Writing analyzer for Siemens PLC

Development
1

Hi there,

as a part of my master's thesis I'm going to write two analyzer which will be able detect S7Comm and S7CommPlus traffic used by Siemens PLCs. Both protocols are proprietary, so I have no official documentation. The goal is to monitor this kind of traffic and/or detect threats against those PLCs.
So far, I am able to read S7Comm traffic and generate various events, covering all standard and most of the additional (UserData) functions. This part is based on the code of Wireshark S7Comm dissector.

The S7CommPlus part is a little bit trickier. Unfortunately, the only code base I can use is an 4 year old git-repo, probably forked from the first S7CommPlus dissector written by Thomas Wiens (https://github.com/moki-ics/s7commwireshark/blob/master/src/s7comm_plus/packet-s7comm_plus.c).

After a quick glance I have discovered 2 "problems", where I hope you could help me.

1) Reassembling packets: Some S7CommPlus packets which payload is over a certain amount of bytes will be split and need to be reassembled. I don't know how to do that in Bro nor how I can keep track of which fragments belongs to the which packet. (LoC: 3917 to 4135)
2) Various payload: Some packets contain different payload, e.g. different addressing types, attributes and/or structures, even though the packet-type is the same (for example: a request packet can contain one or more objects. In each object, there can be various items of type A, B, C or D, each of them have a different structure). If I want to generate a Bro events which contains the payload as a parameter, how do I do that?

Any help will be appreciated!

Thanks.

Dane

2

1) Reassembling packets: Some S7CommPlus packets which payload is over a
certain amount of bytes will be split and need to be reassembled.

As a couple quick pointers, the DNP3 and DTLS analyzers face a similar
task, you might find some ideas there.

If I want to generate a Bro events which contains the payload as a
parameter, how do I do that?

If with "payload" you mean the raw bytes, you would pass that as a
string into the event. But it's hard to do much with raw data that in
script-land. The common way would be instead creating one event per
type of payload and then raising the corresponding event as you parse
packets and find out what's in there.

Robin

3

Hey Robin,

thanks for you answer. I will look through this files and see if I can use this kind of reassembling.

If with "payload" you mean the raw bytes, you would pass that as a
string into the event. But it's hard to do much with raw data that in
script-land. The common way would be instead creating one event per
type of payload and then raising the corresponding event as you parse
packets and find out what's in there.

No, I don't just want to put the whole data as a string into the event. Well, seems like I have to define a lot of different events and/or bro types (I don't know how many data types there are in total).

Thanks alot.

Dane