О, как же я люблю такие работы! Мои комменты по ресерчу:
Industrial Control Systems Reverse Engineering Framework (ICSREF) for reversing binaries compiled with Codesys, a widely used software stack and compiler for PLCs:
https://arxiv.org/pdf/1812.03478.pdf . This is another amazing step forward in creating tools to automate labour intensive tasks for embedded ICS platforms (we do not have enough tools for embedded systems). Few things to consider together with this work. Some PLCs don't execute the logic on a CPU but via an FPGA/CPLD. Therefore, the binary logic would be a bitstream and there are almost no netlist extractors (equivalent to disassembly) for most FPGAs unlike disassemblers for CPU machine code. But that would be minority of PLCs (I think, Schneider has some of those). Another possible issue would be I/O map extraction from monolithic RTOS-based PLC firmwares on more exotic architectures, which will be more labor intensive than e.g. Codesys on Linux/ARM-like on Wago. However, it is also likely that in the future more and more controllers will be Unix-like RTOSes like QNX or RTLinux on ARM.
https://arxiv.org/pdf/1812.03478.pdf