Research
archive.

Every attack has a shape.

Faultline, Sealbreak and False Colors: three illustrated witnesses for a range that folds back, an approval used outside its contract, and a message carrying the wrong authority.

Original visual studies with local models, replayable inputs and links to the underlying research.

A command is not a right to move.

Session handover, delayed packets and stop-state transitions in an original command-gate fixture. A concrete research proposal informed by Satyress's public architecture.

Eight local scenarios; product-specific experiments remain proposed.

Waymark: follow the original.

A published notice, a release commit, an onion address. Check the publisher, the date and the exact bytes; compare a local file with a recorded SHA-256.

Five attributed records. Address attribution and checksum checks are separate from service reachability.

Cartels in the public record.

What can a source actually establish? CARTELKIT links nine claims to agency publications and research, with dates, document types, and limits beside each record.

Public-source assessment. Earlier generated demo records are excluded; agency findings are attributed to their publishers.

Before the body, a line read.

Afterimage follows CVE-2026-97689 through urllib3’s 2.7.0 and 2.8.0 response code. Thirty-two bounded cases distinguish framing-line limits from body size.

Published upstream issue. Controlled in-memory regression; memory exhaustion and application exploitability were not tested.

Clear status. Less guesswork.

Signing dates, unreadable backup folders, and status decisions in a community LiveContainer fork. Follow the Swift changes and the recorded checks behind the messages.

Community-fork work with source and CI evidence. The case study records its reviewed revision; physical-device behavior and upstream acceptance are not implied.

Where the headers went.

CVE-2026-44431, replayed against urllib3 2.6.3 and 2.7.0. Six cases per release compare low-level redirects, the high-level API, and custom header-removal policy.

Independent reproduction with dummy headers and fixed transport responses. Original reporter credited in the study.

Who approved this exact call?

A tool-name allowlist misses changes to the target and arguments. Sealbreak signs the full request, checks expiry, and consumes a one-use nonce in SQLite.

29 controlled cases and 56 regression tests. The gate returns a decision; execution belongs to the host.

C in. Ghidra out.

The same range check in two compiler builds. Compare recovered types, native instruction bytes, and 21,728 range inputs per build. The corrected check has zero mismatches on those inputs.

Original C fixture. Browser arithmetic, native traces, and Ghidra output are recorded separately.

Shufflebox: the order was the secret.

Reconstructing a permutation from DownUnderCTF’s published 2024 challenge. The write-up verifies the handout hash and re-encodes the rows to check the recovered order.

An archived challenge study, using the published handout.

Three bugs worth writing down.

A string that became true. An ignored manifest. A message acknowledged before it was saved. Small repairs in RangeCheck, PolicyScout, and NovaMind, with patches and regressions.

Beyond the section table.

A Python PE inspector checks declared sections against file boundaries. The review records 59 passing tests and 19 subtests on synthetic malformed files.

The inspector reads file structure without executing the artifact.

The device changed. The check didn’t.

A Filament readiness patch binds checks to the selected app, signing identity, and connected device. Late asynchronous responses cannot silently revive an old approval.

Proposed change. The linked CI record passed on 12 September; merge status is not implied.

Which program emitted the event?

The bytes can match while the attribution is wrong. A recorder review separates canonical Boolean decoding from the invocation stack that identifies an event’s emitter.

Local ingestion defects demonstrated with synthetic fixtures.

What was known at the time?

Three small fixtures for future-data leakage, invalid scores, and ambiguous event order. Change an input and follow the decision.

Controlled examples, with assumptions attached to each result.