Still working on it.
Had a promising run last night, got past the usual checksum traps, but the protection threw me a new one. Instead of locking up, it started spitting back decoy data that looked valid until you compared byte-for-byte. Nasty.
The main process is holding steady, but there's some weird timing drift that's making the payload dump inconsistent. I think the system's intentionally jittering the response windows to throw off brute-pattern attempts.
I'm prepping another pass with some heavier metadata manipulation. The trick is keeping the changes subtle enough that the verification doesn't scream, but big enough to slip a valid key into the handshake.
Right now the client's quiet, not failing, not unlocking. Just… sitting there. Which means it's thinking, and I don't like when software thinks.
Give me a few more weeks. If you don't hear from me, assume either (A) it worked, or (B) I bricked my own test rig again.