| % Modbus layer test campaign |
| |
| + Syntax check |
| = Import the modbus layer |
| from scapy.contrib.modbus import * |
| |
| + Test MBAP |
| = MBAP default values |
| raw(ModbusADURequest()) == b'\x00\x00\x00\x00\x00\x01\xff' |
| |
| = MBAP payload length calculation |
| raw(ModbusADURequest() / b'\x00\x01\x02') == b'\x00\x00\x00\x00\x00\x04\xff\x00\x01\x02' |
| |
| = MBAP Guess Payload ModbusPDU01ReadCoilsRequest (simple case) |
| p = ModbusADURequest(b'\x00\x00\x00\x00\x00\x06\xff\x01\x00\x00\x00\x01') |
| assert(isinstance(p.payload, ModbusPDU01ReadCoilsRequest)) |
| = MBAP Guess Payload ModbusPDU01ReadCoilsResponse |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x04\xff\x01\x01\x01') |
| assert(isinstance(p.payload, ModbusPDU01ReadCoilsResponse)) |
| = MBAP Guess Payload ModbusPDU01ReadCoilsError |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x03\xff\x81\x02') |
| assert(isinstance(p.payload, ModbusPDU01ReadCoilsError)) |
| |
| = MBAP Guess Payload ModbusPDU2B0EReadDeviceIdentificationRequest (2 level test) |
| p = ModbusADURequest(b'\x00\x00\x00\x00\x00\x04\xff+\x0e\x01\x00') |
| assert(isinstance(p.payload, ModbusPDU2B0EReadDeviceIdentificationRequest)) |
| = MBAP Guess Payload ModbusPDU2B0EReadDeviceIdentificationResponse |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x1b\xff+\x0e\x01\x83\x00\x00\x03\x00\x08Pymodbus\x01\x02PM\x02\x031.0') |
| assert(isinstance(p.payload, ModbusPDU2B0EReadDeviceIdentificationResponse)) |
| = MBAP Guess Payload ModbusPDU2B0EReadDeviceIdentificationError |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x03\xff\xab\x01') |
| assert(isinstance(p.payload, ModbusPDU2B0EReadDeviceIdentificationError)) |
| |
| = MBAP Guess Payload Reserved Function Request (Invalid payload) |
| p = ModbusADURequest(b'\x00\x00\x00\x00\x00\x02\xff\x5b') |
| assert(isinstance(p.payload,ModbusPDUReservedFunctionCodeRequest)) |
| = MBAP Guess Payload Reserved Function Response (Invalid payload) |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x02\xff\x7e') |
| assert(isinstance(p.payload, ModbusPDUReservedFunctionCodeResponse)) |
| = MBAP Guess Payload Reserved Function Error (Invalid payload) |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x02\xff\x8a') |
| assert(isinstance(p.payload, ModbusPDUReservedFunctionCodeError)) |
| |
| = MBAP Guess Payload ModbusPDU02ReadDiscreteInputsResponse |
| assert(raw(ModbusPDU02ReadDiscreteInputsResponse()), b'\x02\x01\x00') |
| = MBAP Guess Payload ModbusPDU02ReadDiscreteInputsResponse minimal parameters |
| assert(raw(ModbusPDU02ReadDiscreteInputsResponse(inputStatus=[0x02, 0x01])), b'\x02\x02\x02\x01') |
| = MBAP Guess Payload ModbusPDU02ReadDiscreteInputsRequest dissection |
| p = ModbusPDU02ReadDiscreteInputsResponse(b'\x02\x02\x02\x01') |
| p.byteCount == 2 and p.inputStatus == [0x02, 0x01] |
