<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting PLC Firmware Manipulation — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-plc-firmware-manipulation.

## Tools

### `snap7`

Python library for Siemens S7 PLC communication.

**Usage:**
```python
import snap7
client = snap7.client.Client()
client.connect('10.0.0.1', 0, 1)
```

**Key Methods:**
  - `list_blocks()`: enumerate OB/FB/DB blocks
  - `get_cpu_state()`: check CPU run/stop state
  - `full_upload()`: extract program block data

---

### `binwalk`

Firmware analysis and extraction tool.

**Usage:**
```bash
binwalk firmware.bin
```

**Key Flags:**
  - `-e`: extract embedded files
  - `-A`: scan for executable opcodes
  - `--signature`: scan for file signatures

---

### `sha256sum`

Cryptographic hash verification for firmware integrity.

**Usage:**
```bash
sha256sum firmware.bin > manifest.sha256
sha256sum -c manifest.sha256
```

---

### `nmap`

Network scanner with ICS protocol scripts.

**Usage:**
```bash
nmap --script s7-info -p 102 <target>
```

**Key Scripts:**
  - `s7-info`: Siemens S7 device information
  - `modbus-discover`: Modbus device enumeration

---

## Integration Notes

- Store golden firmware images on air-gapped media
- Schedule integrity checks during maintenance windows
- Log all PLC access operations for forensic audit trail
- Cross-validate PLC-reported values with independent sensors

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- IEC 62443-3-3 SR 3.4: Software and Information Integrity
