<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing USB Device Control

## Windows — Device Inventory

```powershell
Get-PnpDevice -Class USB | Select-Object FriendlyName, InstanceId
Get-WmiObject Win32_DiskDrive | Where-Object { $_.InterfaceType -eq "USB" }
```

## Windows — GPO Restrictions

```powershell
# Block removable storage
reg add "HKLM\...\RemovableStorageDevices\{53f5630d...}" /v Deny_All /t REG_DWORD /d 1 /f

# Block new USB device installation
reg add "HKLM\...\DeviceInstall\Restrictions" /v DenyDeviceClasses /t REG_DWORD /d 1 /f
```

## Linux — udev Rules

```bash
# Block mass storage
ACTION=="add", SUBSYSTEMS=="usb", ATTRS{bInterfaceClass}=="08", RUN+="/bin/sh -c 'echo 0 > /sys$DEVPATH/authorized'"

udevadm control --reload-rules
```

## Agent Script

```bash
node agent.js inventory
node agent.js check-policy --log usb_events.txt
node agent.js generate-udev --whitelist devices.json
```