| |
| = ModbusPDU02ReadDiscreteInputsError |
| raw(ModbusPDU02ReadDiscreteInputsError()) == b'\x82\x01' |
| |
| = MBAP Guess Payload User-Defined Function Request (Invalid payload) |
| p = ModbusADURequest(b'\x00\x00\x00\x00\x00\x02\xff\x5b') |
| assert(isinstance(p.payload, ModbusPDUReservedFunctionCodeRequest)) |
| = MBAP Guess Payload User-Defined Function Response (Invalid payload) |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x02\xff\x7e') |
| assert(isinstance(p.payload, ModbusPDUReservedFunctionCodeResponse)) |
| = MBAP Guess Payload User-Defined Function Error (Invalid payload) |
| p = ModbusADUResponse(b'\x00\x00\x00\x00\x00\x02\xff\x8a') |
| assert(isinstance(p.payload, ModbusPDUReservedFunctionCodeError)) |
| |
| + Test layer binding |
| = Destination port |
| p = TCP()/ModbusADURequest() |
| p[TCP].dport == 502 |
| |
| = Source port |
| p = TCP()/ModbusADUResponse() |
| p[TCP].sport == 502 |
| |
| + Test PDU |
| * Note on tests cases: dissection/minimal parameters will not be done for packets that does not perform calculation |
| # 0x01/0x81 Read Coils -------------------------------------------------------------- |
| = ModbusPDU01ReadCoilsRequest |
| raw(ModbusPDU01ReadCoilsRequest()) == b'\x01\x00\x00\x00\x01' |
| = ModbusPDU01ReadCoilsRequest minimal parameters |
| raw(ModbusPDU01ReadCoilsRequest(startAddr=16, quantity=2)) == b'\x01\x00\x10\x00\x02' |
| = ModbusPDU01ReadCoilsRequest dissection |
| p = ModbusPDU01ReadCoilsRequest(b'\x01\x00\x10\x00\x02') |
| assert(p.startAddr == 16) |
| assert(p.quantity == 2) |
| |
| = ModbusPDU01ReadCoilsResponse |
| raw(ModbusPDU01ReadCoilsResponse()) == b'\x01\x01\x00' |
| = ModbusPDU01ReadCoilsResponse minimal parameters |
| raw(ModbusPDU01ReadCoilsResponse(coilStatus=[0x10]*3)) == b'\x01\x03\x10\x10\x10' |
| = ModbusPDU01ReadCoilsResponse dissection |
| p = ModbusPDU01ReadCoilsResponse(b'\x01\x03\x10\x10\x10') |
| assert(p.coilStatus == [16, 16, 16]) |
| assert(p.byteCount == 3) |
| |
| = ModbusPDU01ReadCoilsError |
| raw(ModbusPDU01ReadCoilsError()) == b'\x81\x01' |
| = ModbusPDU81ReadCoilsError minimal parameters |
| raw(ModbusPDU01ReadCoilsError(exceptCode=2)) == b'\x81\x02' |
| = ModbusPDU81ReadCoilsError dissection |
| p = ModbusPDU01ReadCoilsError(b'\x81\x02') |
| assert(p.funcCode == 0x81) |
| assert(p.exceptCode == 2) |
| |
| # 0x02/0x82 Read Discrete Inputs Registers ------------------------------------------ |
| = ModbusPDU02ReadDiscreteInputsRequest |
| raw(ModbusPDU02ReadDiscreteInputsRequest()) == b'\x02\x00\x00\x00\x01' |
| = ModbusPDU02ReadDiscreteInputsRequest minimal parameters |
| raw(ModbusPDU02ReadDiscreteInputsRequest(startAddr=8, quantity=128)) == b'\x02\x00\x08\x00\x80' |
| |
| = ModbusPDU02ReadDiscreteInputsResponse |
| raw(ModbusPDU02ReadDiscreteInputsResponse()) == b'\x02\x01\x00' |
