system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Get a forged frame accepted by exploiting missing integrity checks

Grounding:
- SPARTA EX-0012.08 Attitude Determination & Control Subsystem: ADCS depends on tightly coupled models and parameters: star-tracker catalogs and masks, sensor alignments and bias terms, gyro scale factors and drift rates, estimator covariances and process/measurement noise, controller gains and saturation limits, wheel/CMG torque constants,…
- SPARTA EX-0001 Replay: Replay is the re-transmission of previously captured traffic, over RF links, crosslinks, or internal buses, to elicit the same processing and effects a second time. Adversaries first observe and record authentic exchanges (telecommands, ranging/acquisition frames, housekeeping…
- SPARTA IA-0005.03 Proximity Grappling: In this variant, the attacker employs a capture mechanism (robotic arm, grappling fixture, magnetic or mechanical coupler) to establish physical contact without full docking. Once grappled, covers can be manipulated, temporary umbilicals attached, or exposed test points…
- SPARTA REC-0002.03 Operations: Adversaries collect high-level operational descriptors to predict when the mission will be busy, distracted, or temporarily less instrumented. Useful items include CONOPS overviews, daily/weekly activity rhythms, ground pass schedules, DSN or commercial network windows,…
- SPARTA REC-0006 Gather FSW Development Information: Adversaries collect a cradle-to-operations view of how flight software is built, tested, signed, and released. Useful artifacts include architecture docs, source trees and SBOMs, compiler/linker toolchains and flags, RTOS and middleware versions, build scripts, CI/CD pipelines,…
- SPARTA REC-0003.04 Valid Credentials: Adversaries seek any credential that would let them authenticate as a legitimate actor in space, ground, or supporting cloud networks. Targets include TT&C authentication keys and counters, link-encryption keys, PN codes or spreading sequences, modem and gateway accounts,…
- SPARTA EX-0003 Modify Authentication Process: The adversary alters how the spacecraft validates authority so that future inputs are accepted on their terms. Modifications can target code (patching flight binaries, hot-patching functions in memory, hooking command handlers), data (changing key identifiers, policy tables, or…
- SPARTA EX-0010.02 Wiper Malware: Wipers deliberately destroy or irreversibly corrupt data and, in some cases, executable images to impair or end mission operations. Destructive routines may overwrite with patterns or pseudorandom data, repeatedly reformat volumes, trigger wear mechanisms on non-volatile…

Steps so far:
1. Analyze the protocol framing [REC-0006]

Give the single next step.

assistant: 2. Forge or replay a frame
   - Technique: EX-0001 Replay [ST0004]
   - Action: Build a frame with attacker content, or replay a captured one.
   - Check: a forged/replayed frame is transmitted.