cpld-crack-siemens-200plc.txt

可用来破解分析西门子200 PLC与模块的通讯协议

LIBRARY IEEE;
USE IEEE.STD_LOGIC_1164.ALL;
USE IEEE.STD_LOGIC_UNSIGNED.ALL;

ENTITY MAIN IS
	PORT(RESET, CTL1_UP, CTL2_UP, CTL3_UP, CLK_UP,INT1_DOWN, INT2_DOWN:IN STD_LOGIC;
		 INT1_UP, INT2_UP, CTL1_DOWN, CTL2_DOWN, CTL3_DOWN, CLK_DOWN,S7300_DIRCTL1, S7300_DIRCTL2,S7200_DIRCTL1,S7200_DIRCTL2:OUT STD_LOGIC;
		 DATA_UP,DATA_DOWN:INOUT STD_LOGIC;		
		 LED2,LED3,LED4:OUT BIT; 
				
		 TRIGGER:OUT STD_LOGIC;	-- 这个信号供测试用，当遇到不认识的命令时用来触发逻辑分析仪
		
		 ADDSTB,INIT,DATASTB,RW:IN STD_LOGIC;
		 PDIR,PDIR2,LPTINT,LPTWAIT,USER1,USER2,USER3:OUT STD_LOGIC;
 		 LPT_DATABUS:INOUT STD_LOGIC_VECTOR(7 DOWNTO 0)
		);
END MAIN;

ARCHITECTURE ARCH_MAIN OF MAIN IS
	TYPE STATE IS(IDLE, TRANSFERDATAUP, TRANSFERDATADOWN); 
	SIGNAL PRESENT_STATE:STATE;
	SIGNAL FLAG3,SENDORDERX,SYSCOUNT,SENDORDER,CMDCOUNT,DATACOUNT,CMDCOUNTCOPY,DATACOUNTCOPY:INTEGER RANGE 0 TO 100;

	SIGNAL CMDREG:STD_LOGIC_VECTOR(17 DOWNTO 0);
	SIGNAL DATAREG:STD_LOGIC_VECTOR(35 DOWNTO 0);	
	SIGNAL FLAG1,FLAG2,SENDOVER,CMDSTARTBIT,DATASTARTBIT,LONGTIME,NEWDATA,FULLFLAG,INT2_CUR,PARITY, PREPARITY,SYSCLK,INT1_CUR_TMP,INT1_DOWN_TMP,INT2_CTL_TMP:STD_LOGIC;	
	SIGNAL BUFFERBYTE1,BUFFERBYTE2,BUFFERBYTE3,BUFFERBYTE4:STD_LOGIC_VECTOR(7 DOWNTO 0);

	ATTRIBUTE KEEP: BOOLEAN;
	ATTRIBUTE KEEP OF INT2_CUR: SIGNAL IS TRUE;

 	COMPONENT  ALTUFM_OSC0_ALTUFM_OSC_7P3 IS 
	 PORT 
	 ( 
		 OSC	:	OUT  STD_LOGIC;
		 OSCENA	:	IN  STD_LOGIC
	 ); 
 	END COMPONENT;

	BEGIN
		PDIR<='0';								--PC控制字传输至CPLD
		PDIR2<='1';								--并口数据上传至PC		
		U1: ALTUFM_OSC0_ALTUFM_OSC_7P3 PORT MAP(SYSCLK,'1');
		S7200_DIRCTL1 <= '1';
		S7200_DIRCTL2 <= '0';		
		CTL1_DOWN <= CTL1_UP;
		CTL2_DOWN <= CTL2_UP;
		CTL3_DOWN <= CTL3_UP;
		CLK_DOWN <= CLK_UP;		
		INT1_UP <=  INT1_DOWN_TMP;
		INT2_UP <= INT2_DOWN; 

INT1_UP_PROC:PROCESS(RESET, SYSCLK, INT1_DOWN)
	BEGIN
		IF RESET = '0' THEN
			INT1_DOWN_TMP <= '1';
		ELSE
			IF SYSCLK ='1' AND SYSCLK'EVENT THEN 
				INT1_DOWN_TMP <= INT1_DOWN;
			END IF;
		END IF;
	END PROCESS;

---------------------------------------------------------------------------------------------
DIRCONTROL:PROCESS(CTL3_UP, PRESENT_STATE,DATA_DOWN,DATAREG)--控制数据方向
	BEGIN
		IF CTL3_UP = '0' AND PRESENT_STATE = TRANSFERDATAUP THEN
			S7300_DIRCTL1 <= '1';
			S7300_DIRCTL2 <= '0';
		ELSE 
			S7300_DIRCTL1 <= '0';
			S7300_DIRCTL2 <= '1';
		END IF;
	END PROCESS DIRCONTROL;

----------------------------------------------------------------------------------------------
DATADOWN:PROCESS(CTL1_UP, CTL3_UP, CLK_UP, PRESENT_STATE,DATA_UP,DATAREG)
	BEGIN

