diff --git a/dwt/challenge_vectors.json b/dwt/challenge_vectors.json
new file mode 100644
index 0000000..feb966c
--- /dev/null
+++ b/dwt/challenge_vectors.json
@@ -0,0 +1,1889 @@
+[
+ {
+  "input_hex": "00000000000000000000000000000000",
+  "output_hex": "90de09b47285581790de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "zero",
+   "index": 0
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffffffffffffffffffff",
+  "output_hex": "6a81040bf22944796a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "ones",
+   "index": 1
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0b0c0d0e0f",
+  "output_hex": "490621ba1f7a2f9af3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "ascending",
+   "index": 2
+  }
+ },
+ {
+  "input_hex": "0f0e0d0c0b0a09080706050403020100",
+  "output_hex": "47340c29c8b7bd41b8d97e1542ed3c35",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "descending",
+   "index": 3
+  }
+ },
+ {
+  "input_hex": "aa55aa55aa55aa55aa55aa55aa55aa55",
+  "output_hex": "bff91eb2093e0ff1bff91eb2093e0ff1",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "alternating_aa55",
+   "index": 4
+  }
+ },
+ {
+  "input_hex": "55aa55aa55aa55aa55aa55aa55aa55aa",
+  "output_hex": "6a5628027555c59b6a5628027555c59b",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "alternating_55aa",
+   "index": 5
+  }
+ },
+ {
+  "input_hex": "0000000000000000ffffffffffffffff",
+  "output_hex": "90de09b4728558176a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "half_zero_half_ones",
+   "index": 6
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff0000000000000000",
+  "output_hex": "6a81040bf229447990de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "half_ones_half_zero",
+   "index": 7
+  }
+ },
+ {
+  "input_hex": "80000000000000000000000000000000",
+  "output_hex": "c12005491321e97590de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "single_msb_first_half",
+   "index": 8
+  }
+ },
+ {
+  "input_hex": "00000000000000008000000000000000",
+  "output_hex": "90de09b472855817c12005491321e975",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "single_msb_second_half",
+   "index": 9
+  }
+ },
+ {
+  "input_hex": "7f000000000000000000000000000000",
+  "output_hex": "0a24c5c7784a080f90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "byte0_7f",
+   "index": 10
+  }
+ },
+ {
+  "input_hex": "00000000000000000100000000000000",
+  "output_hex": "90de09b47285581705c18845d2682fba",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "last_byte_01",
+   "index": 11
+  }
+ },
+ {
+  "input_hex": "00112233445566770011223344556677",
+  "output_hex": "df11bb36ba20f348df11bb36ba20f348",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "repeated_8byte_record",
+   "index": 12
+  }
+ },
+ {
+  "input_hex": "f32cec8d0000ead00263a8c0f324ec8e",
+  "output_hex": "5d02bb9c37d40a5be4f2363831815699",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_wire_challenge",
+   "index": 13,
+   "note": "the 16 bytes the terminal sent over TCP (wire order)"
+  }
+ },
+ {
+  "input_hex": "8dec2cf3d0ea0000c0a863028eec24f3",
+  "output_hex": "bdb2d3e0fc00db5fe31ecbd30f1e1b93",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_challenge_post_ntohl",
+   "index": 14,
+   "note": "same challenge after dwt_prf's per-word ntohl; this is f's input"
+  }
+ },
+ {
+  "input_hex": "00000000000000000000000000000000",
+  "output_hex": "90de09b47285581790de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_zero",
+   "index": 15,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000001000000000000000000000000",
+  "output_hex": "b1975ff1d78d032a90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_01",
+   "index": 16,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000002000000000000000000000000",
+  "output_hex": "5865800e5d8c3c5590de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_02",
+   "index": 17,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000003000000000000000000000000",
+  "output_hex": "ee590df03c2bdbdd90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_03",
+   "index": 18,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000010000000000000000000000000",
+  "output_hex": "0b9ab22e400a068f90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_10",
+   "index": 19,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000020000000000000000000000000",
+  "output_hex": "362cf798ec8ae91890de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_20",
+   "index": 20,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000030000000000000000000000000",
+  "output_hex": "9ecae2e539a1635790de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_30",
+   "index": 21,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000080000000000000000000000000",
+  "output_hex": "57d8297c38f7783b90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_80",
+   "index": 22,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "000000ff000000000000000000000000",
+  "output_hex": "fc00338c744b2d1b90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p0_ff",
+   "index": 23,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000100000000000000000000000000",
+  "output_hex": "21105daed5e13ec590de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p1_01",
+   "index": 24,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "00000000010000000000000000000000",
+  "output_hex": "46ba798d00e10cdb90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "live_p7_01",
+   "index": 25,
+   "note": "live TCP probe, post-ntohl input"
+  }
+ },
+ {
+  "input_hex": "010102030405060708090a0b0c0d0e0f",
+  "output_hex": "92bc012d93a116aef3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 26,
+   "note": "ascending baseline, byte 0 bit 0"
+  }
+ },
+ {
+  "input_hex": "020102030405060708090a0b0c0d0e0f",
+  "output_hex": "164015f196b01410f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 27,
+   "note": "ascending baseline, byte 0 bit 1"
+  }
+ },
+ {
+  "input_hex": "040102030405060708090a0b0c0d0e0f",
+  "output_hex": "abbd32f93542e6dff3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 28,
+   "note": "ascending baseline, byte 0 bit 2"
+  }
+ },
+ {
+  "input_hex": "080102030405060708090a0b0c0d0e0f",
+  "output_hex": "56dc26e290e8be41f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 29,
+   "note": "ascending baseline, byte 0 bit 3"
+  }
+ },
+ {
+  "input_hex": "100102030405060708090a0b0c0d0e0f",
+  "output_hex": "301e846cbd602214f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 30,
+   "note": "ascending baseline, byte 0 bit 4"
+  }
+ },
+ {
+  "input_hex": "200102030405060708090a0b0c0d0e0f",
+  "output_hex": "d30c1cc792bb30c9f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 31,
+   "note": "ascending baseline, byte 0 bit 5"
+  }
+ },
+ {
+  "input_hex": "400102030405060708090a0b0c0d0e0f",
+  "output_hex": "ffc252ad921795abf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 32,
+   "note": "ascending baseline, byte 0 bit 6"
+  }
+ },
+ {