| = ModbusPDU02ReadDiscreteInputsResponse minimal parameters |
| raw(ModbusPDU02ReadDiscreteInputsResponse(inputStatus=[0x02, 0x01])) == b'\x02\x02\x02\x01' |
| = ModbusPDU02ReadDiscreteInputsRequest dissection |
| p = ModbusPDU02ReadDiscreteInputsResponse(b'\x02\x02\x02\x01') |
| assert(p.byteCount == 2) |
| assert(p.inputStatus == [0x02, 0x01]) |
| |
| = ModbusPDU02ReadDiscreteInputsError |
| raw(ModbusPDU02ReadDiscreteInputsError()) == b'\x82\x01' |
| |
| # 0x03/0x83 Read Holding Registers -------------------------------------------------- |
| = ModbusPDU03ReadHoldingRegistersRequest |
| raw(ModbusPDU03ReadHoldingRegistersRequest()) == b'\x03\x00\x00\x00\x01' |
| = ModbusPDU03ReadHoldingRegistersRequest minimal parameters |
| raw(ModbusPDU03ReadHoldingRegistersRequest(startAddr=2048, quantity=16)) == b'\x03\x08\x00\x00\x10' |
| |
| = ModbusPDU03ReadHoldingRegistersResponse |
| raw(ModbusPDU03ReadHoldingRegistersResponse()) == b'\x03\x02\x00\x00' |
| = ModbusPDU03ReadHoldingRegistersResponse minimal parameters |
| 1==1 |
| = ModbusPDU03ReadHoldingRegistersResponse dissection |
| p = ModbusPDU03ReadHoldingRegistersResponse(b'\x03\x06\x02+\x00\x00\x00d') |
| assert(p.byteCount == 6) |
| assert(p.registerVal == [555, 0, 100]) |
| |
| = ModbusPDU03ReadHoldingRegistersError |
| raw(ModbusPDU03ReadHoldingRegistersError()) == b'\x83\x01' |
| |
| # 0x04/0x84 Read Input Register ----------------------------------------------------- |
| = ModbusPDU04ReadInputRegistersRequest |
| raw(ModbusPDU04ReadInputRegistersRequest()) == b'\x04\x00\x00\x00\x01' |
| |
| = ModbusPDU04ReadInputRegistersResponse |
| raw(ModbusPDU04ReadInputRegistersResponse()) == b'\x04\x02\x00\x00' |
| = ModbusPDU04ReadInputRegistersResponse minimal parameters |
| raw(ModbusPDU04ReadInputRegistersResponse(registerVal=[0x01, 0x02])) == b'\x04\x04\x00\x01\x00\x02' |
| |
| = ModbusPDU04ReadInputRegistersError |
| raw(ModbusPDU04ReadInputRegistersError()) == b'\x84\x01' |
| |
| # 0x05/0x85 Write Single Coil ------------------------------------------------------- |
| = ModbusPDU05WriteSingleCoilRequest |
| raw(ModbusPDU05WriteSingleCoilRequest()) == b'\x05\x00\x00\x00\x00' |
| |
| = ModbusPDU05WriteSingleCoilResponse |
| raw(ModbusPDU05WriteSingleCoilResponse()) == b'\x05\x00\x00\x00\x00' |
| |
| = ModbusPDU05WriteSingleCoilError |
| raw(ModbusPDU05WriteSingleCoilError()) == b'\x85\x01' |
| |
| # 0x06/0x86 Write Single Register --------------------------------------------------- |
| = ModbusPDU06WriteSingleRegisterError |
| raw(ModbusPDU06WriteSingleRegisterRequest()) == b'\x06\x00\x00\x00\x00' |
| |
| = ModbusPDU06WriteSingleRegisterResponse |
| raw(ModbusPDU06WriteSingleRegisterResponse()) == b'\x06\x00\x00\x00\x00' |
| |
| = ModbusPDU06WriteSingleRegisterError |
