<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing IoT Device Forensics

## binwalk

```bash
binwalk firmware.bin                    # Scan for embedded components
binwalk -e firmware.bin                 # Extract components
binwalk -eM firmware.bin                # Recursive extraction
binwalk -E firmware.bin                 # Entropy analysis
binwalk -A firmware.bin                 # Opcode scan (architecture)
binwalk -W fw1.bin fw2.bin              # Hexdump diff
```

| Flag | Description |
|------|-------------|
| `-e` | Extract identified components |
| `-M` | Recursive (matryoshka) extraction |
| `-E` | Entropy plot |
| `-A` | Architecture/opcode analysis |
| `-C` | Output directory |

## flashrom

```bash
flashrom -p ch341a_spi -r dump.bin       # Read SPI flash
flashrom -p ch341a_spi -w firmware.bin   # Write (caution!)
flashrom -p ch341a_spi --flash-name      # Identify chip
```

## OpenOCD

```bash
openocd -f interface/ftdi/ft2232.cfg -f target/stm32f1x.cfg \
  -c "init; flash read_image fw.bin 0x08000000 0x100000; shutdown"
```

## esptool (ESP32/ESP8266)

```bash
esptool.py --port /dev/ttyUSB0 read_flash 0 0x400000 dump.bin
esptool.py --port /dev/ttyUSB0 flash_id
esptool.py --port /dev/ttyUSB0 chip_id
```

## UART Access

```bash
screen /dev/ttyUSB0 115200
minicom -D /dev/ttyUSB0 -b 115200
```

## mosquitto-clients (MQTT)

```bash
mosquitto_sub -h broker -t '#' -v        # Subscribe to all topics
mosquitto_sub -h broker -t 'device/+/data' -v
mosquitto_pub -h broker -t 'test' -m 'hello'
```

## tshark — IoT Protocol Analysis

```bash
tshark -r capture.pcap -Y mqtt -T fields -e mqtt.topic -e mqtt.msg
tshark -r capture.pcap -Y coap -T fields -e coap.code -e coap.opt.uri_path
tshark -r capture.pcap -Y "zbee_nwk" -T fields -e zbee_nwk.src
```

## Filesystem Tools

```bash
unsquashfs -d ./root/ squashfs.bin       # Extract SquashFS
jefferson -d ./root/ jffs2.bin           # Extract JFFS2
ubi_reader ./ubi_image                    # Extract UBIFS
```