+  "input_hex": "800102030405060708090a0b0c0d0e0f",
+  "output_hex": "cfb469b1a5881636f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 33,
+   "note": "ascending baseline, byte 0 bit 7"
+  }
+ },
+ {
+  "input_hex": "000002030405060708090a0b0c0d0e0f",
+  "output_hex": "ac8c291d71256bfbf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 34,
+   "note": "ascending baseline, byte 1 bit 0"
+  }
+ },
+ {
+  "input_hex": "000302030405060708090a0b0c0d0e0f",
+  "output_hex": "5ce92f90a6d5d14af3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 35,
+   "note": "ascending baseline, byte 1 bit 1"
+  }
+ },
+ {
+  "input_hex": "000502030405060708090a0b0c0d0e0f",
+  "output_hex": "22acb5cab75350acf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 36,
+   "note": "ascending baseline, byte 1 bit 2"
+  }
+ },
+ {
+  "input_hex": "000902030405060708090a0b0c0d0e0f",
+  "output_hex": "68a54ddee96445f3f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 37,
+   "note": "ascending baseline, byte 1 bit 3"
+  }
+ },
+ {
+  "input_hex": "001102030405060708090a0b0c0d0e0f",
+  "output_hex": "02346aa75dc726aff3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 38,
+   "note": "ascending baseline, byte 1 bit 4"
+  }
+ },
+ {
+  "input_hex": "002102030405060708090a0b0c0d0e0f",
+  "output_hex": "dadd787249314abaf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 39,
+   "note": "ascending baseline, byte 1 bit 5"
+  }
+ },
+ {
+  "input_hex": "004102030405060708090a0b0c0d0e0f",
+  "output_hex": "2b9c5c6ffc3a1f9ef3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 40,
+   "note": "ascending baseline, byte 1 bit 6"
+  }
+ },
+ {
+  "input_hex": "008102030405060708090a0b0c0d0e0f",
+  "output_hex": "f4e3474acf62420cf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 41,
+   "note": "ascending baseline, byte 1 bit 7"
+  }
+ },
+ {
+  "input_hex": "000103030405060708090a0b0c0d0e0f",
+  "output_hex": "ef72b6cc68559e6af3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 42,
+   "note": "ascending baseline, byte 2 bit 0"
+  }
+ },
+ {
+  "input_hex": "000100030405060708090a0b0c0d0e0f",
+  "output_hex": "e4fdf0dd779b07abf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 43,
+   "note": "ascending baseline, byte 2 bit 1"
+  }
+ },
+ {
+  "input_hex": "000106030405060708090a0b0c0d0e0f",
+  "output_hex": "4ffeb9cce4068e81f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 44,
+   "note": "ascending baseline, byte 2 bit 2"
+  }
+ },
+ {
+  "input_hex": "00010a030405060708090a0b0c0d0e0f",
+  "output_hex": "9947c7dff3d05245f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 45,
+   "note": "ascending baseline, byte 2 bit 3"
+  }
+ },
+ {
+  "input_hex": "000112030405060708090a0b0c0d0e0f",
+  "output_hex": "1fdf4a0763b9f83bf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 46,
+   "note": "ascending baseline, byte 2 bit 4"
+  }
+ },
+ {
+  "input_hex": "000122030405060708090a0b0c0d0e0f",
+  "output_hex": "932dc9c97c441e66f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 47,
+   "note": "ascending baseline, byte 2 bit 5"
+  }
+ },
+ {
+  "input_hex": "000142030405060708090a0b0c0d0e0f",
+  "output_hex": "18ba761ef97d5766f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 48,
+   "note": "ascending baseline, byte 2 bit 6"
+  }
+ },
+ {
+  "input_hex": "000182030405060708090a0b0c0d0e0f",
+  "output_hex": "86bbb870a3d2d245f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 49,
+   "note": "ascending baseline, byte 2 bit 7"
+  }
+ },
+ {
+  "input_hex": "000102020405060708090a0b0c0d0e0f",
+  "output_hex": "876784940262e686f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 50,
+   "note": "ascending baseline, byte 3 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102010405060708090a0b0c0d0e0f",
+  "output_hex": "befcce7e438b0a31f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 51,
+   "note": "ascending baseline, byte 3 bit 1"
+  }
+ },
+ {
+  "input_hex": "000102070405060708090a0b0c0d0e0f",
+  "output_hex": "249be14e8c537ec6f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 52,
+   "note": "ascending baseline, byte 3 bit 2"
+  }
+ },
+ {
+  "input_hex": "0001020b0405060708090a0b0c0d0e0f",
+  "output_hex": "c593b7eb96b434f9f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 53,
+   "note": "ascending baseline, byte 3 bit 3"
+  }
+ },
+ {
+  "input_hex": "000102130405060708090a0b0c0d0e0f",
+  "output_hex": "a449cce9cdd9937bf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 54,
+   "note": "ascending baseline, byte 3 bit 4"
+  }
+ },
+ {
+  "input_hex": "000102230405060708090a0b0c0d0e0f",
+  "output_hex": "a83ef09eeacc3ef9f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 55,
+   "note": "ascending baseline, byte 3 bit 5"
+  }
+ },
+ {
+  "input_hex": "000102430405060708090a0b0c0d0e0f",
+  "output_hex": "5049acd27ce7cc18f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 56,
+   "note": "ascending baseline, byte 3 bit 6"
+  }
+ },
+ {
+  "input_hex": "000102830405060708090a0b0c0d0e0f",
+  "output_hex": "22f90834f70ac2fdf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 57,
+   "note": "ascending baseline, byte 3 bit 7"
+  }
+ },
+ {
+  "input_hex": "000102030505060708090a0b0c0d0e0f",
+  "output_hex": "6c3c483c112bf4a5f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 58,
+   "note": "ascending baseline, byte 4 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030605060708090a0b0c0d0e0f",
+  "output_hex": "b090ed887529e1c8f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 59,
+   "note": "ascending baseline, byte 4 bit 1"
+  }
+ },
+ {
+  "input_hex": "000102030005060708090a0b0c0d0e0f",
+  "output_hex": "2e926606b0294c9df3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 60,
+   "note": "ascending baseline, byte 4 bit 2"
+  }
+ },
+ {
+  "input_hex": "000102030c05060708090a0b0c0d0e0f",
+  "output_hex": "aeef4164a1cba00df3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 61,
+   "note": "ascending baseline, byte 4 bit 3"
+  }
+ },
+ {
+  "input_hex": "000102031405060708090a0b0c0d0e0f",
+  "output_hex": "c8c629bc2a2694b8f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 62,
+   "note": "ascending baseline, byte 4 bit 4"
+  }
+ },
+ {
+  "input_hex": "000102032405060708090a0b0c0d0e0f",
+  "output_hex": "8e07759b6844e0e9f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 63,
+   "note": "ascending baseline, byte 4 bit 5"
+  }
+ },
+ {
+  "input_hex": "000102034405060708090a0b0c0d0e0f",
+  "output_hex": "759d964d0c40cc1ff3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 64,
+   "note": "ascending baseline, byte 4 bit 6"
+  }
+ },
+ {
+  "input_hex": "000102038405060708090a0b0c0d0e0f",
+  "output_hex": "fd4090c4a77c4b72f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 65,
+   "note": "ascending baseline, byte 4 bit 7"
+  }
+ },
+ {
+  "input_hex": "000102030404060708090a0b0c0d0e0f",
+  "output_hex": "f46afcccd96861caf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 66,