| raw(ModbusPDU06WriteSingleRegisterError()) == b'\x86\x01' |
| |
| # 0x07/0x87 Read Exception Status (serial line only) -------------------------------- |
| # 0x08/0x88 Diagnostics (serial line only) ------------------------------------------ |
| # 0x0b Get Comm Event Counter: serial line only ------------------------------------- |
| # 0x0c Get Comm Event Log: serial line only ----------------------------------------- |
| |
| # 0x0f/0x8f Write Multiple Coils ---------------------------------------------------- |
| = ModbusPDU0FWriteMultipleCoilsRequest |
| raw(ModbusPDU0FWriteMultipleCoilsRequest()) |
| = ModbusPDU0FWriteMultipleCoilsRequest minimal parameters |
| raw(ModbusPDU0FWriteMultipleCoilsRequest(outputsValue=[0x01, 0x01])) == b'\x0f\x00\x00\x00\x01\x02\x01\x01' |
| |
| = ModbusPDU0FWriteMultipleCoilsResponse |
| raw(ModbusPDU0FWriteMultipleCoilsResponse()) == b'\x0f\x00\x00\x00\x01' |
| |
| = ModbusPDU0FWriteMultipleCoilsError |
| raw(ModbusPDU0FWriteMultipleCoilsError()) == b'\x8f\x01' |
| |
| # 0x10/0x90 Write Multiple Registers ---------------------------------------------------- |
| = ModbusPDU10WriteMultipleRegistersRequest |
| raw(ModbusPDU10WriteMultipleRegistersRequest()) == b'\x10\x00\x00\x00\x01\x02\x00\x00' |
| = ModbusPDU10WriteMultipleRegistersRequest minimal parameters |
| raw(ModbusPDU10WriteMultipleRegistersRequest(outputsValue=[0x0001, 0x0002])) == b'\x10\x00\x00\x00\x02\x04\x00\x01\x00\x02' |
| |
| = ModbusPDU10WriteMultipleRegistersResponse |
| raw(ModbusPDU10WriteMultipleRegistersResponse()) == b'\x10\x00\x00\x00\x01' |
| |
| = ModbusPDU10WriteMultipleRegistersError |
| raw(ModbusPDU10WriteMultipleRegistersError()) == b'\x90\x01' |
| |
| # 0x11/91 Report Server ID: serial line only ---------------------------------------- |
| |
| # 0x14/944 Read File Record --------------------------------------------------------- |
| = ModbusPDU14ReadFileRecordRequest len parameters |
| p = raw(ModbusPDU14ReadFileRecordRequest()/ModbusReadFileSubRequest()/ModbusReadFileSubRequest()) |
| assert(p == b'\x14\x0e\x06\x00\x01\x00\x00\x00\x01\x06\x00\x01\x00\x00\x00\x01') |
| = ModbusPDU14ReadFileRecordRequest minimal parameters |
| p = raw(ModbusPDU14ReadFileRecordRequest()/ModbusReadFileSubRequest(fileNumber=4, recordNumber=1, recordLength=2)/ModbusReadFileSubRequest(fileNumber=3, recordNumber=9, recordLength=2)) |
| assert(p == b'\x14\x0e\x06\x00\x04\x00\x01\x00\x02\x06\x00\x03\x00\t\x00\x02') |
| = ModbusPDU14ReadFileRecordRequest dissection |
| p = ModbusPDU14ReadFileRecordRequest(b'\x14\x0e\x06\x00\x04\x00\x01\x00\x02\x06\x00\x03\x00\t\x00\x02') |
| assert(isinstance(p.payload, ModbusReadFileSubRequest)) |
| assert(isinstance(p.payload.payload, ModbusReadFileSubRequest)) |
| |
| = ModbusPDU14ReadFileRecordResponse minimal parameters |
