One Step Further: Understanding PLC Binaries Through Cross-Platform Reverse Engineering and Function-Level Semantic Analysis

• URL: http://arxiv.org/abs/2605.17392v2
• Date: Wed, 20 May 2026 09:47:32 GMT
• Title: One Step Further: Understanding PLC Binaries Through Cross-Platform Reverse Engineering and Function-Level Semantic Analysis
• Abstract summary: PLC-BinX is a BCA workflow for cross-platform PLC binary understanding.<n>Under ten-fold program-level evaluation, PLC-BinX achieves 100.00% precision, recall, and F1 in toolchain prediction.<n>Results demonstrate that PLC-BinX provides an effective and interpretable approach to cross-platform PLC binary understanding.
• Score: 7.990445011559295
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As emerging attacks increasingly target Industrial Control Systems (ICS), the security of Programmable Logic Controllers (PLCs) has become a critical concern. Binary Code Analysis (BCA), which enables analysts to understand compiled programs without source code, is essential for ICS security tasks such as post-attack digital forensics and incident response. However, automated BCA for PLC binaries remains challenging due to three key issues: heterogeneous binary formats across PLC platforms, entangled program semantics caused by the mixture of control logic with runtime code, and limited semantic representations for interpretable and learning-based downstream analysis. In this paper, we present PLC-BinX, a BCA workflow for cross-platform PLC binary understanding. PLC-BinX analyzes PLC binaries from four platforms: CODESYS v3, GEB, OpenPLC v2, and OpenPLC v3, and recovers function-level information through cross-platform reverse engineering, core-function extraction, and function-level semantic representation construction. Based on the recovered semantic representations, we further study two downstream tasks: toolchain prediction and functionality prediction. Under ten-fold program-level evaluation, PLC-BinX achieves 100.00% precision, recall, and F1 in toolchain prediction, and 51.43% precision, 49.38% recall, and 49.18% F1 in functionality prediction over 22 labels. The results demonstrate that PLC-BinX provides an effective and interpretable approach to cross-platform PLC binary understanding by exposing task-relevant function-level semantics from heterogeneous PLC binaries.

Related papers

• PLC-Bin2Src: Retrieving Corresponding Structured Text Source Files for PLC Binaries [8.479104710721645]
  PLC developers reuse existing components and third-party libraries to reduce the cost of developing new applications.<n> binary2source matching can retrieve the corresponding Structured Text (ST) source file for a PLC binary from a candidate source repository.<n>We present PLC-Bin2Src, a cross-platform binary2source matching framework that retrieves corresponding ST source files for binaries produced by CODESYS, GEB, OpenPLC v2, and OpenPLC v3.
  arXiv  Detail & Related papers  (2026-09-08T10:52:46Z)
• PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact? [8.55906011630603]
  PLCBENCH is the first real-PLC hardware-in-the-loop framework for characterizing cyber-to-physical capability and its boundaries.<n>It combines vendor-native interaction, commercial PLC execution, closed-loop reduced-order process simulation, and independent outcome verification.<n>Results show that 98 episodes stop before a valid native read, whereas 62 reach a process-linked write but do not sustain the final objective.
  arXiv  Detail & Related papers  (2026-08-27T09:40:11Z)
• Training-Free Hashing-Based Attention via Binary Principal Components [62.88957443238231]
  Long-context large language models (LLMs) are increasingly deployed in real-world applications.<n>Existing sparse attention reduce computation by attending to fewer KV pairs, but often suffer from substantial accuracy degradation.<n>We present BinaryPC, a training-free, data-aware hashing-based sparse attention for long-context LLMs.
  arXiv  Detail & Related papers  (2026-08-05T03:19:21Z)
• Tracing the Thought of a Grandmaster-level Chess-Playing Transformer [62.403498221631715]
  We introduce a sparse decomposition framework to interpret Leela Chess Zero's internal computation.<n>We conduct a detailed case study showing that these pathways expose rich, interpretable considerations.<n>To the best of our knowledge, this is the first work to decompose the internal computation of a transformer on both computation and attention modules.
  arXiv  Detail & Related papers  (2026-04-11T11:11:06Z)
• GLM-OCR Technical Report [65.42028025507491]
  GLM-OCR is an efficient compact model designed for real-world document understanding.<n>It combines a CogViT visual encoder with a GLM language decoder, achieving a strong balance between computational efficiency and recognition performance.<n>Extensive evaluations on public benchmarks and industrial scenarios show that GLM-OCR achieves competitive or state-of-the-art performance.
  arXiv  Detail & Related papers  (2026-03-11T15:55:47Z)
• Cross-modal Retrieval Models for Stripped Binary Analysis [62.89251403093734]
  BinSeek is the first two-stage cross-modal retrieval framework for stripped binary code analysis.<n>It consists of two models: BinSeekEmbedding is trained on large-scale dataset to learn the semantic relevance of the binary code.<n>BinSeek-Reranker learns to carefully judge the relevance of the candidate code to the description with context augmentation.
  arXiv  Detail & Related papers  (2025-12-11T07:58:10Z)
• An Empirical Study on the Effectiveness of Large Language Models for Binary Code Understanding [50.17907898478795]
  This work proposes a benchmark to evaluate the effectiveness of Large Language Models (LLMs) in real-world reverse engineering scenarios.<n>Our evaluations reveal that existing LLMs can understand binary code to a certain extent, thereby improving the efficiency of binary code analysis.
  arXiv  Detail & Related papers  (2025-04-30T17:02:06Z)
• Bridging the PLC Binary Analysis Gap: A Cross-Compiler Dataset and Neural Framework for Industrial Control Systems [14.826593801448032]
  PLC-BEAD is a dataset containing 2431 compiled binaries from 700+ PLC programs across four major industrial compilers.<n>This novel dataset uniquely pairs each binary with its original Structured Text source code and standardized functionality labels.<n>We demonstrate the dataset's utility through PLCEmbed, a transformer-based framework for binary code analysis.
  arXiv  Detail & Related papers  (2025-02-27T03:27:37Z)
• CP-BCS: Binary Code Summarization Guided by Control Flow Graph and Pseudo Code [79.87518649544405]
  We present a control flow graph and pseudo code guided binary code summarization framework called CP-BCS. CP-BCS utilizes a bidirectional instruction-level control flow graph and pseudo code that incorporates expert knowledge to learn the comprehensive binary function execution behavior and logic semantics.
  arXiv  Detail & Related papers  (2023-10-24T14:20:39Z)
• ProgSG: Cross-Modality Representation Learning for Programs in Electronic Design Automation [38.023395256208055]
  High-level synthesis (HLS) allows a developer to compile a high-level description in the form of software code in C and C++. HLS tools still require microarchitecture decisions, expressed in terms of pragmas. We propose ProgSG allowing the source code sequence modality and the graph modalities to interact with each other in a deep and fine-grained way.
  arXiv  Detail & Related papers  (2023-05-18T09:44:18Z)
• Code Integrity Attestation for PLCs using Black Box Neural Network Predictions [6.328987417919762]
  We propose a practical code integrity checking solution based on privacy-preserving black box models. By exploiting the black box nature of the model, our solution maintains the privacy of the original PLC code. We evaluated our approach on a modern six-stage water treatment plant testbed, finding that it could predict actuator states from PLC inputs with near-100% accuracy.
  arXiv  Detail & Related papers  (2021-06-15T03:09:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.