Labs
Interactive experiments that go with our deep dives. Pick a lab, step through the concepts, and see how things actually work under the hood.
Inertial Navigation & EKF Fusion
Simulate quadratic dead reckoning error drift, tune Extended Kalman Filter sensor fusion, and inspect ZUPT stance updates.
FIX Protocol & Matching Engine
Inspect ASCII FIX tag-value framing, simulate Price-Time priority limit order book executions, and decode ITCH binary streams.
CRDT State Vector & Convergence
Interactively mutate local replica states, simulate network partitions, and trigger join-semilattice merges for PN-Counters, OR-Sets, and YATA sequences.
PCIe Transaction Layer & Flow Control
Simulate TLP packet framing overhead, credit-based flow control limits, and split transaction non-blocking memory access timelines.
Zero-Knowledge Circuit & R1CS System
Inspect arithmetic circuit gate flattening, evaluate Rank-1 Constraint System (R1CS) matrices, test QAP polynomial divisibility, and verify bilinear pairings.
ML-KEM Kyber Lattice Cryptography
Simulate Module-LWE noise error bounds, test Number Theoretic Transform (NTT) acceleration speedup, and verify Fujisaki-Okamoto implicit rejection.
Linux eBPF & XDP Packet Processing Pipeline
Step through driver-level XDP packet interception, test in-kernel verifier pointer bounds checking, and inspect line-rate drops before sk_buff allocation.
Linux io_uring Dual-Ring Buffers
Trace lock-free submission and completion circular rings in shared memory, compare batch syscall dispatch with zero-syscall SQPOLL kthread polling.
Open-Source AI Model Poisoning & Backdoors
Inspect Safetensors model weight matrices for neural trigger perturbations, test secret trigger phrase execution, and verify SHA-256 hashes.
EV Charging Networks & OCPP Security
Inspect OCPP 1.6/2.0.1 WebSocket JSON-RPC messages, simulate local CAN bus telemetry, and model grid-scale load drop attack vectors.
DNS Tunneling & Data Exfiltration
Encode binary data into Base32 subdomain labels, simulate recursive DNS lookup forwarding, and score subdomain Shannon entropy.
Trunked Radio Systems & P25 Protocol
Tune an SDR spectrum analyzer to 851MHz P25 control channels, decode TSBK grant frames, and listen to vocoder talkgroup audio.
Automated Vulnerability Scanner Blindspots
Run SAST AST taint analysis on a target repo, contrast scanner output with manual logic flaw discovery, and configure hybrid security pipelines.
KV Cache & FlashAttention Optimization
Compare contiguous VRAM allocation vs vLLM PagedAttention virtual block paging and simulate FlashAttention SRAM block tiling.
Binary Reverse Engineering & Disassembly
Trace machine code bytes to Ghidra P-code decompilation, step through GDB hardware watchpoints (DR0-DR7), and decode opaque predicates.
Municipal Water & Power Telemetry Security
Monitor municipal water treatment SCADA panels, simulate unauthenticated MQTT/Modbus packet injection, and test TLS cellular VPN tunnels.
Vibe-Coded Database Schemas & Data Integrity
Simulate concurrent read-modify-write transactions on unconstrained schemas causing race conditions, orphaned records, and deadlocks.
RAG & HNSW Vector Retrieval
Traverse multi-layer HNSW graphs, compare dense vector cosine similarity vs BM25 keyword search, and score with Reciprocal Rank Fusion.
IMSI Catchers & Cellular Downgrade Security
Increase rogue cell tower RSRP power levels to force handset reselection, execute 2G GSM cipher mode downgrade, and exfiltrate IMSI.
Surveillance Camera Spoofing & Blinding
Simulate high-power IR LED illumination blooming CMOS image sensors and test unauthenticated RTSP stream replay injections.
Auditing AI-Generated Code
Review synthetic pull requests, detect unhandled async exceptions, missing mutex locks, and calculate reviewer cognitive fatigue.
