Tool finds source code for programmable logic controller binaries quickly and accurately
PLC-Bin2Src: Retrieving Corresponding Structured Text Source Files for PLC Binaries
Software Engineering
Summary
It can be hard to figure out where the source code comes from just by looking at a program that runs on special industrial controllers called PLCs. The authors created a tool named PLC-Bin2Src that matches PLC program files back to their original source code written in Structured Text, even though different platforms produce different kinds of binary files. Their method combines information about the program's structure and symbols to find the right source code files. Tests showed the tool correctly identified the matching source file almost all the time across several popular PLC platforms.
Programmable Logic Controller (PLC)Structured Text (ST)binary-to-source matchingsoftware reusecontrol-data flow graphfunction call graphsoftware composition analysisCODESYSOpenPLCRecall@1
Authors
Ang Jia, Yaxin Duan, He Jiang, Ming Fan, Zhilei Ren, Xiaochen Li
Abstract
Software reuse allows existing components and third-party libraries to be incorporated into new applications, but binary-only components can obscure their origins and implementations. Software composition analysis seeks to identify these reused components and trace their provenance, supporting dependency inventory, vulnerability assessment, and security auditing. For PLC applications, binary2source matching provides a core link in this analysis: given an opaque PLC binary artifact, retrieve its corresponding Structured Text (ST) source file from a collected source repository. However, this task is complicated by cross-platform compilation heterogeneity, the representation gap between PLC binaries and ST source code, and the granularity mismatch between recovered binary units and ST source files. This paper presents PLC-Bin2Src, a cross-platform binary2source matching framework for retrieving corresponding ST source files for binaries produced by CODESYS, GEB, OpenPLC v2, and OpenPLC v3. Platform-aware frontends construct comparable representations, and a shared backend equally combines control--data flow graph (CDFG), function call graph (FCG), and recovered-symbol similarities to rank source candidates. We evaluate PLC-Bin2Src on PLC-BEAD. Results show that PLC-Bin2Src achieves 95.89% Recall@1, 99.66% Recall@5, and an MRR of 0.9769 across four PLC platforms.