+   "note": "ascending baseline, byte 5 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030407060708090a0b0c0d0e0f",
+  "output_hex": "e9323c9d59a033e5f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 67,
+   "note": "ascending baseline, byte 5 bit 1"
+  }
+ },
+ {
+  "input_hex": "000102030401060708090a0b0c0d0e0f",
+  "output_hex": "598bd0df5d9e7250f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 68,
+   "note": "ascending baseline, byte 5 bit 2"
+  }
+ },
+ {
+  "input_hex": "00010203040d060708090a0b0c0d0e0f",
+  "output_hex": "334e6948c674fa42f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 69,
+   "note": "ascending baseline, byte 5 bit 3"
+  }
+ },
+ {
+  "input_hex": "000102030415060708090a0b0c0d0e0f",
+  "output_hex": "c9f599b0c58d1092f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 70,
+   "note": "ascending baseline, byte 5 bit 4"
+  }
+ },
+ {
+  "input_hex": "000102030425060708090a0b0c0d0e0f",
+  "output_hex": "2f482e0cea3b8c9bf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 71,
+   "note": "ascending baseline, byte 5 bit 5"
+  }
+ },
+ {
+  "input_hex": "000102030445060708090a0b0c0d0e0f",
+  "output_hex": "638c609aeafcc4bcf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 72,
+   "note": "ascending baseline, byte 5 bit 6"
+  }
+ },
+ {
+  "input_hex": "000102030485060708090a0b0c0d0e0f",
+  "output_hex": "92b400ed0b282e70f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 73,
+   "note": "ascending baseline, byte 5 bit 7"
+  }
+ },
+ {
+  "input_hex": "000102030405070708090a0b0c0d0e0f",
+  "output_hex": "1d5d0e33202104c4f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 74,
+   "note": "ascending baseline, byte 6 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405040708090a0b0c0d0e0f",
+  "output_hex": "fae5e314891347b1f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 75,
+   "note": "ascending baseline, byte 6 bit 1"
+  }
+ },
+ {
+  "input_hex": "000102030405020708090a0b0c0d0e0f",
+  "output_hex": "5439e903e0acadb9f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 76,
+   "note": "ascending baseline, byte 6 bit 2"
+  }
+ },
+ {
+  "input_hex": "0001020304050e0708090a0b0c0d0e0f",
+  "output_hex": "0cfaed9f09fa568ef3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 77,
+   "note": "ascending baseline, byte 6 bit 3"
+  }
+ },
+ {
+  "input_hex": "000102030405160708090a0b0c0d0e0f",
+  "output_hex": "31ad575576d6ba77f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 78,
+   "note": "ascending baseline, byte 6 bit 4"
+  }
+ },
+ {
+  "input_hex": "000102030405260708090a0b0c0d0e0f",
+  "output_hex": "d3ad6af78b407ccdf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 79,
+   "note": "ascending baseline, byte 6 bit 5"
+  }
+ },
+ {
+  "input_hex": "000102030405460708090a0b0c0d0e0f",
+  "output_hex": "6a8d0b396a2a9faef3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 80,
+   "note": "ascending baseline, byte 6 bit 6"
+  }
+ },
+ {
+  "input_hex": "000102030405860708090a0b0c0d0e0f",
+  "output_hex": "c4e4173d22348ad4f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 81,
+   "note": "ascending baseline, byte 6 bit 7"
+  }
+ },
+ {
+  "input_hex": "000102030405060608090a0b0c0d0e0f",
+  "output_hex": "7b6ab5d4c1731566f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 82,
+   "note": "ascending baseline, byte 7 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060508090a0b0c0d0e0f",
+  "output_hex": "e1ad86d595ee2004f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 83,
+   "note": "ascending baseline, byte 7 bit 1"
+  }
+ },
+ {
+  "input_hex": "000102030405060308090a0b0c0d0e0f",
+  "output_hex": "b2e4c1bc21486d9af3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 84,
+   "note": "ascending baseline, byte 7 bit 2"
+  }
+ },
+ {
+  "input_hex": "000102030405060f08090a0b0c0d0e0f",
+  "output_hex": "5cc4b03fa98a98c3f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 85,
+   "note": "ascending baseline, byte 7 bit 3"
+  }
+ },
+ {
+  "input_hex": "000102030405061708090a0b0c0d0e0f",
+  "output_hex": "a12ffd65e0d144ddf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 86,
+   "note": "ascending baseline, byte 7 bit 4"
+  }
+ },
+ {
+  "input_hex": "000102030405062708090a0b0c0d0e0f",
+  "output_hex": "a640e50db6b1f841f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 87,
+   "note": "ascending baseline, byte 7 bit 5"
+  }
+ },
+ {
+  "input_hex": "000102030405064708090a0b0c0d0e0f",
+  "output_hex": "c6a07e62940eafa8f3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 88,
+   "note": "ascending baseline, byte 7 bit 6"
+  }
+ },
+ {
+  "input_hex": "000102030405068708090a0b0c0d0e0f",
+  "output_hex": "31c89b8122781dbcf3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_first8",
+   "index": 89,
+   "note": "ascending baseline, byte 7 bit 7"
+  }
+ },
+ {
+  "input_hex": "000102030405060709090a0b0c0d0e0f",
+  "output_hex": "490621ba1f7a2f9ac716e3d7791fee58",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 90,
+   "note": "ascending baseline, byte 8 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708080a0b0c0d0e0f",
+  "output_hex": "490621ba1f7a2f9a6e5e338e84f025b7",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 91,
+   "note": "ascending baseline, byte 9 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090b0b0c0d0e0f",
+  "output_hex": "490621ba1f7a2f9a0f49ddcfaf30192a",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 92,
+   "note": "ascending baseline, byte 10 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0a0c0d0e0f",
+  "output_hex": "490621ba1f7a2f9aaaa449bf0b87891f",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 93,
+   "note": "ascending baseline, byte 11 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0b0d0d0e0f",
+  "output_hex": "490621ba1f7a2f9adf98d6b3c074a265",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 94,
+   "note": "ascending baseline, byte 12 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0b0c0c0e0f",
+  "output_hex": "490621ba1f7a2f9a1ea4227224dbb1e9",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 95,
+   "note": "ascending baseline, byte 13 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0b0c0d0f0f",
+  "output_hex": "490621ba1f7a2f9ae8efe545c1c86949",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 96,
+   "note": "ascending baseline, byte 14 bit 0"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0b0c0d0e0e",
+  "output_hex": "490621ba1f7a2f9a52705db9168bfbcb",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "flip_second8",
+   "index": 97,
+   "note": "ascending baseline, byte 15 bit 0"
+  }
+ },
+ {
+  "input_hex": "3501026c15e723a90000000000000000",
+  "output_hex": "7356bebf9efa99d690de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 98
+  }
+ },
+ {
+  "input_hex": "3501026c15e723a9ffffffffffffffff",
+  "output_hex": "7356bebf9efa99d66a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 99
+  }
+ },
+ {
+  "input_hex": "b26233a118609e470000000000000000",
+  "output_hex": "795a7cfe96a7460590de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 100