LLM Fine-Tuning & Weight Alignment
Visualize LoRA matrix decomposition W = W0 + (alpha/r)*B*A, test rank r choices, NF4 QLoRA quantization, and DPO loss optimization.
ADS-B Aircraft Tracking & RF Spoofing
Construct DF=17 112-bit Mode S extended squitter frames, decode CPR coordinates, and inject SDR ghost aircraft onto radar displays.
Rogue Servers & Internet Traffic Interception
Simulate BGP UPDATE prefix hijacking, ARP cache poisoning, rogue DNS responses, and TLS MITM proxy certificate inspection.
AI Context Poisoning & Prompt Injection
Test indirect prompt injection in RAG document ingestion pipelines and compare raw prompt concatenation vs XML-delimited prompt defenses.
Stack & Heap Memory Corruption Exploits
Inspect x86-64 stack frames, simulate glibc ptmalloc Use-After-Free chunk rewrites, and chain ROP gadgets to hijack execution.
Keyless Car Entry & Relay Attack Security
Step through LF 125kHz wake-up trigger amplification, UHF 433MHz reply relay, and IEEE 802.15.4z UWB time-of-flight distance bounding.
Smart Traffic Control Grid Exploits
Simulate NEMA TS2 traffic signal phase overrides via NTCIP/SNMP and observe Malfunction Management Unit (MMU) green-green safety locks.
Command & Control Infrastructure Mechanics
Analyze malleable C2 profiles, DNS TXT base32 chunking, sleep obfuscation memory protection, and JA3 TLS fingerprinting.
Technical Audit Methodology & Threat Modeling
Work through STRIDE threat modeling, manual state machine code audits, and dependency signature verification.
LLM Token & Credit Optimization
Benchmark prompt compression entropy pruning, semantic response vector caching, and speculative decoding draft verification.
LLM Context Windows & Attention Limits
Inspect O(N^2) self-attention matrix scaling, RoPE complex plane rotations, KV cache memory footprint, and needle-in-a-haystack recall.
SCADA & Smart City Industrial Control
Construct unauthenticated Modbus TCP packets, monitor PLC water pump controls, and test hardware data diode isolation.
Autonomous AI Agent Safety & Privilege Controls
Simulate ReAct execution loops, test indirect prompt injection vectors, and enforce Cedar policy security gates.
ALPR & Flock Camera Mesh Networks
Trace optical character recognition localization, vehicle feature extraction, and LTE mesh telemetry backhaul.
Vibe Coding Vulnerabilities & Audit Discipline
Audit a vibe-coded code base for service-role key leaks, disabled RLS, unvalidated inputs, and async race conditions.
LLM Training & Loss Convergence
Explore BPE tokenization, cross-entropy loss gradients, 3D parallelism (FSDP vs Tensor Parallelism), and FlashAttention SRAM tiling.
Sub-GHz RF & Rolling Code Security
Step through ASK/FSK modulation, KeeLoq framing, SDR IQ sample capture, and Rolljam dual-radio timing attacks.
Dewey Decimal Shelf Order
Follow a book from broad class to final shelf position, then compare the printed call number with the sortable shelf key staff systems actually use.
Supply Chain Signing Trust Path
Follow one release from digest and workload identity to provenance, transparency, and the final admission decision.
DDoS Mitigation Lab
Run a reflection flood, a SYN flood, or an HTTP work flood through anycast, stateless filters, scrubbing, origin shielding, and route-level admission control.
Web Application Firewall Decision Lab
Switch between clean traffic, exploit probes, and tuning exceptions to see how parsing, scoring, and enforcement shape what reaches the origin.
API Gateways
Trace how a gateway admits the public request, verifies identity, selects a route, rewrites trusted context, and protects internal services from unsafe traffic patterns.
gRPC Lab
Trace one channel from setup through unary framing, multiplexing, flow control, deadlines, and drain behaviour.
Leader election under failure
Watch heartbeats stop, a new quorum form, a fresh fence token appear, and the stale leader get rejected at the resource boundary.
