- Worked example: 2-file archive (hello.txt + data.bin) with 323 bytes total
- Real SHA-256 hashes computed for both files
- Full annotated hex dump with byte-by-byte field annotations
- Step-by-step shell decode walkthrough with dd/xxd commands
- Shell reference functions: read_le_u16, read_le_u32, verify_hmac, decrypt_file
- Kotlin reference: decrypt, HMAC verify, gzip decompress, SHA-256 verify
- Busybox compatibility notes with od fallback for xxd
- All offsets verified internally consistent via automated check
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Archive header definition (40 bytes) with complete field table
- File table entry definition (11 fields, variable-length per entry)
- AES-256-CBC + HMAC-SHA-256 encryption pipeline with encrypt-then-MAC
- PKCS7 padding formula with 8 worked examples
- Gzip compression details with per-file flag
- Obfuscation features: XOR header, encrypted TOC, decoy padding
- Decode order of operations (full step-by-step)
- Version compatibility rules
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