+  }
+ },
+ {
+  "input_hex": "b26233a118609e47ffffffffffffffff",
+  "output_hex": "795a7cfe96a746056a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 101
+  }
+ },
+ {
+  "input_hex": "cd055494378d8c260000000000000000",
+  "output_hex": "0ea29507d5f9af1390de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 102
+  }
+ },
+ {
+  "input_hex": "cd055494378d8c26ffffffffffffffff",
+  "output_hex": "0ea29507d5f9af136a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 103
+  }
+ },
+ {
+  "input_hex": "0d66c35b5d0e17000000000000000000",
+  "output_hex": "b268c381a0d29af590de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 104
+  }
+ },
+ {
+  "input_hex": "0d66c35b5d0e1700ffffffffffffffff",
+  "output_hex": "b268c381a0d29af56a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 105
+  }
+ },
+ {
+  "input_hex": "1d1ea39547625c8c0000000000000000",
+  "output_hex": "381f7a0f0c40d91490de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 106
+  }
+ },
+ {
+  "input_hex": "1d1ea39547625c8cffffffffffffffff",
+  "output_hex": "381f7a0f0c40d9146a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 107
+  }
+ },
+ {
+  "input_hex": "cddf89707ed28ca00000000000000000",
+  "output_hex": "2a9f66460c954e0f90de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 108
+  }
+ },
+ {
+  "input_hex": "cddf89707ed28ca0ffffffffffffffff",
+  "output_hex": "2a9f66460c954e0f6a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 109
+  }
+ },
+ {
+  "input_hex": "30c654040ab964900000000000000000",
+  "output_hex": "4b96772686a6414490de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 110
+  }
+ },
+ {
+  "input_hex": "30c654040ab96490ffffffffffffffff",
+  "output_hex": "4b96772686a641446a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 111
+  }
+ },
+ {
+  "input_hex": "225412226117a6db0000000000000000",
+  "output_hex": "94dfbb7b696ff68890de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_zero",
+   "index": 112
+  }
+ },
+ {
+  "input_hex": "225412226117a6dbffffffffffffffff",
+  "output_hex": "94dfbb7b696ff6886a81040bf2294479",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_a_ones",
+   "index": 113
+  }
+ },
+ {
+  "input_hex": "0000000000000000748aadd2dc1ffdf2",
+  "output_hex": "90de09b4728558174f042d404735fbc2",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 114
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff748aadd2dc1ffdf2",
+  "output_hex": "6a81040bf22944794f042d404735fbc2",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 115
+  }
+ },
+ {
+  "input_hex": "00000000000000004aa500e87edc64c4",
+  "output_hex": "90de09b472855817f7bea28401464aa9",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 116
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff4aa500e87edc64c4",
+  "output_hex": "6a81040bf2294479f7bea28401464aa9",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 117
+  }
+ },
+ {
+  "input_hex": "00000000000000006b6a5fb00237cad2",
+  "output_hex": "90de09b472855817794f1f3eb90c3f7c",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 118
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff6b6a5fb00237cad2",
+  "output_hex": "6a81040bf2294479794f1f3eb90c3f7c",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 119
+  }
+ },
+ {
+  "input_hex": "00000000000000008c8ff951a25f1570",
+  "output_hex": "90de09b472855817f867951521bd7c78",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 120
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff8c8ff951a25f1570",
+  "output_hex": "6a81040bf2294479f867951521bd7c78",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 121
+  }
+ },
+ {
+  "input_hex": "0000000000000000eb8a6a6991b61ff5",
+  "output_hex": "90de09b4728558170741bef82537b2d2",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 122
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffffeb8a6a6991b61ff5",
+  "output_hex": "6a81040bf22944790741bef82537b2d2",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 123
+  }
+ },
+ {
+  "input_hex": "00000000000000003a5eb345ffe4b82c",
+  "output_hex": "90de09b472855817670d4e8e84e288a3",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 124
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff3a5eb345ffe4b82c",
+  "output_hex": "6a81040bf2294479670d4e8e84e288a3",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 125
+  }
+ },
+ {
+  "input_hex": "00000000000000000d022175a50d18fc",
+  "output_hex": "90de09b4728558170a2e1c9971e91d1b",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 126
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff0d022175a50d18fc",
+  "output_hex": "6a81040bf22944790a2e1c9971e91d1b",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 127
+  }
+ },
+ {
+  "input_hex": "00000000000000004a8d5e79aebdb5c8",
+  "output_hex": "90de09b47285581759ad04b586354818",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_zero",
+   "index": 128
+  }
+ },
+ {
+  "input_hex": "ffffffffffffffff4a8d5e79aebdb5c8",
+  "output_hex": "6a81040bf229447959ad04b586354818",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "indep_b_ones",
+   "index": 129
+  }
+ },
+ {
+  "input_hex": "8735ca449d06e48e92d9a690779e4f9a",
+  "output_hex": "b6f66ef5f2a5cedd30e1a1fb479ab692",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 130
+  }
+ },
+ {
+  "input_hex": "1a068ad8dc21dde0230f2e171bdf6835",
+  "output_hex": "60cbae07071171fafe324af662d56547",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 131
+  }
+ },
+ {
+  "input_hex": "939999e9cfefb9a939e89b16ca161ab5",
+  "output_hex": "4bcb501a7c79b71f9e2d2df7d0f9970a",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 132
+  }
+ },
+ {
+  "input_hex": "ad34b10c287fd20998faa0af457b4709",
+  "output_hex": "d4232710a53156107f0626f57f27107a",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 133
+  }
+ },
+ {
+  "input_hex": "47d34ba7b939955a047cf68d737a61ea",
+  "output_hex": "a251c1cbdc69be78d58ebbc1f3d245e1",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 134
+  }
+ },
+ {
+  "input_hex": "c3a2b00938d11fa1c92c641e712aca34",
+  "output_hex": "5b660019c0379e8e87549e42ddd8dc91",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 135
+  }
+ },
+ {
+  "input_hex": "e00ad1ad276852a1a5f2df2231952729",
+  "output_hex": "e5bcbaa614d6eac3d2bae6dfb65adb39",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 136
+  }
+ },
+ {
+  "input_hex": "3af2e6babf44ec5c1a55f0baa5fa9bda",
+  "output_hex": "45d82cb113cbd25d673bc3e62822a3da",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 137
+  }
+ },
+ {
+  "input_hex": "8a3b6d96439a3c3a00fe89b197f1c6d9",
+  "output_hex": "adf093b70042b643dde4a30b27d911d7",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 138
+  }
+ },
+ {
+  "input_hex": "00c5de6db0d87ac62982036bc9dcfc65",
+  "output_hex": "6288d3e03ae6f7e14eca401c5ba5fd27",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 139
+  }
+ },
+ {
+  "input_hex": "3d69baf6a6fb385684057ef71c02a84f",
+  "output_hex": "dc44ec4be6e8c4d8b7ba15ffc141c2c3",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 140