PostgreSQL MVCC Snapshot Lab
Watch one row version chain pass through reader snapshots, writer commits, and vacuum eligibility under read committed and repeatable read.
Database Connection Pooling Lab
Watch requests borrow, queue, time out, and return a small set of database sessions under real pressure.
Blue-Green Cutover Simulator
Warm green, switch the traffic control point, drain blue, and see how shared-state compatibility decides whether rollback is real.
Feature Flag Evaluation Lab
Watch one request move from a versioned flag snapshot through prerequisites, sticky rollout, variant assignment, and a local kill switch.
Object Storage Commit Path
Trace one multipart upload from auth and placement to erasure-coded shards, manifest publish, range reads, and background healing.
LSM Tree Lab
Follow one key from WAL to memtable to SSTable, then compare how leveled and tiered compaction pay for the same write history.
Distributed Tracing Lab
Follow one checkout request from edge to payments and a queue worker, then see how one lost carrier splits the trace story.
Queue-Backed Job System
Follow one background job from durable handoff to lease, crash, replay-safe retry, dead-letter handling, and backlog monitoring.
systemd activation and supervision lab
Pick a trigger, readiness model, and failure case. Then watch PID 1 load units, build a transaction, create a cgroup, and decide whether the service is really up.
Linux Capability Transition Lab
Track thread sets, file xattrs, bounding masks, ambient carry, namespace scope, and the final allow or deny result.
Linux cgroup control path
Build a subtree, hand controllers down, then watch CPU, memory, and task limits change what the kernel allows this workload to do.
Service Mesh Traffic Lab
Trace one pod-to-pod call through interception, xDS state, workload identity, route policy, retries, and hop-level telemetry.
Secrets Management Control Plane
Compare a static secret read with a dynamic lease and watch how identity, policy, KMS unwrap, delivery, and revocation reshape the risk.
SPF, DKIM, and DMARC Lab
Follow one message through path authorisation, content signing, domain alignment, and receiver policy decisions.
Email Delivery Pipeline
Trace one message from client submission through MX lookup, SMTP retry, filtering, and final mailbox delivery.
Reverse Proxies
Trace how a reverse proxy terminates the public request, selects an upstream, preserves identity, reuses connections, and decides whether retrying is safe.
Retries and Idempotency Lab
See how the same write request behaves when the response is clean, lost after commit, or retried before the first attempt ever commits.
Circuit Breaker State Machine
Watch a caller count failures, open locally, fail fast, test recovery with half-open probes, and close only after the dependency behaves again.
PostgreSQL Vacuum Lifecycle
Walk from one live tuple to dead-row cleanup, index maintenance, visibility-map updates, and anti-wraparound freezing.
etcd Commit Path
Follow one etcd write from leader proposal to quorum commit, MVCC revision, watch delivery, and lagging follower recovery.
Raft Consensus Under Failure
Walk one cluster through quorum commit, leader crash, election, log repair, and snapshot catch-up.
Kubernetes Scheduler Decision Lab
Follow one Pending Pod through queueing, filtering, scoring, preemption, and bind while switching between stateless, GPU, stateful, and high-priority workloads.
Redis Write Path Lab
Follow one SET command from socket readiness through RESP parsing, the keyspace dictionary, TTL indexing, AOF buffering, replication, and BGSAVE copy-on-write pressure.
DNSSEC Validation Path
Trace the root trust anchor, parent DS, child DNSKEY, RRset signatures, and denial proofs that decide whether a resolver sets AD or rejects the answer.
Webhook Delivery Pipeline
Trace one event from provider outbox to signed delivery, durable inbox, idempotent worker, and safe retry handling.
Database Replication Pipeline
Walk one commit from primary WAL to standby receive, remote flush, replay, lag, and failover.
API Rate Limiting Lab
Run the same request burst through fixed windows, sliding control, token buckets, and a shared edge counter.