| raw(ModbusPDU14ReadFileRecordResponse()/ModbusReadFileSubResponse(recData=[0x0dfe, 0x0020])/ModbusReadFileSubResponse(recData=[0x33cd, 0x0040])) == b'\x14\x0c\x05\x06\r\xfe\x00 \x05\x063\xcd\x00@' |
| = ModbusPDU14ReadFileRecordResponse dissection |
| p = ModbusPDU14ReadFileRecordResponse(b'\x14\x0c\x05\x06\r\xfe\x00 \x05\x063\xcd\x00@') |
| assert(isinstance(p.payload, ModbusReadFileSubResponse)) |
| assert(isinstance(p.payload.payload, ModbusReadFileSubResponse)) |
| |
| = ModbusPDU14ReadFileRecordError |
| raw(ModbusPDU14ReadFileRecordError()) == b'\x94\x01' |
| |
| # 0x15/0x95 Write File Record ------------------------------------------------------- |
| = ModbusPDU15WriteFileRecordRequest minimal parameters |
| raw(ModbusPDU15WriteFileRecordRequest()/ModbusWriteFileSubRequest(fileNumber=4, recordNumber=7, recordData=[0x06af, 0x04be, 0x100d])) == b'\x15\r\x06\x00\x04\x00\x07\x00\x03\x06\xaf\x04\xbe\x10\r' |
| = ModbusPDU15WriteFileRecordRequest dissection |
| p = ModbusPDU15WriteFileRecordRequest(b'\x15\x0d\x06\x00\x04\x00\x07\x00\x03\x06\xaf\x04\xbe\x10\r') |
| assert(isinstance(p.payload, ModbusWriteFileSubRequest)) |
| assert(p.payload.recordLength == 3) |
| |
| = ModbusPDU15WriteFileRecordResponse minimal parameters |
| raw(ModbusPDU15WriteFileRecordResponse()/ModbusWriteFileSubResponse(fileNumber=4, recordNumber=7, recordData=[0x06af, 0x04be, 0x100d])) == b'\x15\r\x06\x00\x04\x00\x07\x00\x03\x06\xaf\x04\xbe\x10\r' |
| = ModbusPDU15WriteFileRecordResponse dissection |
| p = ModbusPDU15WriteFileRecordResponse(b'\x15\x0d\x06\x00\x04\x00\x07\x00\x03\x06\xaf\x04\xbe\x10\r') |
| assert(isinstance(p.payload, ModbusWriteFileSubResponse)) |
| assert(p.payload.recordLength == 3) |
| |
| = ModbusPDU15WriteFileRecordError |
| raw(ModbusPDU15WriteFileRecordError()) == b'\x95\x01' |
| |
| # 0x16/0x96 Mask Write Register ----------------------------------------------------- |
| = ModbusPDU16MaskWriteRegisterRequest |
| raw(ModbusPDU16MaskWriteRegisterRequest()) == b'\x16\x00\x00\xff\xff\x00\x00' |
| |
| = ModbusPDU16MaskWriteRegisterResponse |
| raw(ModbusPDU16MaskWriteRegisterResponse()) == b'\x16\x00\x00\xff\xff\x00\x00' |
| |
| = ModbusPDU16MaskWriteRegisterError |
| raw(ModbusPDU16MaskWriteRegisterError()) == b'\x96\x01' |
| |
| # 0x17/0x97 Read/Write Multiple Registers ------------------------------------------- |
| = ModbusPDU17ReadWriteMultipleRegistersRequest |
| raw(ModbusPDU17ReadWriteMultipleRegistersRequest()) == b'\x17\x00\x00\x00\x01\x00\x00\x00\x01\x02\x00\x00' |
| = ModbusPDU17ReadWriteMultipleRegistersRequest minimal parameters |
| raw(ModbusPDU17ReadWriteMultipleRegistersRequest(writeRegistersValue=[0x0001, 0x0002])) == b'\x17\x00\x00\x00\x01\x00\x00\x00\x02\x04\x00\x01\x00\x02' |
| = ModbusPDU17ReadWriteMultipleRegistersRequest dissection |