+  }
+ },
+ {
+  "input_hex": "dc771563dfab03f5b61486f08d0420ed",
+  "output_hex": "bb4bc8c0da0f67f067f1e050cccc4496",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 141
+  }
+ },
+ {
+  "input_hex": "72dbc7ae27d3f52777c23a5aad142793",
+  "output_hex": "a08ead92445c042ec35e0e35ccbf4d63",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 142
+  }
+ },
+ {
+  "input_hex": "e87423730ba482d37d2c5b81998a6e11",
+  "output_hex": "e27dbc03e384000e6856245c601c066c",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 143
+  }
+ },
+ {
+  "input_hex": "485cc3950cf9bba76ea9a66114d74306",
+  "output_hex": "6ceb557795af089eba4e64de032e7b0c",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 144
+  }
+ },
+ {
+  "input_hex": "eddc3862d2b887a09387b95d22f28d16",
+  "output_hex": "9063e689a041631b5e4221f07c6c2547",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 145
+  }
+ },
+ {
+  "input_hex": "98d7dda8c2c3d7a2cef816d1c57dd25b",
+  "output_hex": "4b4dbf8ab4aefd03a982ad51d10c36b4",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 146
+  }
+ },
+ {
+  "input_hex": "e59918d7f7440e10e34bb57226b23e3e",
+  "output_hex": "cade8c78ee6a226d1371950638d6e524",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 147
+  }
+ },
+ {
+  "input_hex": "795dd0f1748f2fcc6da86e78e523a6db",
+  "output_hex": "4d0af9fdde099932cceae634e6a6e4f2",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 148
+  }
+ },
+ {
+  "input_hex": "ff374e2becd41ddfc34ef995bad74103",
+  "output_hex": "53e283c3d30ca9b14b819686a25f04ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 149
+  }
+ },
+ {
+  "input_hex": "79b01497977c38e8cadfbad60eb67e76",
+  "output_hex": "6b1d1ec7f7ca646d4d8d767dd61d9d70",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 150
+  }
+ },
+ {
+  "input_hex": "a65fc3f7d66da24e73bbdacd9ce12c94",
+  "output_hex": "988849d83be204c765c6b42beb78dcdf",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 151
+  }
+ },
+ {
+  "input_hex": "a60b9669d2c984782cfa89992ae6a9d2",
+  "output_hex": "6657bfca2e87a070af6045dbefccf55f",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 152
+  }
+ },
+ {
+  "input_hex": "9cac25c867b7e079ded45d428b2efcf9",
+  "output_hex": "f39d44d3e059e4e01127f65b9fbb20b6",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 153
+  }
+ },
+ {
+  "input_hex": "4908bbb17763ce521276697474f8d19b",
+  "output_hex": "016964d9028d40780288fa31a2bd56f7",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 154
+  }
+ },
+ {
+  "input_hex": "a7ba8dea495b0258c1e7782ea394c06a",
+  "output_hex": "1a13c5630a767779570af70e38937996",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 155
+  }
+ },
+ {
+  "input_hex": "83f052520b2ad979727161de54d9581c",
+  "output_hex": "7d242666dbe8b30efe5e4830923218a0",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 156
+  }
+ },
+ {
+  "input_hex": "a08e2045b24736220446c0637c406ab2",
+  "output_hex": "afc79c27120e812f3a767842cec3f8f4",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 157
+  }
+ },
+ {
+  "input_hex": "490a2794e95ff3faf368b3693d3ff730",
+  "output_hex": "5cb8795143440bf5481e9b7d3f2beccc",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 158
+  }
+ },
+ {
+  "input_hex": "bbde52c3fbe8ce87e330574e622a72c6",
+  "output_hex": "3c5af926f6e820ba1addbc9449ce9aeb",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 159
+  }
+ },
+ {
+  "input_hex": "fef29072dcaa31a29fef6013f989bc3d",
+  "output_hex": "10c67b8b791d948f0f946ccf8e6c195e",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 160
+  }
+ },
+ {
+  "input_hex": "56201529bc79958577f97ab3d0633f0f",
+  "output_hex": "010a4f36bbc6229ff7538406754cdc9a",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 161
+  }
+ },
+ {
+  "input_hex": "f711da57a41d0b5b846db5e5c0ead574",
+  "output_hex": "8582dcf8562b6e7f7e66f3354c21a503",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 162
+  }
+ },
+ {
+  "input_hex": "dd7b13e7479cb46208e84b6dccf5d7df",
+  "output_hex": "79f9a78684adcd5bf1bfe7701c18ce01",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 163
+  }
+ },
+ {
+  "input_hex": "29563ba35966fddd90ab8df4f8d46f53",
+  "output_hex": "a9c1e15117ee664024ebb66be44fdd3e",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 164
+  }
+ },
+ {
+  "input_hex": "6951df1546b54e9a7902cb6d1f0ccfe8",
+  "output_hex": "31bd9e6914ff5d15229db8ac1315ed84",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 165
+  }
+ },
+ {
+  "input_hex": "5f9bbbc7778be7198bee4284ac65fa5c",
+  "output_hex": "e825ebcd5ab616a4c376755a70dd5d85",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 166
+  }
+ },
+ {
+  "input_hex": "4c5242b528b8d14a761c0989779b3e71",
+  "output_hex": "7131ec719f72a11319139dd9d9dca7a5",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 167
+  }
+ },
+ {
+  "input_hex": "fa3cbbe6139d9465cf5efc777d1ea6c5",
+  "output_hex": "abe7686eed7024017e1fcafaa6b87f74",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 168
+  }
+ },
+ {
+  "input_hex": "02e3aa2be481a7b4195c3a6435ebeb58",
+  "output_hex": "2d11d2406b8e1f2d8029f710e0477610",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 169
+  }
+ },
+ {
+  "input_hex": "3ed28369f5acef0097bb500bdf8d1115",
+  "output_hex": "c6240578965f1a4fb77bf238bd903b39",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 170
+  }
+ },
+ {
+  "input_hex": "38cedaa0d9d0fba6829f37d697154869",
+  "output_hex": "4a8a4cc4e5f5f8f8809c5f96357942e8",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 171
+  }
+ },
+ {
+  "input_hex": "91145732a012b25cb686760edfdbcea2",
+  "output_hex": "d1410b2f2b76ecfa4b2eaff0c3308013",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 172
+  }
+ },
+ {
+  "input_hex": "10591aff4360aff4ee77ef3d32db9bf7",
+  "output_hex": "df82591209484a8e43282118eb19e424",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 173
+  }
+ },
+ {
+  "input_hex": "393952f7a6dd08ec511e329f7f57c94e",
+  "output_hex": "81a173bf7cb18b44a8ac7214f662c513",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 174
+  }
+ },
+ {
+  "input_hex": "5bfe98265bfa6885e6ce29783dcdb264",
+  "output_hex": "7c514c2cc9b44c1f490844a9eec42370",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 175
+  }
+ },
+ {
+  "input_hex": "de3a6461e30e89f4c2cfc154d11cb171",
+  "output_hex": "7b5e780f51ce26a7a3cfd770c8007984",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 176
+  }
+ },
+ {
+  "input_hex": "f824d54a780f4fa96f6350d34e8bd760",
+  "output_hex": "858da30dd7e423f22ef0076ae22d19ce",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "random",
+   "index": 177
+  }
+ },
+ {
+  "input_hex": "00000000000000000000000000000000",
+  "output_hex": "90de09b47285581790de09b472855817",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "zero_duplicate",
+   "index": 178,
+   "note": "repeat of the first vector"
+  }
+ },
+ {
+  "input_hex": "000102030405060708090a0b0c0d0e0f",
+  "output_hex": "490621ba1f7a2f9af3ee13199041b8ef",
+  "meta": {
+   "stage": "full",
+   "boot": 2,
+   "kind": "ascending_duplicate",
