# Research

Papers on how systems fail and how to reason about their security, covering attack planning, anti-debugging and cryptographic randomness.

## [Recon as a First-Class Planning Action under Partial Observability](https://www.researchgate.net/publication/405230754_Recon_as_a_First-Class_Planning_Action_under_Partial_Observability)

Attack-path planners almost all assume they already know the network. Modelling reconnaissance as a planning action with its own OPSEC cost and information gain reaches the goal in 80.3% of randomised Active Directory graphs against 52.3% for a two-phase baseline — but only once the pursuit is directed and multi-step.

Domains: Offensive Security
Topics: Attack Planning, Partial Observability, Reconnaissance

## [HOP: Hook Oriented Programming](https://www.researchgate.net/publication/396647415_HOP_-Hook_Oriented_Programming)

Licence checks fall to debuggers, and anti-debugging in turn falls to whatever an attacker can patch out. HOP is a Linux anti-debugging design that claims the one debugger slot a process is allowed to have, so the protection has to be evicted before a debugger can attach at all.

Domains: Offensive Security, Systems Programming
Topics: Anti-debugging, Reverse Engineering
Languages: C, Assembly

## [RCPRNG: Robust Complete PRNG](https://www.researchgate.net/publication/396647163_RCPRNG_-_Robust_Complete_Pseudo_Random_Number_Generator)

Cryptographic PRNG models assume unlimited compute and clean entropy; embedded systems have neither, and there entropy accumulation and generation share the same scarce resources. RCPRNG folds both into one security model whose completeness property carries guarantees across arbitrary state transitions, and shows the Gaži-Tessaro sponge construction satisfies it.

Domains: Cryptography
Topics: Pseudo-randomness, Entropy, Formal Methods