		IF CTL1_UP = '0' THEN
			DATA_DOWN <= DATA_UP;
		ELSIF CTL3_UP = '0' THEN
			IF PRESENT_STATE = TRANSFERDATADOWN THEN 
				DATA_DOWN <= DATA_UP;
			ELSE 
				DATA_DOWN <= 'Z';
			END IF;				
		ELSE 
			DATA_DOWN <= 'Z';
		END IF;
	END PROCESS DATADOWN;
DATAUP:PROCESS(CTL3_UP, PRESENT_STATE,DATA_DOWN,DATAREG)
	BEGIN
		IF CTL3_UP = '0' THEN
			IF(PRESENT_STATE = TRANSFERDATAUP) THEN  -- 如果是CPU读后续模块的数据，向上透传
				DATA_UP <= DATA_DOWN;
			ELSE 
				DATA_UP <= 'Z';
			END IF;				
		ELSE 
			DATA_UP <= 'Z';
		END IF;
	END PROCESS DATAUP;

----------------------------------------------------------------------------------------------
CMDPROC:PROCESS(RESET, CTL1_UP)
	BEGIN
		IF RESET='0' THEN
			PRESENT_STATE <= IDLE;
			
		ELSE
			IF CTL1_UP'EVENT AND CTL1_UP= '1' THEN			
				IF CMDCOUNT= 4 THEN
					PRESENT_STATE <= IDLE;
					
				ELSIF CMDCOUNT= 9 THEN
						IF CMDREG(17) = '0' THEN	-- CPU 写命令
								PRESENT_STATE <= TRANSFERDATADOWN;
						ELSE
								PRESENT_STATE <= TRANSFERDATAUP;
						END IF;
						
				ELSIF CMDCOUNT = 18 THEN
						IF CMDREG(17) = '0' THEN	-- CPU 写命令
								PRESENT_STATE <= TRANSFERDATADOWN;
						ELSE
								PRESENT_STATE <= TRANSFERDATAUP;
						END IF;
						
				ELSE
					PRESENT_STATE <= IDLE;
				END IF;
			END IF;
		END IF;
END PROCESS CMDPROC;
----------------------------------------------------------------------------------------------	
CMDCODERECV:PROCESS(CTL1_UP, CLK_UP,SYSCLK)
	BEGIN
	
		IF CTL1_UP = '1' THEN
			CMDCOUNT<= 0;
			
		ELSE
			IF CLK_UP'EVENT AND CLK_UP= '1' THEN
				CMDREG(16 DOWNTO 0) <= CMDREG(17 DOWNTO 1);
				CMDREG(17) <= DATA_UP;
				CMDCOUNT<= CMDCOUNT+1;				
			END IF;
		END IF;
		
		
END PROCESS  CMDCODERECV;	
	
DATACODERECV:PROCESS(CTL3_UP, CLK_UP)
	BEGIN
		IF CTL3_UP = '1' THEN
			DATACOUNT<= 0;
			
		ELSE
			IF CLK_UP'EVENT AND CLK_UP= '1' THEN
				DATAREG(34 DOWNTO 0) <= DATAREG(35 DOWNTO 1);
				DATAREG(35) <= DATA_UP;
				DATACOUNT<= DATACOUNT+1;
			END IF;
		END IF;
	END PROCESS DATACODERECV;	

----------------------------------------------------------------------------------------------
FETCH:PROCESS(CTL3_UP,SYSCLK)
BEGIN
	IF CTL3_UP'EVENT AND CTL3_UP='1' THEN
		BUFFERBYTE1<=CMDREG(17 DOWNTO 10);
		BUFFERBYTE2<=DATAREG(35 DOWNTO 28);
		BUFFERBYTE3<=DATAREG(26 DOWNTO 19);		
	END IF;
END PROCESS FETCH;

OTHER1:PROCESS(CTL3_UP)
BEGIN 
	IF CTL3_UP'EVENT AND CTL3_UP='1' THEN
		FLAG1<=NOT FLAG1;
		END IF;
END PROCESS OTHER1;
	
OTHER2:PROCESS(FLAG1)
BEGIN
	IF FLAG1'EVENT AND FLAG1='1' THEN
		IF FLAG2='0' THEN FLAG3<=1;
		ELSIF FLAG2='1' THEN FLAG3<=0;
		END IF;
	END IF;
END PROCESS OTHER2;

COUNTPROC:PROCESS(RESET, DATASTB)
	BEGIN
	IF FLAG3=1 THEN
		IF DATASTB='0' AND DATASTB'EVENT THEN
			IF SENDORDER<3 THEN
	 			SENDORDER<=SENDORDER+1;
			ELSE  SENDORDER<=3;
			END IF;
		END IF;
	END IF;

	IF DATASTB='0' THEN
		IF SENDORDER=0 THEN LPT_DATABUS<=BUFFERBYTE1;LPTWAIT<='1';
		ELSIF SENDORDER=1 THEN LPT_DATABUS<=BUFFERBYTE2;LPTWAIT<='1';	
		ELSIF SENDORDER=2 THEN LPT_DATABUS<=BUFFERBYTE3;LPTWAIT<='1';	
		ELSIF SENDORDER=3 THEN LPT_DATABUS<=X"CC";LPTWAIT<='1';		IF FLAG3=1 THEN FLAG2<='1';END IF;
		END IF;		
		
	ELSE  LPTWAIT<='0';	TRIGGER<='0';	--CPLD进入发送数据初始状态；A缓冲区数据送至并口
	END IF;
	
END PROCESS COUNTPROC;

END ARCH_MAIN;