add: ai generated 1.5 section

Document0-Initial_Information_Gathering.md

@@ -267,7 +267,49 @@ Here you can see:
 
 ## 1.5 Software Components from Firmware Analysis
 
-#TODO
+Only the bridge firmware could be extracted, so this section covers the bridge
+The components below were identified through static analysis.
+
+Apart from ESP-IDF, no component versions are embedded as strings, the versions of the bundled libraries follow from the ESP-IDF release.
+
+### Bridge
+
+| Component | Version / Source | Evidence | Purpose |
+| --- | --- | --- | --- |
+| ESP-IDF | v4.4.1 | Version string in image | Espressif's SDK and build framework |
+| FreeRTOS | Bundled with ESP-IDF v4.4.1 | Part of every ESP-IDF application | Real-time operating system |
+| Bluedroid BLE stack | Bundled with ESP-IDF | `esp_ble_gattc_*`, `ESP_GAP_BLE_AUTH_CMPL_EVT` | BLE central: scanning, pairing/bonding, GATT client to the lock |
+| WiFi driver | Bundled with ESP-IDF | `ap.authmode`, `ap.passwd`, "Set WiFi credentials" | WiFi station; credentials provisioned and stored in NVS |
+| mbedTLS | Bundled with ESP-IDF | mbedTLS label tables, SHA-256 constants, AES/RSA/EC code, TLS-PSK paths | TLS and cryptography |
+| CA certificate store | Standard ESP/mbedTLS bundle | Public CA certificates (Entrust, COMODO, Starfield, …) | TLS server certificate validation |
+| MQTT client | ESP-IDF MQTT component (likely `esp-mqtt`) | `mqtts://` URLs, MQTT auth error strings | Cloud connection to `mqtt.production.loqed.com:8883` |
+| HTTP client / HTTPS OTA | ESP-IDF `esp_http_client`, `esp_https_ota` | `esp_https_ota_*` | Firmware downloads for bridge and lock |
+| OTA / app update | ESP-IDF `app_update` | `otadata`, `ota_0` / `ota_1` partitions, rollback, image magic `0xE9` | A/B updates with rollback |
+| NVS with encryption | ESP-IDF `nvs_flash` | `nvs` and `nvs_key` (subtype 0x04) partitions | Encrypted storage of device identity, tokens and WiFi credentials |
+| Secure boot | ESP-IDF secure boot v1 | `secure_boot_v1` in boot log | Bootloader/app signature verification |
+| Core dump | ESP-IDF `espcoredump` | `coredump` partition, upload URL | Crash dumps, uploaded to `app.loqed.com` |
+| Button driver | `iot_button` from Espressif's esp-iot-solution | Path `components/button_driver/iot_button.c` | Reset button handling |
+| `LoqedBridge` application | Custom, commit `33beadf` (`-dirty`) | Project name, git hash | BLE ↔ MQTT relay, command protocol, lock/bridge OTA logic |
+
+The custom application implements:
+- a binary command protocol between backend, bridge and lock (`REQUEST_STATUS_INFO_BRIDGE`, `COMMAND_ELECTRONIC_DOOR`, `COMMAND_LOCK_FIRMWARE_UPGRADE`, `REQUEST_TIME_FROM_BRIDGE`, …)
+- the lock state machine (`GO_TO_STATE_*`: open / latch / night lock via twist assist, touch-to-lock, outside module, BLE or remote)
+- lock firmware delivery: the bridge downloads lock firmware from `firmware.loqed.com` and sends it to the lock over BLE in parts
+
+#### Security-Relevant Observations
+
+- The firmware prints tokens and WiFi credentials to the UART console (`token: %s`, `auth_token: %s`, `Setting wifi credentials to:`)
+- It was built from an uncommitted working tree (`-dirty`), and developer paths are left in the binary (`/home/pierre/bridge/…`, `/root/bridge/…`)
+- ESP-IDF v4.4.1 is from 2022, the bundled components (Bluedroid, mbedTLS, WiFi driver) should be checked against known CVEs for that release
+
+### Lock (Inner Module)
+
+The lock firmware could not be extracted, so its components are unknown.
+
+What can be said from the outside:
+- It runs on the nRF52840, so it is most likely built on Nordic's nRF5 SDK with a SoftDevice or on the nRF Connect SDK (Zephyr)
+- No standard Nordic DFU service is exposed over BLE (ToothFairy WRLS-GATT-002), updates use the bridge's custom transfer mechanism instead
+- It implements a custom GATT service (`bdce0001-…`) and the UART display protocol to the touch module 
 
 ## 1.6 Collect "Fresh" Firmware Dump