Many industry specific solutions in the field of SCADA consist of unknown custom chips without public documentation. These Application Specific Integrated Circuits (ASICs) are often simple System on Chip (SoC) solutions with standardized modules and few custom functionalities like additional CAN-Bus interfaces etc.
During this talk we will present hardware reverse engineering of custom chips and how to find vulnerabilities by using the Siemens S7-1200 (v1 and v4) series as exemplary targets.
After opening the PLC, it was clear that all parts, except the main SoC, were off-the-shelf components. This was the case for both versions of the Siemens PLCs. Leaked boards for both chips, MB87M2230 and SIEMENS-A5E30235063 were found and bought on a Chinese online shop.
With these boards, more than 60 percent of the pins from both chips were reverse-engineered. With the help of an oscilloscope, the protocols and the different voltage levels were identified. Simple resistance measurements were also done to find all connections between the components and to determine the pin-resistance.
Additionally, the interfaces for the flash memories, the RAM and the JTAG-ports were also identified on both chips.
It was found that the SoC on the older S7-1200v1 series is a Fujitsu ARM-BE chip with the chip-ID 0x1406C009. After decapping the chip, a label became visible, setting the date when it was designed back to 2007.
The SoC on the newer S7-1200v4 is a ARM-Cortex-R4 r1p3 in big endian mode. For the newer PLC series (S7-1200v4) a working debug setup with a JTAG-adapter was created. This enabled us to dump/write memory, set breakpoints, modify the program counter and use all other features to do live debugging on the Siemens PLC. Since all S7-1200 devices share the same SoC, it is possible to enable debugging on all PLCs of this series.