microsoft/ics-forensics-tools

S7RawFileParser: KeyError 'blocks' and S7BlockLogic: KeyError 'identity'

erithacus-rubecula opened this issue · 3 comments

Greetings,
I'm currently trying to examine this tool in the context of a tool study at my university and am running into trouble getting it to run on a small experimental setup with a Simens S7-1200 device. The example project is written using TIA-portal V17 and contains several code and data blocks.

The problems start when executing "python driver.py S7 --ip ips.csv",
which reads two slots at the given ip (ips.csv only contains one IP), even though there is only one device in the setup.
For both successful (ip, port, rack, slot) connections it also gives the warning: WARNING | S7 client blocks error for (ip, port, rack, slot).
The resulting [ip].json therefore only contains information about rack, slot, supported szl and some specific szl's.

Since the json file contains no information with key 'blocks'/'identity', the analysers have nothing to work with, throwing the errors as mentioned in the title.
The S7OnlineOfflineCompare likewise runs into the same problem.
I tried to see if a fresh, unprotected project containing only a data block would result in different behaviour, but the problems remain exactly the same and I'm not sure what to do about it.

Help and pointers towards resolving this problem would be much appreciated.
Regards

Hi,
Currently the framework only supports the S7Comm protocol, and has been tested on the S7-300/400 PLC series. The S7-1200 PLC communicates over the S7Comm Plus protocol and has a newer functionality that has not yet been tested.
I suggest you to setup a PLC simulator for your tests, with the supported versions.

Sorry for the late reply and thanks for the clarification.
I forwarded the info to the people that made the setup for future changes/tests.
Regards

It has been a while since this thread was active. As previously mentioned, there is still no support for the Siemens S7-1200 PLC series. I will be closing this issue, but please feel free to reopen it or create a new one if there are any further concerns that need to be addressed.