# ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries

**Authors:** Anastasis Keliris, Michail Maniatakos  
**arXiv:** [1812.03478](https://arxiv.org/abs/1812.03478)  
**Date:** 2018-12-09  
**Summary page:** https://www.summarizepaper.com/en/paper/1812.03478v1/

## Key points

- Security of Industrial Control Systems (ICS) is a major concern due to real threats targeting industrial environments
- Automating reverse engineering process for ICS binaries is challenging due to proprietary compilers used by ICS vendors
- Automation can accelerate digital forensic investigations and incident response actions, but also enable dynamic generation of malicious ICS payloads
- Authors propose a structured methodology that automates reverse engineering process for ICS binaries while considering unique domain-specific characteristics
- They develop the Industrial Control Systems Reverse Engineering Framework (ICSREF) with modular components designed for reversing CODESYS compiled binaries
- Evaluation shows ICSREF successfully handles diverse PLC binaries from various industry sectors regardless of programming language used
- Example showcases deployment of ICSREF on a commercial smartphone to launch an automated process-aware attack against a chemical process testbed
- ICSREF enables sophisticated attacks without requiring prior knowledge
- Research presents innovative framework that addresses challenges associated with reverse engineering ICS binaries, offering valuable insights for digital forensic investigations and incident response actions in industrial control systems.

## Summary

The security of Industrial Control Systems (ICS) has become a major concern due to the discovery of real threats targeting industrial environments. Automating the reverse engineering process for ICS binaries is challenging, primarily because ICS vendors use proprietary compilers. Automation could accelerate digital forensic investigations and incident response actions, but it could also enable the dynamic generation of malicious ICS payloads. To address this problem, the authors propose a structured methodology that automates the reverse engineering process for ICS binaries while considering their unique domain-specific characteristics. They develop the Industrial Control Systems Reverse Engineering Framework (ICSREF), which consists of modular components specifically designed for reversing binaries compiled with CODESYS, a widely used software stack and compiler for Programmable Logic Controllers (PLCs). To evaluate its effectiveness, a database of samples is created by collecting real PLC binaries from public code repositories and developing in-house binaries. The results demonstrate that ICSREF can successfully handle diverse PLC binaries from various industry sectors, regardless of the programming language used. Furthermore, an example is showcased where ICSREF is deployed on a commercial smartphone to orchestrate and launch an automated process-aware attack against a chemical process testbed. This highlights how ICSREF can enable sophisticated attacks without requiring any prior knowledge. Overall, this research presents an innovative framework that addresses the challenges associated with reverse engineering ICS binaries by automating this process and considering domain-specific characteristics; thus offering valuable insights for digital forensic investigations and incident response actions in industrial control systems.