Doors of Durin: The Veiled Gate to Siemens S7 Silicon
summary
Research uncovers a UART MFGT1 handshake in the S7-1200 bootloader that opens a diagnostic console; bootloader uses CRC32 (not cryptographic) for firmware checks. Hardware work includes decapping, X‑ray and a custom CPU mount; software work uses ~50 IDA Python scripts to parse 84,000 functions. Bootloader handlers (notably the 0x1C handler and 0x80) allow raw SPI/IRAM read/write, enabling RAM payload injection, firmware dumping (verified identical to Siemens update files) and eventual code execution — demos include remote RAM dump and a tic‑tac‑toe payload; Siemens is notified.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:49Process Automation
- 2:09What we do with much more complex control loops?
- 3:06Programmable Logic Controllers
- 4:56Recent Attacks Against ICS
- 7:51S7-1200 V4 PLC HARDWARE - SOC DECAP
- 8:43S7-1200 v4 Closer Look
- 9:25M25P40/ Serial Flash Embedded Memory (bootloader)
- 10:09S7-1200 Specs, 3D X-Ray Tomography
- 13:57Siemens Firmware Components
- 15:30Execution Mode Stack in S7-1200 v4
- 17:26ADONIS MPU Configuration at 0x000400B4
- 17:59Siemens Firmware Boot Process
- 18:21ADONIS Kernel
- 20:48Firmware Update Process On S7 PLC
- 22:05Decompressed Firmware Update File Structure
- 23:20Undocumented HTTP Handlers
- 24:42Special Access Feature
- 26:26Primary Handlers After Handshake
- 27:15x80 Handler, Update Mode Function
- 28:18Ox1C Primary Handler
- 29:53Siemens S7-1200 PLC Bootloader Arbitrary Code Execution
- 40:01Conclusions and Future Works
related talks
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
01h 46mTutorial: Introduction to Reverse Engineering
29mThe Spear to Break the Security Wall of S7Commplus
25mWhat's the DFIRence for ICS?
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
37mOpen Sesame! The full story behind opening a smart lock