search

mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.22k stars 413 forks source link

Modbus server "Illegal data address" exception #459

Closed jnzhuang closed 5 years ago

jnzhuang commented 5 years ago

I tried to use conpot as a modbus slave, and I used libmodbus to generate a serial of modbus requests sent to conpot. Unfortunately, each the response packets contains an Exception of “Illegal data address”. (As an example, please take a look at the snapshot of attached pcap file, comprising only one request and one response in modbus protocol). I tried to look up the answer online, and found this: https://github.com/mushorg/conpot/issues/288, which suggests modify the starting address of COILS to 0. But the solution does not work for me. So I am writing to ask if someone can give me some advice to solve the problem. Thank you very much.

pcap-snapshot
xandfury commented 5 years ago

Could you share the details from the XML template? I am interested in looking at the slave id etc.

jnzhuang commented 5 years ago

Thank you very much. Please refer to the attached file. Actually it is just the original default modbus.xml file with only one modification that I changed mode “serial” to “tcp”. My pcap file is also attached.

I tried to read your code yesterday, and the code is written nicely. I found that the exception is raised by self._write_single_coil, which is a function in modbus-tk. Just for your reference.

Thank you very much.

Best regards, Jianing Zhuang

On Jul 8, 2019, at 12:25 AM, Abhinav Saxena notifications@github.com wrote:

Could you share the details from the XML template? I am interested in looking at the slave id etc.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mushorg/conpot/issues/459?email_source=notifications&email_token=ALBPTRPN4IHQ6B3M6PBPRDDP6LTWXA5CNFSM4H6WIGHKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZMGX4Q#issuecomment-509111282, or mute the thread https://github.com/notifications/unsubscribe-auth/ALBPTRJ6ZGNYKSAZ3T2U2WDP6LTWXANCNFSM4H6WIGHA.

creolis commented 5 years ago

Hey Jianing,

please do not send the attachment via eMail but post the content here on Github :)

jnzhuang commented 5 years ago

Oh, oh. I am so sorry. I will post it on GitHub.

On Jul 8, 2019, at 8:13 AM, creolis notifications@github.com wrote:

Hey Jianing,

please do not send the attachment via eMail but post the content here on Github :)

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mushorg/conpot/issues/459?email_source=notifications&email_token=ALBPTRK34HW5FKKFBLK6JODP6NKR5A5CNFSM4H6WIGHKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZNM45Y#issuecomment-509267575, or mute the thread https://github.com/notifications/unsubscribe-auth/ALBPTRK4XOAM2QCKY6PMOETP6NKR5ANCNFSM4H6WIGHA.

jnzhuang commented 5 years ago

Thank you very much for your attention. The file modbus.xml is attached. I remember also that I changed the port number to 502. I changed the suffix of the uploaded xml file to txt so thath I can upload it properly. Thank you very much. modbus.txt

jnzhuang commented 5 years ago

In my request_pdu, the data_address field parsed by _write_single_coil is 304. How could I modify xml file accordingly? @xandfury @creolis

jnzhuang commented 5 years ago

Oh, I found it. In conpot/templates/default/template.xml Just to change range(0,128) to range(0,x) where x is something larger than 304 will be fine. I focused too much in modbus.xml.