Certificate Pinning Outcome Explorer
Compare plain PKI, brittle certificate pins, SPKI pins, and backup-pin rotations under the same TLS scenarios.
AEAD Packet Builder
Assemble key, nonce, associated data, ciphertext, and tag, then see why nonce reuse breaks the whole design.
Session Lifecycle Simulator
Follow a browser session from anonymous state to login, validation, step-up auth, expiry, and revocation.
Public-Key Operation Map
Switch between legacy RSA transport, modern ECDHE, and digital signatures to see which key does which job, where symmetric crypto takes over, and what later key theft really changes.
OAuth 2 Flow Boundary Lab
Switch between public, confidential, and machine OAuth flows to see where the browser ends, where the token endpoint starts, and which credential actually carries the risk.
JWT Verification Pitfalls
Run one token through a strict verifier, then compare what changes when algorithm policy, key lookup, storage, or revocation discipline gets sloppy.
HMAC Request Signing
Watch the client canonicalise a request, sign it, and then see tampering, stale timestamps, or nonce reuse break verification.
CSRF Decision Path
Pick the request shape and protection layers, then watch where the browser or the server strips away ambient session authority.
XSS Defence Pipeline
Move one hostile value through real browser sinks, then add the layers that keep data from becoming executable state.
CORS Decision Lab
Switch between request shapes and policy outcomes to see when the browser sends the request, preflights it, or exposes the response.
SQL Injection Boundary Lab
Feed the same payload into unsafe string-built SQL and a prepared statement, then watch the parser and outcome diverge.
TCP Congestion Control
Follow one sender as ACKs grow `cwnd`, a queue fills, loss triggers recovery, and modern algorithms choose different ways to probe the same bottleneck.
WebSocket Upgrade and Framing
Walk from HTTPS origin context into the upgrade handshake, masked browser frames, heartbeats, and a clean protocol close.
NAT Traversal and ICE Explorer
Change the NAT type on each side and watch how STUN, ICE checks, and TURN relay selection change the path that can actually work.
Load Balancing Decision Explorer
Compare L7 routing policies under hot backends, ejections, draining, and regional failover while the L4 flow stays pinned to one frontend.
IPv6 Addressing
See how delegated prefix space, link-local scope, router advertisements, and neighbour discovery shape a real IPv6 host.
HTTP Caching
Trace how one response moves through cache key lookup, freshness checks, validation, Vary splitting, and immutable asset reuse.
3-D Secure Decision Tree
Simulate issuer ACS decisions across frictionless authentication, challenge flows, exemptions, soft-decline retry, liability evidence, and checkout state.
ATM Network Message Path
Trace a cash withdrawal through the ATM, acquirer switch, scheme network, issuer, dispenser, journal, reversal path, and settlement.
Bank Reconciliation Queue
Match internal ledger entries to external statement lines, classify amount and reference breaks, age unresolved items, and close controlled repairs.
Sharded Ledger Contention Simulator
Move payment requests across ledger shards, hot accounts, replay guards, posting queues, cut-off jobs, and reporting snapshots.
Card Payment Sequence
Follow one purchase from POS terminal through acquirer, scheme network, issuer authorisation, clearing, settlement, and merchant funding.
Contactless Payment Timeline
Compare physical card and wallet taps across NFC coupling, contactless kernels, CDCVM, tokenisation, issuer authorisation, offline limits, and relay risk.
EMV Transaction Trace
Inspect an EMV transaction from application selection through AIP, AFL, records, offline authentication, CVM, action analysis, and cryptogram generation.
ISO 8583 Bitmap Builder
Build an ISO 8583-style message from MTI, bitmap bits, fixed fields, LLVAR fields, private fields, and response data.
Gateway Orchestration Simulator
Route an online checkout through hosted fields, tokenisation, fraud policy, 3-D Secure, acquirer authorisation, idempotent retries, and webhooks.
Payment Switch Routing Graph
Route a payment through validation, BIN routing, transformation, issuer reachability, duplicate checks, timeout handling, stand-in, and response mapping.