| p = ModbusPDU17ReadWriteMultipleRegistersRequest(b'\x17\x00\x00\x00\x01\x00\x00\x00\x02\x04\x00\x01\x00\x02') |
| assert(p.byteCount == 4) |
| assert(p.writeQuantityRegisters == 2) |
| |
| = ModbusPDU17ReadWriteMultipleRegistersResponse |
| raw(ModbusPDU17ReadWriteMultipleRegistersResponse()) == b'\x17\x02\x00\x00' |
| = ModbusPDU17ReadWriteMultipleRegistersResponse minimal parameters |
| raw(ModbusPDU17ReadWriteMultipleRegistersResponse(registerVal=[1,2,3])) == b'\x17\x06\x00\x01\x00\x02\x00\x03' |
| = ModbusPDU17ReadWriteMultipleRegistersResponse dissection |
| raw(ModbusPDU17ReadWriteMultipleRegistersResponse(b'\x17\x02\x00\x01')) == b'\x17\x02\x00\x01' |
| |
| = ModbusPDU17ReadWriteMultipleRegistersError |
| raw(ModbusPDU17ReadWriteMultipleRegistersError()) == b'\x97\x01' |
| |
| # 0x18/0x88 Read FIFO Queue --------------------------------------------------------- |
| = ModbusPDU18ReadFIFOQueueRequest |
| raw(ModbusPDU18ReadFIFOQueueRequest()) == b'\x18\x00\x00' |
| |
| = ModbusPDU18ReadFIFOQueueResponse |
| = ModbusPDU18ReadFIFOQueueResponse |
| raw(ModbusPDU18ReadFIFOQueueResponse()) == b'\x18\x00\x02\x00\x00' |
| = ModbusPDU18ReadFIFOQueueResponse minimal parameters |
| raw(ModbusPDU18ReadFIFOQueueResponse(FIFOVal=[0x0001, 0x0002, 0x0003])) == b'\x18\x00\x08\x00\x03\x00\x01\x00\x02\x00\x03' |
| = ModbusPDU18ReadFIFOQueueResponse dissection |
| p = ModbusPDU18ReadFIFOQueueResponse(b'\x18\x00\x08\x00\x03\x00\x01\x00\x02\x00\x03') |
| assert(p.byteCount == 8) |
| assert(p.FIFOCount == 3) |
| |
| = ModbusPDU18ReadFIFOQueueError |
| raw(ModbusPDU18ReadFIFOQueueError()) == b'\x98\x01' |
| |
| # 0x2b encapsulated Interface Transport --------------------------------------------- |
| # 0x2b 0xOD CANopen General Reference (out of the main specification) --------------- |
| |
| # 0x2b 0xOE Read Device Information ------------------------------------------------- |
| = ModbusPDU2B0EReadDeviceIdentificationRequest |
| raw(ModbusPDU2B0EReadDeviceIdentificationRequest()) == b'+\x0e\x01\x00' |
| |
| = ModbusPDU2B0EReadDeviceIdentificationResponse |
| raw(ModbusPDU2B0EReadDeviceIdentificationResponse()) == b'+\x0e\x04\x01\x00\x00\x00' |
| = ModbusPDU2B0EReadDeviceIdentificationResponse complete response |
| p = raw(ModbusPDU2B0EReadDeviceIdentificationResponse(objCount=2)/ModbusObjectId(id=0, value="Obj1")/ModbusObjectId(id=1, value="Obj2")) |
| assert(p == b'+\x0e\x04\x01\x00\x00\x02\x00\x04Obj1\x01\x04Obj2') |
| = ModbusPDU2B0EReadDeviceIdentificationResponse dissection |
| p = ModbusPDU2B0EReadDeviceIdentificationResponse(b'+\x0e\x01\x83\x00\x00\x03\x00\x08Pymodbus\x01\x02PM\x02\x031.0') |
| assert(p.payload.payload.payload.id == 2) |
| assert(p.payload.payload.id == 1) |
| assert(p.payload.id == 0) |
| |
| = ModbusPDU2B0EReadDeviceIdentificationError |
| raw(ModbusPDU2B0EReadDeviceIdentificationError()) == b'\xab\x01' |
