live exhibit · 01
Bytecode Disassembler
Steal the file, lose the key: away from its bound device, an OZP1 payload is high-entropy noise.
attacker view — raw OZP1 bytes
000000 C8 1D A4 7B EF FC 85 DA 0B E8 00000A 01 A6 E7 94 3D 32 83 00 39 7E 000014 DF 2C F5 8A FB 18 71 56 D7 C4 00001E AD E2 73 30 A9 2E CF 5C 65 3A 000028 EB 48 E1 06 C7 F4 1D 92 63 60 000032 19 DE BF 8C D5 EA DB 78 51 B6 00003C B7 24 8D 42 53 90 89 8E AF BC 000046 45 9A CB A8 C1 66 A7 54 FD F2 000050 43 C0 F9 3E 9F EC B5 4A BB D8 00005A 31 16 97 84 6D A2 33 F0 69 EE 000064 8F 1C 25 FA AB 08 A1 C6 87 B4 00006E DD 52 23 20 D9 9E 7F 4C 95 AA 000078 9B 38 11 76 77 E4 4D 02 13 50 000082 49 4E 6F 7C 05 5A 8B 68 81 26 00008C 67 14 BD B2 03 80 B9 FE 5F AC 000096 75 0A 7B 98 F1 D6 57 44 2D 62 0000A0 F3 B0 29 AE 4F DC E5 BA 6B C8 0000AA 61 86 47 74 9D 12 E3 E0 99 5E
DECRYPTION FAILED · DEVICE KEY MISMATCH
on this disk: ciphertext only — nothing to disassemble
engineered reality — ozguard in memory
- OZP1 container mapped read-only from disk
- Per-file key unwrapped inside the C core (AES-256-GCM)
- Opcodes streamed straight into the Zend Engine
- Zero plaintext touches disk, page cache or swap
re-probing hardware anchors…
CPU ID mismatch · TPM state mismatch
device binding violated — key unwrap refused
ONIONZERO LOCKDOWN: tamper state persisted