Abstract: A system is disclosed for automatic retrieval and analysis of PLC code including at least one code disassembler configured to receive, via one or more passive or active scanners connected to an automation network, compiled code configured for execution on one or more devices of the automation network, the at least one code disassembler automatically disassembling the compiled code into program code. The system including an analyzing component configured to receive the program code from the code disassembler and to automatically analyze the program code for errors. The system including an alerting component configured to receive one or more detected errors from the analyzing component and to communicate or store the one or more detected errors.

Abstract: A method includes holding multiple primitives of a communication protocol, which is used for managing a controller that controls one or more field devices in an industrial control network. Multiple scenarios are defined, each corresponding to one or more respective sequences of primitives exchanged with the controller over the industrial control network for achieving a respective user-level operation. Multiple parsing rules for deriving the sequences of primitives from the respective scenarios are further defined. A sequence of primitives that were exchanged with the controller over the industrial control network is intercepted. An attempt to reconstruct from the intercepted sequence of primitives, using the parsing rules, one or more scenarios that each corresponds to the intercepted sequence of primitives is carried out, and, in response to succeeding in reconstructing one or more scenarios, extracting user-level information from the reconstructed scenarios.

Abstract: A method includes holding multiple primitives of a communication protocol, which is used for managing a controller that controls one or more field devices in an industrial control network. Multiple scenarios are defined, each corresponding to one or more respective sequences of primitives exchanged with the controller over the industrial control network for achieving a respective user-level operation. Multiple parsing rules for deriving the sequences of primitives from the respective scenarios are further defined. A sequence of primitives that were exchanged with the controller over the industrial control network is intercepted. An attempt to reconstruct from the intercepted sequence of primitives, using the parsing rules, one or more scenarios that each corresponds to the intercepted sequence of primitives is carried out, and, in response to succeeding in reconstructing one or more scenarios, extracting user-level information from the reconstructed scenarios.