##PROGEA MOVICON SCADA/HMI Software##
##TCPUploadServer - port:10651 ##

looop:

.text:10016D7C cmp     dword_10049548, 4 --------> dword_1... = 0
.text:10016D83 jnb     short loc_10016DBA

.text:10016D85 mov     ecx, dword_10049548
.text:10016D8B movsx   edx, byte_10048454[ecx]
.text:10016D92 mov     eax, [ebp+var_18]
.text:10016D95 mov     ecx, [eax+694h]
.text:10016D9B mov     eax, [ebp+var_14]
.text:10016D9E movzx   ecx, byte ptr [ecx+eax]
.text:10016DA2 cmp     edx, ecx 		---->>>> compare bytes (1st to 4th)  : 4d, 6f , 76 , 58
.text:10016DA4 jnz     short loc_10016DB5


.text:10016DA6 mov     edx, dword_10049548 ---->>> edx = 0
.text:10016DAC add     edx, 1  		-----> inc edx
.text:10016DAF mov     dword_10049548, edx

.text:10016DB5 loc_10016DB5:
.text:10016DB5 jmp     loc_10016EC0

.text:10016EC0 loc_10016EC0:
.text:10016EC0 cmp     dword_10049548, 6
.text:10016EC7 jnz     loc_100171D6

.text:10016ECD cmp     dword_10049544, 0
.text:10016ED4 jnz     loc_100171D6

.text:100171D6 loc_100171D6:
.text:100171D6 jmp     loc_10016D67

.text:10016D67 loc_10016D67:
.text:10016D67 mov     edx, [ebp+var_14] ---->>> edx = dword_10049548 = 0
.text:10016D6A add     edx, 1 ----> increase edx
.text:10016D6D mov     [ebp+var_14
--loop-

## when dword_10049548 / edx becomes equal to "4"
this func will be called:

.text:10016DC3 mov     eax, [ebp+var_18]
.text:10016DC6 mov     ecx, [eax+694h]
.text:10016DCC mov     edx, [ebp+var_14]
.text:10016DCF mov     al, [ecx+edx]
.text:10016DD2 mov     byte_10049540, al
.text:10016DD7 movzx   ecx, byte_10049540
.text:10016DDE cmp     ecx, 31h          --->> ecx stores 5th byte of our packet (should be 31 or upper)
.text:10016DE1 jge     short loc_10016E14


.text:10016E14 loc_10016E14:
.text:10016E14 mov     eax, dword_10049548 ; ---> 4
.text:10016E19 add     eax, 1 		--> 5
.text:10016E1C mov     dword_10049548, eax
.text:10016E21 jmp     loc_10016EC0


.text:10016EC0 loc_10016EC0:
.text:10016EC0 cmp     dword_10049548, 6 --->still not equal to 6, go to last func in loop again & make it equal to 6
.text:10016EC7 jnz     loc_100171D6


### when dword_10049548 becomes equal to 6,  call this sub_funk:

.text:10016ECD cmp     dword_10049544, 0  --> dword_10049544 stores 6th byte of packet and we must set it ZERO to pass this cmp
.text:10016ED4 jnz     loc_100171D6

## and here is the func where we wanna go :)
.text:10016EDA movzx   edx, byte_10049540
.text:10016EE1 mov     [ebp+var_20], edx
.text:10016EE4 mov     eax, [ebp+var_20]
.text:10016EE7 sub     eax, 30h
.text:10016EEA mov     [ebp+var_20], eax
.text:10016EED cmp     [ebp+var_20], 44h ; switch 69 cases
.text:10016EF1 ja      loc_100171C2

There are some issues in different opcodes.... This lesson left up to the reader.
PoC kodunu yazan kurum, beni ve sektor calisanlarını sinayabilir ;)
- Celil UNUVER , SignalSEC Ltd.