+   "index": 179,
+   "note": "repeat of ascending"
+  }
+ }
+]
diff --git a/dwt/evidence/oracle/characterisation.json b/dwt/evidence/oracle/characterisation.json
new file mode 100644
index 0000000..404e218
--- /dev/null
+++ b/dwt/evidence/oracle/characterisation.json
@@ -0,0 +1,44 @@
+{
+  "determinism": {
+    "boots": 2,
+    "inputs_compared": 177,
+    "differences": 0,
+    "first_differences": []
+  },
+  "per_record_independence": {
+    "errors": 0,
+    "examples": []
+  },
+  "permutation": {
+    "distinct_inputs": 152,
+    "distinct_outputs": 152,
+    "fixed_points": []
+  },
+  "avalanche": {
+    "samples": 64,
+    "mean_output_bits_changed_first_record": 32.656,
+    "min": 23,
+    "max": 42,
+    "second_record_changed": 0
+  },
+  "record_is_repeated": true,
+  "intermediate": {
+    "captured": 6,
+    "feistel_in_equals_input": true,
+    "pre_final_render_equals_output": true,
+    "file": "dwt/evidence/oracle/stages.txt"
+  },
+  "direction": {
+    "wire_challenge": "f32cec8d0000ead00263a8c0f324ec8e",
+    "challenge_post_ntohl": "8dec2cf3d0ea0000c0a863028eec24f3",
+    "before_transform": "buffer = received 16 bytes with each 32-bit word byte-swapped (dwt_prf ntohl, in place)",
+    "after_transform": "buffer = f(before) in place; dwt_prf memcmp's it against the host-order challenge words",
+    "pass_condition": "f(ntohl(reply_on_wire)) == host_order_challenge; reply = ntohl(f^-1(host_order_challenge))"
+  },
+  "live_probe_agreement": {
+    "matched": 11,
+    "total": 11,
+    "failures": []
+  },
+  "vector_count": 180
+}
diff --git a/dwt/evidence/oracle/driver.log b/dwt/evidence/oracle/driver.log
new file mode 100644
index 0000000..249180d
--- /dev/null
+++ b/dwt/evidence/oracle/driver.log
@@ -0,0 +1,52 @@
+180 vectors
+[runA] mame exit=0 wall=11.9s
+[runA] 177 outputs
+[runB] mame exit=0 wall=12.3s
+[runB] 177 outputs
+wrote /home/arti/code/k-space/vt1200/dwt/challenge_vectors.json (180 vectors)
+[stages] wrote /home/arti/code/k-space/vt1200/dwt/evidence/oracle/stages.txt
+live-probe agreement: 11/11
+{
+  "determinism": {
+    "boots": 2,
+    "inputs_compared": 177,
+    "differences": 0,
+    "first_differences": []
+  },
+  "per_record_independence": {
+    "errors": 0,
+    "examples": []
+  },
+  "permutation": {
+    "distinct_inputs": 152,
+    "distinct_outputs": 152,
+    "fixed_points": []
+  },
+  "avalanche": {
+    "samples": 64,
+    "mean_output_bits_changed_first_record": 32.656,
+    "min": 23,
+    "max": 42,
+    "second_record_changed": 0
+  },
+  "record_is_repeated": true,
+  "intermediate": {
+    "captured": 6,
+    "feistel_in_equals_input": true,
+    "pre_final_render_equals_output": true,
+    "file": "dwt/evidence/oracle/stages.txt"
+  },
+  "direction": {
+    "wire_challenge": "f32cec8d0000ead00263a8c0f324ec8e",
+    "challenge_post_ntohl": "8dec2cf3d0ea0000c0a863028eec24f3",
+    "before_transform": "buffer = received 16 bytes with each 32-bit word byte-swapped (dwt_prf ntohl, in place)",
+    "after_transform": "buffer = f(before) in place; dwt_prf memcmp's it against the host-order challenge words",
+    "pass_condition": "f(ntohl(reply_on_wire)) == host_order_challenge; reply = ntohl(f^-1(host_order_challenge))"
+  },
+  "live_probe_agreement": {
+    "matched": 11,
+    "total": 11,
+    "failures": []
+  },
+  "vector_count": 180
+}
diff --git a/dwt/evidence/oracle/driver_no_run.log b/dwt/evidence/oracle/driver_no_run.log
new file mode 100644
index 0000000..657cdad
--- /dev/null
+++ b/dwt/evidence/oracle/driver_no_run.log
@@ -0,0 +1,47 @@
+180 vectors
+wrote /home/arti/code/k-space/vt1200/dwt/challenge_vectors.json (180 vectors)
+live-probe agreement: 11/11
+{
+  "determinism": {
+    "boots": 2,
+    "inputs_compared": 177,
+    "differences": 0,
+    "first_differences": []
+  },
+  "per_record_independence": {
+    "errors": 0,
+    "examples": []
+  },
+  "permutation": {
+    "distinct_inputs": 152,
+    "distinct_outputs": 152,
+    "fixed_points": []
+  },
+  "avalanche": {
+    "samples": 64,
+    "mean_output_bits_changed_first_record": 32.656,
+    "min": 23,
+    "max": 42,
+    "second_record_changed": 0
+  },
+  "record_is_repeated": true,
+  "intermediate": {
+    "captured": 6,
+    "feistel_in_equals_input": true,
+    "pre_final_render_equals_output": true,
+    "file": "dwt/evidence/oracle/stages.txt"
+  },
+  "direction": {
+    "wire_challenge": "f32cec8d0000ead00263a8c0f324ec8e",
+    "challenge_post_ntohl": "8dec2cf3d0ea0000c0a863028eec24f3",
+    "before_transform": "buffer = received 16 bytes with each 32-bit word byte-swapped (dwt_prf ntohl, in place)",
+    "after_transform": "buffer = f(before) in place; dwt_prf memcmp's it against the host-order challenge words",
+    "pass_condition": "f(ntohl(reply_on_wire)) == host_order_challenge; reply = ntohl(f^-1(host_order_challenge))"
+  },
+  "live_probe_agreement": {
+    "matched": 11,
+    "total": 11,
+    "failures": []
+  },
+  "vector_count": 180
+}
diff --git a/dwt/evidence/oracle/runA/debug.log b/dwt/evidence/oracle/runA/debug.log
new file mode 100644
index 0000000..4b005fe
--- /dev/null
+++ b/dwt/evidence/oracle/runA/debug.log
@@ -0,0 +1,920 @@
+MAME debugger version 0.289 (mame0289-dirty)
+Currently targeting vt1200 (VT1200 X terminal (v2.2 firmware))
+>bclear
+ ^
+unknown command
+Breakpoint 1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 10 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 11 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 12 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 13 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 14 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 15 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 16 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 17 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 18 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 19 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 20 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 21 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 22 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 23 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 24 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 25 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 26 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 27 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 28 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 29 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 30 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 31 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 32 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 33 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 34 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 35 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 36 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 37 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 