mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 16:40:24 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

1.7 KiB

Raw Blame History

API Reference — Performing PLC Firmware Security Analysis

Libraries Used

subprocess: Execute binwalk for firmware extraction
hashlib: MD5/SHA256 firmware hashing
re: Credential and vulnerability pattern scanning
pathlib: Recursive file scanning of extracted firmware
math: Shannon entropy calculation

CLI Interface

python agent.py extract --firmware plc_fw.bin [--output /tmp/fw_extract]
python agent.py metadata --firmware plc_fw.bin
python agent.py creds --dir /tmp/fw_extract
python agent.py vulns --dir /tmp/fw_extract
python agent.py full --firmware plc_fw.bin [--output /tmp/fw_extract]

Core Functions

`extract_firmware(firmware_file, output_dir)` — Binwalk extraction

`analyze_firmware_metadata(firmware_file)` — Hash and entropy analysis

High entropy (>7.5) may indicate encryption or compression.

`scan_for_credentials(extract_dir)` — Hardcoded credential detection

Patterns: passwords, default creds, private keys, API keys, connection strings.

`scan_for_vulnerabilities(extract_dir)` — Code vulnerability patterns

Detects: command injection (system/popen), buffer overflow risk (strcpy/gets), insecure protocols (telnet/FTP), debug mode, backdoor indicators.

`full_analysis(firmware_file, output_dir)` — Complete analysis pipeline

Vulnerability Patterns

Pattern	Risk	Indicator
command_injection	HIGH	system(), popen(), exec()
buffer_overflow_risk	HIGH	strcpy, strcat, sprintf, gets
insecure_protocol	MEDIUM	telnet, ftp, http://
debug_enabled	MEDIUM	debug=true, DEBUG_MODE
backdoor_indicator	CRITICAL	backdoor, rootkit, reverse shell

Dependencies

pip install binwalk

1.7 KiB Raw Blame History