Development of Programmable Logic Controller Emulator With QEMU

It is crucial to ensure the security of programmable logic controllers (PLCs), as any compromise of these devices can have a significant impact on the safety and stability of the industrial process. An exploited vulnerability could affect production, damage the plant, and potentially put people at risk. To make them secure, various forms of third-party testing can be performed. However, because the firmware and hardware used in most PLCs is proprietary, firmware testing is difficult. The firmware code may be encrypted, compressed, and/or obfuscated. Even if the firmware is acquired, it is unlikely to run without the PLC because it depends too much on the hardware, which means testing is limited by the availability and processing speed of the PLC. To solve this problem, emulation could be used to speed up testing, but to properly emulate the behavior of the hardware, knowledge of peripheral device communication is required. In this work, we present a method to obtain the necessary information to emulate a proprietary PLC and run its firmware in an emulator, which to our knowledge has not been done before. We acquired the bootloader and firmware for a Siemens S7-1200 PLC and modeled the communication between the firmware and the peripheral devices using reverse engineering methods. The models were then implemented in the QEMU emulator. The end result is a partial emulation of the PLC, demonstrating that emulation of even a proprietary PLC is possible. The emulation shows the potential for future integration with a dynamic testing tool.