control Systems (ICS) has been attracting increased attention over the past years, following the discovery of real threats targeting industrial environments. Despite this attention, automation of the reverse engineering process of ICS binaries for programmable logic controllers remains an open problem, mainly due to the use of proprietary compilers by ICS vendors. Such automation could be a double-edged sword; on the one hand it could accelerate digital forensic investigations and incident response actions, while on the other hand it could enable dynamic generation of malicious ICS payloads. In this work, we propose a structured methodology that automates the reverse engineering process for ICS binaries taking into account their unique domain-specific characteristics. We apply this methodology to develop the modular Industrial Control Systems Reverse Engineering Framework (ICSREF), and instantiate ICSREF modules for reversing binaries compiled with CODESYS, a widely used software stack and compiler for PLCs. To evaluate our framework we create a database of samples by collecting real PLC binaries from public code repositories, as well as developing binaries in-house. Our results demonstrate that ICSREF can successfully handle diverse PLC binaries from varied industry sectors, irrespective of the programming language used. Furthermore, we deploy ICSREF on a commercial smartphone which orchestrates and launches a completely automated process-aware attack against a chemical process testbed. This example of dynamic payload generation showcases how ICSREF can enable sophisticated attacks without any prior knowledge.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
