PLC-Bin2Src links PLC binaries to source code across platforms
PLC-Bin2Src: Retrieving Corresponding Structured Text Source Files for PLC Binaries
Software Engineering
Summary
It can be hard to figure out where some software parts come from when all you see is the compiled version, especially for industrial controllers called PLCs. The authors created a tool named PLC-Bin2Src that matches compiled PLC programs back to their original source code files, even when these programs come from different platforms. Their approach looks at the program’s flow and structure to find the best source file matches. Tests show it works accurately for multiple PLC platforms.
What this means in practice
- •For industrial control engineers: Identify source files for PLC binaries from multiple platforms to support firmware audits and vulnerability assessments.
- •For security auditors: Trace origins of black-box PLC binaries to assess risks and verify compliance in industrial environments.
Authors
Ang Jia, Yaxin Duan, He Jiang, Ming Fan, Zhilei Ren, Xiaochen Li
Abstract
Software reuse allows existing components and third-party libraries to be incorporated into new applications, but binary-only components can obscure their origins and implementations. Software composition analysis seeks to identify these reused components and trace their provenance, supporting dependency inventory, vulnerability assessment, and security auditing. For PLC applications, binary2source matching provides a core link in this analysis: given an opaque PLC binary artifact, retrieve its corresponding Structured Text (ST) source file from a collected source repository. However, this task is complicated by cross-platform compilation heterogeneity, the representation gap between PLC binaries and ST source code, and the granularity mismatch between recovered binary units and ST source files. This paper presents PLC-Bin2Src, a cross-platform binary2source matching framework for retrieving corresponding ST source files for binaries produced by CODESYS, GEB, OpenPLC v2, and OpenPLC v3. Platform-aware frontends construct comparable representations, and a shared backend equally combines control--data flow graph (CDFG), function call graph (FCG), and recovered-symbol similarities to rank source candidates. We evaluate PLC-Bin2Src on PLC-BEAD. Results show that PLC-Bin2Src achieves 95.89% Recall@1, 99.66% Recall@5, and an MRR of 0.9769 across four PLC platforms.