38 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 39 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 40 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 41 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 42 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 43 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 44 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 45 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 46 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 47 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 48 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 49 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 50 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 51 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 52 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 53 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 54 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 55 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 56 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 57 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 58 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 59 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 60 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 61 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 62 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 63 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 64 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 65 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 66 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 67 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 68 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 69 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 70 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 71 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 72 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 73 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 74 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 75 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 76 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 77 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 78 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 79 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 80 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 81 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 82 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 83 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 84 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 85 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 86 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 87 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 88 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 89 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 90 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 91 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 92 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 93 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 94 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 95 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 96 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 97 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 98 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 99 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A0 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A9 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AA set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AB set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AC set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AD set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AE set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AF set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B0 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
diff --git a/dwt/evidence/oracle/runA/in.txt b/dwt/evidence/oracle/runA/in.txt
new file mode 100644
index 0000000..17052e0
--- /dev/null
+++ b/dwt/evidence/oracle/runA/in.txt
@@ -0,0 +1,180 @@
+00000000000000000000000000000000
+ffffffffffffffffffffffffffffffff
+000102030405060708090a0b0c0d0e0f
+0f0e0d0c0b0a09080706050403020100
+aa55aa55aa55aa55aa55aa55aa55aa55
+55aa55aa55aa55aa55aa55aa55aa55aa
+0000000000000000ffffffffffffffff
+ffffffffffffffff0000000000000000
+80000000000000000000000000000000
+00000000000000008000000000000000
+7f000000000000000000000000000000
+00000000000000000100000000000000
+00112233445566770011223344556677
+f32cec8d0000ead00263a8c0f324ec8e
+8dec2cf3d0ea0000c0a863028eec24f3
+00000000000000000000000000000000
+00000001000000000000000000000000
+00000002000000000000000000000000
+00000003000000000000000000000000
+00000010000000000000000000000000
+00000020000000000000000000000000
+00000030000000000000000000000000
+00000080000000000000000000000000
+000000ff000000000000000000000000
+00000100000000000000000000000000
+00000000010000000000000000000000
+010102030405060708090a0b0c0d0e0f
+020102030405060708090a0b0c0d0e0f
+040102030405060708090a0b0c0d0e0f
+080102030405060708090a0b0c0d0e0f
+100102030405060708090a0b0c0d0e0f
+200102030405060708090a0b0c0d0e0f
+400102030405060708090a0b0c0d0e0f
+800102030405060708090a0b0c0d0e0f
+000002030405060708090a0b0c0d0e0f
+000302030405060708090a0b0c0d0e0f
+000502030405060708090a0b0c0d0e0f
+000902030405060708090a0b0c0d0e0f
+001102030405060708090a0b0c0d0e0f
+002102030405060708090a0b0c0d0e0f
+004102030405060708090a0b0c0d0e0f
+008102030405060708090a0b0c0d0e0f
+000103030405060708090a0b0c0d0e0f
+000100030405060708090a0b0c0d0e0f
+000106030405060708090a0b0c0d0e0f
+00010a030405060708090a0b0c0d0e0f
+000112030405060708090a0b0c0d0e0f
+000122030405060708090a0b0c0d0e0f
+000142030405060708090a0b0c0d0e0f
+000182030405060708090a0b0c0d0e0f
+000102020405060708090a0b0c0d0e0f
+000102010405060708090a0b0c0d0e0f
+000102070405060708090a0b0c0d0e0f
+0001020b0405060708090a0b0c0d0e0f
+000102130405060708090a0b0c0d0e0f
+000102230405060708090a0b0c0d0e0f
+000102430405060708090a0b0c0d0e0f
+000102830405060708090a0b0c0d0e0f
+000102030505060708090a0b0c0d0e0f
+000102030605060708090a0b0c0d0e0f
+000102030005060708090a0b0c0d0e0f
+000102030c05060708090a0b0c0d0e0f
+000102031405060708090a0b0c0d0e0f
+000102032405060708090a0b0c0d0e0f
+000102034405060708090a0b0c0d0e0f
+000102038405060708090a0b0c0d0e0f
+000102030404060708090a0b0c0d0e0f
+000102030407060708090a0b0c0d0e0f
+000102030401060708090a0b0c0d0e0f
+00010203040d060708090a0b0c0d0e0f
+000102030415060708090a0b0c0d0e0f
+000102030425060708090a0b0c0d0e0f
+000102030445060708090a0b0c0d0e0f
+000102030485060708090a0b0c0d0e0f
+000102030405070708090a0b0c0d0e0f
+000102030405040708090a0b0c0d0e0f
+000102030405020708090a0b0c0d0e0f
+0001020304050e0708090a0b0c0d0e0f
+000102030405160708090a0b0c0d0e0f
+000102030405260708090a0b0c0d0e0f
+000102030405460708090a0b0c0d0e0f
