<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Firmware Malware Analysis — API Reference

## binwalk

### Commands

```bash
binwalk firmware.bin                    # Signature scan
binwalk -e firmware.bin                 # Extract embedded files
binwalk -E firmware.bin                 # Entropy graph
binwalk -A firmware.bin                 # Opcode scan (architecture detection)
binwalk -R "\x7fELF" firmware.bin       # Raw byte search
binwalk --dd='.*' firmware.bin          # Extract all identified content
```

## uefi-firmware-parser

```bash
pip install uefi_firmware
uefi-firmware-parser --test firmware.rom        # List volumes and files
uefi-firmware-parser -e -O output/ firmware.rom  # Extract all components
uefi-firmware-parser --json firmware.rom         # JSON output
```

### Python API

```python
import uefi_firmware

with open("firmware.rom", "rb") as f:
    parser = uefi_firmware.AutoParser(f.read())

if parser.type() != "unknown":
    firmware = parser.parse()
    firmware.showinfo()     # Print firmware structure
    firmware.dump("output/")  # Extract components
```

## Ghidra — Firmware Analysis

### Headless Analysis

```bash
analyzeHeadless /tmp/project FWProject \
    -import module.efi \
    -processor x86:LE:64:default \
    -postScript ListFunctions.py

# ARM firmware
analyzeHeadless /tmp/project FWProject \
    -import firmware.bin \
    -processor ARM:LE:32:v7 \
    -loader BinaryLoader \
    -loader-baseAddr 0x08000000
```

### Processor Modules

| Architecture | Ghidra Processor ID |
|-------------|-------------------|
| x86 64-bit | `x86:LE:64:default` |
| ARM 32-bit | `ARM:LE:32:v7` |
| ARM Thumb | `ARM:LE:16:v7` |
| MIPS 32 BE | `MIPS:BE:32:default` |
| MIPS 32 LE | `MIPS:LE:32:default` |

## flashrom

```bash
flashrom -p internal -r dump.bin          # Read SPI flash
flashrom -p internal -w clean.bin         # Write clean firmware
flashrom -p internal --verify clean.bin   # Verify write
flashrom -L                                # List supported chips
```

## QEMU Firmware Emulation

```bash
# ARM IoT device
qemu-system-arm -M virt -kernel zImage \
    -drive file=rootfs.img,format=raw \
    -append "root=/dev/vda console=ttyAMA0" -nographic

# MIPS router
qemu-system-mipsel -M malta -kernel vmlinux \
    -drive file=rootfs.img -append "root=/dev/sda1" \
    -nographic -net nic -net user
```
