system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Achieve code execution and a software-update capability on an OBC that has no update feature (BEESAT-1 method)

Grounding:
- Threat model: BEESAT-1 OBC command interface threat model (unauthenticated parameter-write primitive). Case: BEESAT-1, a 1U CubeSat (TU Berlin, launched 2009). Assets: the on-board computer command handler, parameter memory in SRAM, in-memory C++ objects and their virtual function tables (vtables), and the NAND flash holding firmware. Trust boundary: telecommands arrive over an…
- SPARTA REC-0006.02 Security Testing Tools: Adversaries study how you test to learn what you don’t test. They inventory static analyzers and coding standards (MISRA/C, CERT, CWE rulesets), dynamic tools (address/UB sanitizers, valgrind-class tools), fuzzers targeted at command parsers and protocols (e.g., CCSDS TC/TM,…
- SPARTA EX-0009 Exploit Code Flaws: The adversary executes actions on-board by abusing defects in software that runs on the vehicle, ranging from application logic in flight software to libraries, drivers, and supporting services. Outcomes range from arbitrary code execution and privilege escalation to silent…
- SPARTA IA-0008.01 Rogue Ground Station: Adversaries may field their own ground system, transportable or fixed, to transmit and receive mission-compatible signals. A typical setup couples steerable apertures and GPS-disciplined timing with SDR/modems configured for the target’s bands, modulation/coding, framing, and…
- SPARTA PER-0002 Backdoor: A backdoor is a covert access path that bypasses normal authentication, authorization, or operational checks so the attacker can reenter the system on demand. Backdoors may be preexisting (undocumented service modes, maintenance accounts, debug features) or introduced by the…
- SPARTA DE-0003.12 Poison AI/ML Training for Evasion: When security monitoring relies on AI/ML (e.g., anomaly detection on telemetry, RF fingerprints, or command semantics), the training data itself is a target. Data-poisoning introduces crafted examples or labels so the learned model embeds false associations, treating attacker…
- SPARTA EX-0012.03 Memory Write/Loads: The adversary uses legitimate direct-memory commands or load services to place chosen bytes at chosen addresses. Many spacecraft support raw read/write operations, block loads into RAM or non-volatile stores, and table/file loaders that copy content into working memory. With…
- SPARTA IA-0005 Rendezvous & Proximity Operations: Adversaries may execute a sequence of orbital maneuvers to co-orbit and approach a target closely enough for local sensing, signaling, or physical interaction. Proximity yields advantages that are difficult to achieve from Earth: high signal-to-noise for interception, narrowly…
- SPARTA IA-0010 Unauthorized Access During Safe-Mode: Adversaries time their first execution to coincide with safe-mode, when the vehicle prioritizes survival and recovery. In many designs, safe-mode reconfigures attitude, reduces payload activity, lowers data rates, and enables contingency dictionaries or maintenance procedures…

Steps so far:
1. Establish command link on the amateur (UHF) band [IA-0008.01]
2. Obtain an arbitrary memory-write primitive from the parameter-write command [EX-0012.03]
3. Hijack control flow by overwriting a C++ vtable pointer [EX-0009]

Give the single next step.

assistant: 4. Stage custom code, bootstrap an update capability, upload an image
   - Technique: PER-0002 Backdoor [ST0005]
   - Action: With control flow hijacked, run custom routines and build the missing software-update capability from scratch, then upload a software image (about 300 KB in the recovery).
   - Check: attacker code persists across the intended control path and a staged image is accepted and executed in the emulator.