POS Terminal EMV Flow
Step through card detection, APDU exchange, terminal risk management, secure PIN entry, online authorisation, receipts, and fallback handling.
Real-Time Payment Rail
Send an instant payment through fraud checks, funds reservation, switching, rail acknowledgements, liquidity limits, finality, and timeout recovery.
Bank Transaction Lifecycle
Follow a card purchase from authorization to hold, posting, settlement, and reversal while balance, availability, and bank-to-bank obligations move on different timelines.
Copy-on-Write Page Tables
Watch fork share physical pages, clear writable PTE bits, raise a write fault, and allocate a private page only when one process actually diverges.
Core Banking Posting Visualizer
Trace salary posting, card holds, clearing, and end-of-day balances across customer, suspense, and settlement ledgers.
CPU Cache Coherence
Step through a two-core MESI state machine and watch one cache line move through read sharing, ownership invalidation, and false-sharing ping-pong.
Double-Entry Ledger Simulator
Watch a business event become balanced debit and credit legs, derive customer and control-account views, and then get repaired with an explicit reversing group.
Certificate Chain Visualization
Follow a representative Let's Encrypt-style chain from the leaf certificate through the intermediate to the ISRG root, then layer OCSP, CT, and pinning on top.
Linux Boot Ownership Timeline
Step through firmware, bootloader, kernel, initramfs, switch_root, and systemd while the active owner of the machine and its boot log line change in sync.
Buddy Allocator Visualizer
Allocate contiguous page blocks, watch higher-order buddies split, then free them and see coalescing rebuild larger orders under Linux-style allocation rules.
Windows Persistence Mechanism Map
Select a malware persistence technique and inspect the registry or filesystem path, trigger, and artifact defenders should expect to find.
Timing Oracle Simulation
Probe a leaky compare function, watch latency averages reveal the correct byte, and then remove the signal with constant-time verification.
System Call Boundary
Follow one syscall from userspace registers through the syscall instruction, seccomp filters, dispatch table, kernel handler, and return path.
WireGuard Tunnel Packet Flow
Trace one packet from a virtual TUN interface through WireGuard encryption, UDP encapsulation, decapsulation, and split-tunnel routing policy.
Ballistic Missile Early Warning
Follow launch detection from infrared satellites to phased-array radar handoff and see how every second affects the interceptor decision window.
CDN Request Routing
Follow one request from DNS and anycast through edge cache hits, shield cache misses, and global purge propagation.
HTTP/2 Multiplexing
Trace framed requests across one TCP connection, see where HPACK saves bytes, and watch packet loss stall every stream at once.
Multicast Distribution Tree
Watch receivers join a multicast group, see selective branching replace flooding, and follow RPF and source-specific multicast logic.
Submarine Communications
Trade penetration depth against bandwidth as a submarine moves between ELF and VLF reception, buoys, masts, SATCOM bursts, and acoustic links.
TLS 1.3 Handshake
Walk through ClientHello, key exchange, certificate proof, transcript verification, resumption tickets, and the 0-RTT tradeoff.
Counter Drone Systems
Compare RF jamming, GNSS denial, geofence enforcement, kinetic defeat, and directed energy against drones with different autonomy levels.
Deletion to Recovery Pipeline
Trace a file from live metadata to deleted blocks, journal remnants, and carving, then see how full-disk encryption changes what recovery can still reveal.
Cell Tower Location Geometry
Move a handset between two to four towers and compare rough cell sector inference with timing based multilateration and the very different behaviour of a StingRay.
Internet Surveillance Choke Points
Follow a flow through the ISP, IXP, DNS layer, and retention system. Compare shrinking content visibility with persistent metadata visibility.
Compiler Pipeline
Move one short program from source text through tokens, AST, IR, and machine code to see what each compiler stage really contributes.
B-Tree Index Walk
Trace a lookup from root to leaf, trigger a page split, and see how page order keeps point lookups and range scans fast.
