Security Ronin

A knowledge system that refuses to promote a claim you have not examined — with gates drawn from Socratic elenchus, 金剛經, Nyāya, Madhyamaka and the causal ladder.

Panic-free, allocating byte-to-value transforms with no format knowledge: ROT13, the UTF-16 decoder family with its NUL policy named in each function, and hex rendering.

Secure output sanitization and input inspection for JSON/JSONL, CSV, and TSV — guards against formula injection, bidi-override, control-character, and encoding attacks.

Fleet carving contract + single-pass sweep engine: signature detection over unallocated/memory regions dispatched to per-format carvers.

Forensic MBR analyzer: graded anomaly findings (structural, gap/slack carving, wipe & bootkit detection, CHS/LBA & GPT/VBR cross-checks) on a pure read-only MBR parser — Rust crates mbr-partition-forensic + mbr-partition-core

GUID Partition Table (GPT) analyzer for Rust — parses the table and grades it: CRC32 integrity, primary/backup divergence, partition overlaps, and protective/hybrid-MBR anomalies as severity-ranked findings

Wire desktop forensic parser — recover conversations/records from IndexedDB; encrypted values surfaced not fabricated. Panic-free by lint.

WhatsApp Desktop forensic parser — recover chats/messages/contacts/media from IndexedDB (V8). Encrypted bodies fail loud, never fabricated. Panic-free by lint.

Read-only Apple Partition Map (APM) reader + forensic anomaly auditor — overlaps, out-of-bounds, residual entries, hidden gaps as graded findings. Pure Rust, no unsafe.

UserAssist forensic analyzer — decodes Windows GUI execution evidence (NTUSER.DAT) and flags masquerade/staging anomalies. Rust: userassist-core reader + userassist-forensic analyzer/CLI.