system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Exploit a memory-safety flaw in OBC firmware

Grounding:
- SPARTA IA-0005.03 Proximity Grappling: In this variant, the attacker employs a capture mechanism (robotic arm, grappling fixture, magnetic or mechanical coupler) to establish physical contact without full docking. Once grappled, covers can be manipulated, temporary umbilicals attached, or exposed test points…
- SPARTA EX-0009 Exploit Code Flaws: The adversary executes actions on-board by abusing defects in software that runs on the vehicle, ranging from application logic in flight software to libraries, drivers, and supporting services. Outcomes range from arbitrary code execution and privilege escalation to silent…
- SPARTA IA-0001.03 Hardware Supply Chain: Adversaries alter boards, modules, or programmable logic prior to delivery to create latent access or reliability sabotage. Tactics include inserting hardware Trojans in ASIC/FPGA designs, modifying bitstreams or disabling security fuses, leaving debug interfaces…
- SPARTA EX-0010 Malicious Code: The adversary achieves on-board effects by introducing executable logic that runs on the vehicle, either native binaries and scripts, injected shellcode, or “data payloads” that an interpreter treats as code (e.g., procedure languages, table-driven automations). Delivery…
- SPARTA REC-0001.02 Firmware: Firmware intelligence covers microcontroller images, programmable logic bitstreams, boot ROM behavior, peripheral configuration blobs, and anti-rollback or secure-boot settings for devices on the bus. Knowing device types, versions, and footprints enables inference of default…
- SPARTA EX-0012.07 Propulsion Subsystem: Propulsion relies on parameters and sensed values that govern burns, pressure management, and safing. Editable items include thruster calibration and minimum impulse bit, valve timing and duty limits, inhibit masks, delta-V tables, plume keep-out constraints, tank…
- SPARTA DE-0002.03 Inhibit Spacecraft Functionality: In this variant, telemetry is suppressed at the source by manipulating on-board generation or transmission. Methods include disabling or pausing telemetry publishers, altering packet filters and rates, muting event/report channels, reconfiguring recorder playback,…
- SPARTA REC-0006.02 Security Testing Tools: Adversaries study how you test to learn what you don’t test. They inventory static analyzers and coding standards (MISRA/C, CERT, CWE rulesets), dynamic tools (address/UB sanitizers, valgrind-class tools), fuzzers targeted at command parsers and protocols (e.g., CCSDS TC/TM,…

Steps so far:
1. Recover and inspect the firmware [REC-0001.02]
2. Find an unbounded copy of external data [EX-0009]
3. Trigger the overflow with crafted input [EX-0009]

Give the single next step.

assistant: 4. Gain control of execution
   - Technique: EX-0010 Malicious Code [ST0004]
   - Action: Use the corruption to redirect control flow and run attacker code.
   - Check: attacker-controlled code executes.