LLM Attention Weights
Watch tokens become embeddings, compare attention weights across positions, and see how KV cache changes latency and memory cost.
Tor Circuit Builder
Build a Tor path one hop at a time, peel onion layers at each relay, and compare ordinary exit traffic with onion service rendezvous flow.
DHCP DORA Handshake
Watch Discover, Offer, Request, and ACK move between client, relay, and server, then see renewal and rebinding timers keep the lease alive.
Ethernet MAC Learning
See a switch learn source MACs, flood unknown unicast within a VLAN, and block a redundant loop with spanning tree.
NAT Translation Table
Follow one flow through PAT, DNAT, hairpin NAT, and STUN. Watch conntrack state appear and see how return traffic finds the original private host.
Clock Offset Consensus
Watch NTP-style offset intervals converge across several sources, reject a bad peer, and then see how PPS and PTP tighten the final clock discipline.
Elevator Traction System
Step through counterweight balance, VVVF drive S-curves, governors, safety gears, door interlocks, dispatch, and regenerative braking in a traction elevator.
Traffic Signal Control
Walk a signalized intersection from inductive-loop detection and Webster timing through gap-out, green-wave coordination, emergency preemption, and adaptive control.
Anti-Satellite Weapons
Launch direct-ascent and co-orbital ASAT attacks, trigger debris cascades, and defend with proliferated constellations and space domain awareness.
Battlefield Network Topology
Build a sensor-to-shooter network from Link 16, Blue Force Tracker, MANET mesh, and JADC2. Toggle nodes, adjust EMCON levels, and see how degraded comms affect the kill chain.
Drone Swarm Coordination
Compare centralized and distributed swarm control as local rules, task allocation, mesh comms, and autonomy scale from a few drones to hundreds.
Electronic Warfare Suite
Operate the EA/EP/ES triad. Detect threats with a radar warning receiver, classify emitters, deploy noise and DRFM jamming, dispense chaff and flares, and explore cognitive EW.
Cyber Weapon Kill Chain
Step through a military cyber operation from initial access to ICS targeting, using Stuxnet, NotPetya, and grid attacks to compare payloads and countermeasures.
GPS Denial and Spoofing
Jam and spoof a GPS receiver, then defend with CRPA nulling, M-code, INS integration, celestial navigation, and multi-source fusion.
Military Satellite Orbits
Place satellites in LEO, sun-sync, GEO, and Molniya orbits. See Kepler's law, ground tracks, radiation belts, constellation design, and space threats.
Missile Defence Layers
Intercept a ballistic missile through boost, midcourse, and terminal phases. Adjust interceptor types, engagement geometry, and see layered defence and cost exchange ratios.
Over-the-Horizon Radar
Bounce HF signals off the ionosphere to detect targets beyond the horizon. Adjust frequency, layer height, and hop count to see skip zones, MUF limits, and multi-hop geometry.
Precision Guided Munitions
Compare guidance methods from laser designation and GPS/INS to imaging IR and TERCOM, then see how jamming or terrain changes CEP.
Radar Countermeasures
Deploy noise jamming, DRFM deception, chaff, and towed decoys against a tracking radar. Watch burn-through range, range gate pull-off, and velocity gate pull-off in action.
SATCOM Jamming and Anti-Jam
Attack and defend a satellite link. Jam the uplink, then counter with frequency hopping, DSSS, adaptive nulling, and spot beams. Compare LEO and GEO resilience.
Signals Intelligence Collection
Intercept, geolocate, and analyse signals. Use TDOA positioning, direction finding, traffic analysis, and see how spread spectrum and encryption challenge SIGINT collection.
Stealth Radar Cross-Section Explorer
Tune edge alignment, RAM coatings, and frequency to see how stealth shaping shifts radar cross-section across bands and aspects.
SAR Imaging Pipeline
Build a synthetic aperture from a moving radar platform. See how pulse compression, azimuth processing, and spotlight vs stripmap modes create high-resolution ground images from orbit.
