system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Gain root on a satellite user terminal by defeating secure boot (Starlink method)

Grounding:
- SPARTA EX-0012.08 Attitude Determination & Control Subsystem: ADCS depends on tightly coupled models and parameters: star-tracker catalogs and masks, sensor alignments and bias terms, gyro scale factors and drift rates, estimator covariances and process/measurement noise, controller gains and saturation limits, wheel/CMG torque constants,…
- SPARTA EX-0015 Side-Channel Attack: Adversaries extract secrets or steer execution by observing or perturbing physical byproducts of computation rather than the intended interfaces. Passive channels include timing, power draw, electromagnetic emissions, acoustic/optical leakage, and thermal patterns correlated…
- SPARTA EX-0010 Malicious Code: The adversary achieves on-board effects by introducing executable logic that runs on the vehicle, either native binaries and scripts, injected shellcode, or “data payloads” that an interpreter treats as code (e.g., procedure languages, table-driven automations). Delivery…
- SPARTA RD-0005 Obtain Non-Cyber Capabilities: Adversaries may pursue non-cyber counterspace means to create access, leverage, or effects that complement cyber operations. These capabilities span kinetic physical (e.g., direct-ascent or co-orbital interceptors and attacks on ground segments), non-kinetic physical (e.g.,…
- SPARTA EX-0004 Compromise Boot Memory: The attacker manipulates memory and configuration used in the earliest stages of boot so that their code runs before normal protections and integrity checks take hold. Targets include boot ROM vectors, first-stage/second-stage bootloaders, boot configuration words and strap…
- SPARTA REC-0005.04 Active Scanning (RF/Optical): Active scanning moves beyond passive collection: an adversary transmits or injects probes intended to elicit identifiable responses that reveal frequencies, protocols, or device behavior. Examples include stimulating auto-track or auto-reply beacons, provoking ranging…
- SPARTA REC-0001.02 Firmware: Firmware intelligence covers microcontroller images, programmable logic bitstreams, boot ROM behavior, peripheral configuration blobs, and anti-rollback or secure-boot settings for devices on the bus. Knowing device types, versions, and footprints enables inference of default…
- SPARTA IA-0009.03 User Segment: The “user segment” encompasses end users and their equipment that interact with mission services, SATCOM terminals, customer ground gateways, tasking portals, and downstream processing pipelines for delivered data. Where these environments interconnect with mission cores, a…

Steps so far:
1. Characterize the terminal boot chain and SoC [REC-0001.02]
2. Build a low-cost voltage fault-injection mod chip [RD-0005]
3. Voltage-glitch the boot to bypass the secure-boot signature check [EX-0004]

Give the single next step.

assistant: 4. Load and run unsigned attacker firmware (root)
   - Technique: EX-0010 Malicious Code [ST0004]
   - Action: With verification defeated, boot a modified image and obtain a root shell for further research.
   - Check: unsigned firmware executes and grants privileged access.