THE RESEARCH LOG / REPRODUCE · INSPECT · EXPLAIN
A result is stronger
when you can rerun it.
Original exercises in binary analysis, input validation, and evidence integrity. Every entry states what ran, what it found, and where the claim ends.
REVIEWED 14 SEP 2026LOCAL FIXTURES / PUBLIC REPRODUCERS
01 / INVESTIGATIONS YOU CAN INSPECT
From input to evidence.
REVERSE ENGINEERING / ORIGINAL C FIXTURE
Where a range check wraps.
Compare original C with recorded Ghidra output from two compiler builds. Follow the unsigned arithmetic that lets a wrapping addition accept an invalid range, then compare the subtraction-based predicate.
Fresh check: 285 model assertions passed. The verifier also checked hashes for the recorded artifacts, eight functions across two builds, and graph references. This rerun did not rebuild the DLLs or rerun Ghidra.
Inspect recovered code and reproduction instructions ↗
PROTOCOL ANALYSIS / SYNTHETIC EVENTS
A valid shape is not an author.
A payload can match a schema and still come from the wrong program. The exercise follows invocation context and rejects forged markers, malformed Boolean values, and truncated records.
Fresh check: 22 shared vectors and rejection checks passed. The downloadable Python reduced model also passed six test methods, including a synthetic execution-gap example.
Run the editable counterexamples ↗
STATIC FILE REVIEW / SYNTHETIC REGRESSION
Inspect before execution.
A standard-library PE inspector checks declared sections and file boundaries. Synthetic malformed files exercise the parser without running the inspected executable.
Fresh check: 59 tests and 19 subtests passed. These results establish parser behavior on the fixtures; they do not determine whether an arbitrary executable is safe.
Read the method and run the inspector ↗
APPLICATION ENGINEERING / REGRESSION
Make the failure visible.
Three projects gained explicit failure handling: RangeCheck rejects ambiguous scope values, PolicyScout validates persisted evidence, and NovaMind acknowledges a message only after storage succeeds.
Local validation: 38 RangeCheck tests and 14 NovaMind tests passed again during publication review. The earlier PolicyScout review recorded 40 passing tests; its patch was checked against the pinned source, but that suite was not rerun in this publication environment. These are software checks, not deployment or agency-acceptance claims.
Inspect the changes and limits ↗
02 / COMPLETION & REWARDS
Keep the record exact.
An unverified outcome is not a measured zero. This page records only the evidence available to it.
03 / THE NEXT WRITEUP
What belongs
in a useful record.
- Identify the exercise. Name the platform, permitted challenge, date, and publication rules. Keep restricted solutions private.
- Explain the observation. Show the smallest input that distinguishes the competing explanations. Record commands and tool versions.
- Show the correction. Connect the result to input validation, detection, or a specific defensive improvement. Include a regression that fails before the fix.
- Record the outcome separately. Cite the platform’s completion evidence and, only if applicable, an actual award decision. Public records should redact account and wallet details.
For an internship discussion, the strongest part of this work is the reasoning a reviewer can inspect: a concrete question, a bounded experiment, and a result whose limits are visible.
04 / REPRODUCTION
Start locally.
node scripts/check-evidence.mjs
node scripts/check-binary-boundary.mjs
python labs/evidence/reproduce.py
python -m pytest -q labs/format-review/test_inspect_pe.py
Run these from a checkout of the portfolio repository. They use the published local fixtures. The Python inspector tests require pytest.