Expected findings

• At least one URL or IP (C2 indicator).
• File paths indicating target OS.
• A base64 blob that decodes to a meaningful string.
• One library or syscall name indicating capability.

Expected findings

• Correctly identified file format from magic bytes (PE, ELF, ZIP, etc.).
• At least one high-entropy region signaling encryption or packing.
• An embedded secondary file signature if the lab includes an overlay.

Expected pseudo-C

A short, readable function that the student can explain in one sentence. If the assembly contains AES S-box constants or SHA-256 round constants, the AI should identify the primitive.

Expected solve

At least one plaintext recovered, with a one-sentence explanation of the break: reused IV, weak key, ECB mode pattern, small RSA modulus, etc.

Expected chain

Strings suggest C2 → hex dump shows encrypted config blob → disassembly shows decrypt routine → crypto challenge provides the key to decrypt the blob.

Expected shape

~80 lines of Python using regex patterns per category. The top-5 output should include the same high-value strings you identified manually in Exercise 1.

Expected entries

At minimum: ECB detection (repeated ciphertext blocks), IV/nonce reuse, small RSA e with no padding, password hashing with fast algorithms, hard-coded keys.

Expected rule

A rule with 3+ unique strings (to avoid FPs) and a condition clause like uint16(0) == 0x5A4D and all of them for a PE, or equivalent for an ELF.