# Binary frame behavior-recovery demonstration

New educational work, September 2026. This benign C program models a tiny
telemetry classifier. It is not malware, a firmware dump, or an employment case.
The source is intentionally available so recovered behavior can be checked.

## Run the checks

Save `fixture.c` and `verify.mjs` in the same directory. Requires Node.js 22+
and a C11 compiler (`cc`, or set `CC` to a compiler executable).

```sh
node verify.mjs
```

The script compiles the adjacent known fixture into a temporary directory,
checks 18 hand-calculated inputs against stdout and exit status, then removes
its temporary directory. It does not accept an external binary to analyze.

## Build and inspect

```sh
cc -std=c11 -O1 -Wall -Wextra -Werror fixture.c -o fixture
file fixture
# macOS:
otool -tvV fixture
# Linux alternative (different instruction listing and executable format):
objdump -d fixture
```

For Ghidra, import the locally compiled executable, check the detected format
and processor, run analysis, and examine `classify_frame`. Ghidra is an optional
reader exercise; the included listing was produced with `otool`, not Ghidra.

## Recorded observation

- Compiler: Apple clang 21.0.0 (clang-2100.1.1.101)
- Target: arm64-apple-darwin25.6.0
- Format: Mach-O 64-bit arm64; optimization: `-O1`; symbols retained
- Source SHA-256: `fdf3a7661c1e9964864d0ecf2b4c4c7e181edffe1219391d39d8250a00b14875`
- Observed executable SHA-256: `733f9db1127a3335b10ff988b884098764a7a2731eed985040fda822d4a645c4`

`disassembly-arm64.txt` records the full code-section listing for that build.
Hashes identify this observation; different toolchains, SDKs, paths, or linker
settings can produce different bytes and addresses. Reproduction here means
checking the behavior and explaining the resulting code, not a promise of
byte-identical builds. No precompiled executable is distributed.

## Scope and limits

The cases cover threshold boundaries, flags, byte order, header/checksum errors
and malformed command-line input. They are not exhaustive or a security audit.
The command-line wrapper always passes six decoded bytes to `classify_frame`;
its internal length-error path is visible statically but is not exercised by
these command-line checks. No packing, anti-analysis, persistence, process
injection, exploitation, device hardware or AI component is implemented.

The XOR check byte detects some corruption; it provides no authenticity.
An actor who can replace a frame can recompute it. This observation motivates
a later trust-boundary study, not a claim of a vulnerability in a real device.