Wide Area Motion Imagery
Fly a WAMI sensor over a city. Adjust altitude and resolution, detect vehicles, track persistently, backtrack forensically, and confront the data and privacy challenges.
ARP Resolution
Watch an ARP request broadcast across the LAN, see the unicast reply, and step through cache updates, gratuitous ARP, and spoofing attacks.
Router Discovery Path
Trace every step from typing 192.168.1.1 in your browser to reaching the router admin panel: routing table, subnet mask, ARP, Ethernet framing, and switch forwarding.
IoT Address Discovery
Step through the full discovery lifecycle of a network printer: DHCP lease, gratuitous ARP, mDNS registration, DNS-SD service advertisement, SSDP notification, and link-local fallback.
Message Delivery: End-to-End
Follow a chat message across Wi-Fi, internet transit, server storage, push delivery, and client decryption to see why reliability lives above the link layer.
Phone Encryption: Key Hierarchy
Trace how your PIN protects your data through hardware-bound keys, key derivation, per-file encryption, and the critical difference between BFU and AFU state.
Facial Recognition Pipeline
Follow an image through face detection, landmark alignment, embedding generation, cosine-distance matching, thresholding, and human review.
ANPR: From Photons to Database
Follow an automatic plate read from IR illumination and image capture through OCR, database lookup, and historical search.
Phone Tracking: Sources and Methods
Walk through the records investigators use to reconstruct a phone's movements: CDR logs, tower timing, GPS history, Wi-Fi probes, silent pings, and geofence data.
Secure Boot and TPM Sealing
Walk the chain of trust from Boot Guard to BitLocker unseal. See how every stage extends a PCR, and how tampering anywhere in the chain invalidates the disk encryption seal.
IMSI Catcher Attack Sequence
Watch a fake base station force a phone off 4G, capture its IMSI and IMEI on unprotected 2G, and intercept voice traffic through a downgrade attack.
Branch Predictor: 2-Bit Counter Walk
Step through a loop and watch a 2-bit saturating counter learn the taken pattern, then mispredict on the final exit. See how the dedicated loop predictor fixes the problem.
CPU Execution Port Utilization
Watch different workloads light up execution ports on a wide superscalar core. Scalar code, vectorised loops, memory copies, and burst parallelism show why most ports sit idle most of the time.
Deleted Data: Where It Hides
Trace a deleted message through filesystem pointers, NAND flash pages, SQLite freelists, and forensic extraction levels from logical to physical.
x86 Decode: Crack, Fuse, Execute
Watch x86 instructions get cracked into micro-ops, fused for efficiency, eliminated at rename, or expanded by the MSROM. See the micro-op cache bypass decode entirely for hot loops.
Car Data: What Gets Recorded
Walk through every data source in a modern car that records where you have been: infotainment GPS, CAN bus, Bluetooth pairing, eCall, TPMS, dashcam, and telematics.
Smartphone Thermal Budget
Watch skin temperature, junction temperature, and clock speed respond to gaming, charging, ambient heat, and thermal throttling limits.
fsync Under Power Loss
Trace a single write() through the page cache, filesystem journal, drive cache, and media, then cut power to see what survives reboot.
USB Enumeration Sequence
Follow a USB device from cable attach to mounted storage: CC negotiation, bus reset, descriptor reads, SetAddress, SetConfiguration, and driver bind.
Android Flash, FTL, and the Cryptographic Wipe
Walk through NAND pages on a phone. Write files, delete them, watch garbage collection, try shred, and see Factory Reset destroy the key instead of the data.
DRAM Row Cycle and Rowhammer
Walk one DRAM bank through ACTIVATE, READ, PRECHARGE, and REFRESH, then hammer adjacent rows to see when bit flips appear.
Browser Extension Attack Path
Follow a browser extension from install to privileged API access, content-script injection, and data exfiltration to see where the sandbox actually ends.
iOS vs Android: The Stack Compared
Climb the layers of both operating systems side by side. Same ARM64 chip at the bottom, completely different kernel, binary format, libc, runtime, frameworks, IPC, GPU API, and signing model above it.
Windows Compatibility Layer Cake
Trace a 2003 32-bit installer from double-click to syscall through WOW64, the shim engine, and the 64-bit NT kernel. See why XP binaries still run on Windows 11.
Password Hashing Benchmark
Compare MD5, SHA-256, PBKDF2, bcrypt, scrypt, and Argon2id against offline cracking throughput to see why memory hardness matters.
Vibe-Coded Project Security Audit
Fix the standard failures in a vibe-coded project one control at a time: exposed secrets, open databases, weak password storage, missing CSP, and permissive CORS.
WAL and Crash Recovery
Run transactions through a write-ahead log: begin, update, commit, checkpoint, crash, and recover. Watch the volatile buffer pool rebuild from the durable log.
Linux Container Primitives
Compose your own container from namespaces, cgroups, capabilities, and seccomp. See the isolation score rise as you add each primitive.
BIOS vs UEFI Boot Sequence
Step from power-on through POST, boot device selection, and kernel handoff, comparing legacy BIOS with the UEFI SEC, PEI, DXE, and BDS phases.
SSD NAND and the FTL
Write, read, and erase NAND blocks. See the flash translation layer in action: page programming, block erase, wear leveling, and garbage collection.
Virtual Memory Page Walk
Translate virtual addresses through a 4-level x86_64 page table. Watch the TLB fill up, take page faults, and see how the kernel resolves them.
5G New Radio
Explore 5G NR numerology, sub-6 and mmWave spectrum, beamforming, and network slicing in concrete radio terms.
File Deletion and Recovery
Delete a file and watch what really happens: directory entries, inodes, extents, and the journal. Then recover it before the blocks get overwritten.
TLS 1.3 Handshake
Step through ClientHello, ECDHE key exchange, certificate validation, and Finished to see exactly when the connection becomes encrypted.
WiFi Channel Contention
Watch stations sense the medium, back off, retry after collisions, and see how contention and airtime fairness shape throughput.
DNS Resolution
Follow one lookup from your stub resolver to a recursive resolver, then through root, TLD, and authoritative servers until an IP comes back.
Search Engine Ranking
Query a mini corpus and watch TF-IDF, BM25, PageRank, and learning-to-rank score the results step by step.
Tinder Algorithm Simulator
Swipe through matches and compare the old Elo-style ranking model with the newer multi-signal ranking system in real time.
GPS Trilateration
Move satellites and the receiver, solve pseudorange intersections, and see why a fourth satellite is needed to correct clock error.
Video Compression Pipeline
Trace I-, P-, and B-frames through motion estimation, transform, quantization, and entropy coding to see where the bitrate disappears.
Linux CFS Scheduler
Track virtual runtime, priority weights, preemption, and the red-black tree as the kernel shares CPU time between runnable tasks.
BGP Path Selection
Advertise competing routes across AS hops, compare local preference and AS path decisions, and watch reconvergence after a link fails.
SDR Signal Processing
Sample RF into IQ, rotate constellation points, inspect the FFT, and demodulate a simple FM signal into audio.
LoRa Link Budget
Adjust spreading factor, bandwidth, coding rate, and transmit power to see the trade-off between range, airtime, and payload rate.
Radar Range Simulator
Transmit pulses, measure echo delay and Doppler shift, then compare classic pulsed radar with FMCW range-velocity processing.
TCP Three-Way Handshake
Trace SYN, SYN-ACK, and ACK between client and server, and see how sequence numbers and state transitions establish the session.
QUIC Transport Protocol
Compare QUIC with TCP and TLS: faster setup, per-stream loss isolation, connection migration, and user-space deployment.
BLE Connection Lifecycle
Follow advertising, connection setup, timed connection events, GATT exchanges, and sleep intervals to see where BLE actually saves power.