+000102030405860708090a0b0c0d0e0f
+000102030405060608090a0b0c0d0e0f
+000102030405060508090a0b0c0d0e0f
+000102030405060308090a0b0c0d0e0f
+000102030405060f08090a0b0c0d0e0f
+000102030405061708090a0b0c0d0e0f
+000102030405062708090a0b0c0d0e0f
+000102030405064708090a0b0c0d0e0f
+000102030405068708090a0b0c0d0e0f
+000102030405060709090a0b0c0d0e0f
+000102030405060708080a0b0c0d0e0f
+000102030405060708090b0b0c0d0e0f
+000102030405060708090a0a0c0d0e0f
+000102030405060708090a0b0d0d0e0f
+000102030405060708090a0b0c0c0e0f
+000102030405060708090a0b0c0d0f0f
+000102030405060708090a0b0c0d0e0e
+3501026c15e723a90000000000000000
+3501026c15e723a9ffffffffffffffff
+b26233a118609e470000000000000000
+b26233a118609e47ffffffffffffffff
+cd055494378d8c260000000000000000
+cd055494378d8c26ffffffffffffffff
+0d66c35b5d0e17000000000000000000
+0d66c35b5d0e1700ffffffffffffffff
+1d1ea39547625c8c0000000000000000
+1d1ea39547625c8cffffffffffffffff
+cddf89707ed28ca00000000000000000
+cddf89707ed28ca0ffffffffffffffff
+30c654040ab964900000000000000000
+30c654040ab96490ffffffffffffffff
+225412226117a6db0000000000000000
+225412226117a6dbffffffffffffffff
+0000000000000000748aadd2dc1ffdf2
+ffffffffffffffff748aadd2dc1ffdf2
+00000000000000004aa500e87edc64c4
+ffffffffffffffff4aa500e87edc64c4
+00000000000000006b6a5fb00237cad2
+ffffffffffffffff6b6a5fb00237cad2
+00000000000000008c8ff951a25f1570
+ffffffffffffffff8c8ff951a25f1570
+0000000000000000eb8a6a6991b61ff5
+ffffffffffffffffeb8a6a6991b61ff5
+00000000000000003a5eb345ffe4b82c
+ffffffffffffffff3a5eb345ffe4b82c
+00000000000000000d022175a50d18fc
+ffffffffffffffff0d022175a50d18fc
+00000000000000004a8d5e79aebdb5c8
+ffffffffffffffff4a8d5e79aebdb5c8
+8735ca449d06e48e92d9a690779e4f9a
+1a068ad8dc21dde0230f2e171bdf6835
+939999e9cfefb9a939e89b16ca161ab5
+ad34b10c287fd20998faa0af457b4709
+47d34ba7b939955a047cf68d737a61ea
+c3a2b00938d11fa1c92c641e712aca34
+e00ad1ad276852a1a5f2df2231952729
+3af2e6babf44ec5c1a55f0baa5fa9bda
+8a3b6d96439a3c3a00fe89b197f1c6d9
+00c5de6db0d87ac62982036bc9dcfc65
+3d69baf6a6fb385684057ef71c02a84f
+dc771563dfab03f5b61486f08d0420ed
+72dbc7ae27d3f52777c23a5aad142793
+e87423730ba482d37d2c5b81998a6e11
+485cc3950cf9bba76ea9a66114d74306
+eddc3862d2b887a09387b95d22f28d16
+98d7dda8c2c3d7a2cef816d1c57dd25b
+e59918d7f7440e10e34bb57226b23e3e
+795dd0f1748f2fcc6da86e78e523a6db
+ff374e2becd41ddfc34ef995bad74103
+79b01497977c38e8cadfbad60eb67e76
+a65fc3f7d66da24e73bbdacd9ce12c94
+a60b9669d2c984782cfa89992ae6a9d2
+9cac25c867b7e079ded45d428b2efcf9
+4908bbb17763ce521276697474f8d19b
+a7ba8dea495b0258c1e7782ea394c06a
+83f052520b2ad979727161de54d9581c
+a08e2045b24736220446c0637c406ab2
+490a2794e95ff3faf368b3693d3ff730
+bbde52c3fbe8ce87e330574e622a72c6
+fef29072dcaa31a29fef6013f989bc3d
+56201529bc79958577f97ab3d0633f0f
+f711da57a41d0b5b846db5e5c0ead574
+dd7b13e7479cb46208e84b6dccf5d7df
+29563ba35966fddd90ab8df4f8d46f53
+6951df1546b54e9a7902cb6d1f0ccfe8
+5f9bbbc7778be7198bee4284ac65fa5c
+4c5242b528b8d14a761c0989779b3e71
+fa3cbbe6139d9465cf5efc777d1ea6c5
+02e3aa2be481a7b4195c3a6435ebeb58
+3ed28369f5acef0097bb500bdf8d1115
+38cedaa0d9d0fba6829f37d697154869
+91145732a012b25cb686760edfdbcea2
+10591aff4360aff4ee77ef3d32db9bf7
+393952f7a6dd08ec511e329f7f57c94e
+5bfe98265bfa6885e6ce29783dcdb264
+de3a6461e30e89f4c2cfc154d11cb171
+f824d54a780f4fa96f6350d34e8bd760
+00000000000000000000000000000000
+000102030405060708090a0b0c0d0e0f
diff --git a/dwt/evidence/oracle/runA/nvram/vt1200/nvram b/dwt/evidence/oracle/runA/nvram/vt1200/nvram
new file mode 100644
index 0000000..08e7df1
Binary files /dev/null and b/dwt/evidence/oracle/runA/nvram/vt1200/nvram differ
diff --git a/dwt/evidence/oracle/runA/out.txt b/dwt/evidence/oracle/runA/out.txt
new file mode 100644
index 0000000..6b5b765
--- /dev/null
+++ b/dwt/evidence/oracle/runA/out.txt
@@ -0,0 +1,180 @@
+1 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+2 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 6A81040BF22944796A81040BF2294479
+3 000102030405060708090A0B0C0D0E0F 490621BA1F7A2F9AF3EE13199041B8EF
+4 0F0E0D0C0B0A09080706050403020100 47340C29C8B7BD41B8D97E1542ED3C35
+5 AA55AA55AA55AA55AA55AA55AA55AA55 BFF91EB2093E0FF1BFF91EB2093E0FF1
+6 55AA55AA55AA55AA55AA55AA55AA55AA 6A5628027555C59B6A5628027555C59B
+7 0000000000000000FFFFFFFFFFFFFFFF 90DE09B4728558176A81040BF2294479
+8 FFFFFFFFFFFFFFFF0000000000000000 6A81040BF229447990DE09B472855817
+9 80000000000000000000000000000000 C12005491321E97590DE09B472855817
+10 00000000000000008000000000000000 90DE09B472855817C12005491321E975
+11 7F000000000000000000000000000000 0A24C5C7784A080F90DE09B472855817
+12 00000000000000000100000000000000 90DE09B47285581705C18845D2682FBA
+13 00112233445566770011223344556677 DF11BB36BA20F348DF11BB36BA20F348
+14 F32CEC8D0000EAD00263A8C0F324EC8E 5D02BB9C37D40A5BE4F2363831815699
+15 8DEC2CF3D0EA0000C0A863028EEC24F3 BDB2D3E0FC00DB5FE31ECBD30F1E1B93
+16 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+17 00000001000000000000000000000000 B1975FF1D78D032A90DE09B472855817
+18 00000002000000000000000000000000 5865800E5D8C3C5590DE09B472855817
+19 00000003000000000000000000000000 EE590DF03C2BDBDD90DE09B472855817
+20 00000010000000000000000000000000 0B9AB22E400A068F90DE09B472855817
+21 00000020000000000000000000000000 362CF798EC8AE91890DE09B472855817
+22 00000030000000000000000000000000 9ECAE2E539A1635790DE09B472855817
+23 00000080000000000000000000000000 57D8297C38F7783B90DE09B472855817
+24 000000FF000000000000000000000000 FC00338C744B2D1B90DE09B472855817
+25 00000100000000000000000000000000 21105DAED5E13EC590DE09B472855817
+26 00000000010000000000000000000000 46BA798D00E10CDB90DE09B472855817
+27 010102030405060708090A0B0C0D0E0F 92BC012D93A116AEF3EE13199041B8EF
+28 020102030405060708090A0B0C0D0E0F 164015F196B01410F3EE13199041B8EF
+29 040102030405060708090A0B0C0D0E0F ABBD32F93542E6DFF3EE13199041B8EF
+30 080102030405060708090A0B0C0D0E0F 56DC26E290E8BE41F3EE13199041B8EF
+31 100102030405060708090A0B0C0D0E0F 301E846CBD602214F3EE13199041B8EF
+32 200102030405060708090A0B0C0D0E0F D30C1CC792BB30C9F3EE13199041B8EF
+33 400102030405060708090A0B0C0D0E0F FFC252AD921795ABF3EE13199041B8EF
+34 800102030405060708090A0B0C0D0E0F CFB469B1A5881636F3EE13199041B8EF
+35 000002030405060708090A0B0C0D0E0F AC8C291D71256BFBF3EE13199041B8EF
+36 000302030405060708090A0B0C0D0E0F 5CE92F90A6D5D14AF3EE13199041B8EF
+37 000502030405060708090A0B0C0D0E0F 22ACB5CAB75350ACF3EE13199041B8EF
+38 000902030405060708090A0B0C0D0E0F 68A54DDEE96445F3F3EE13199041B8EF
+39 001102030405060708090A0B0C0D0E0F 02346AA75DC726AFF3EE13199041B8EF
+40 002102030405060708090A0B0C0D0E0F DADD787249314ABAF3EE13199041B8EF
+41 004102030405060708090A0B0C0D0E0F 2B9C5C6FFC3A1F9EF3EE13199041B8EF
+42 008102030405060708090A0B0C0D0E0F F4E3474ACF62420CF3EE13199041B8EF
+43 000103030405060708090A0B0C0D0E0F EF72B6CC68559E6AF3EE13199041B8EF
+44 000100030405060708090A0B0C0D0E0F E4FDF0DD779B07ABF3EE13199041B8EF
+45 000106030405060708090A0B0C0D0E0F 4FFEB9CCE4068E81F3EE13199041B8EF
+46 00010A030405060708090A0B0C0D0E0F 9947C7DFF3D05245F3EE13199041B8EF
+47 000112030405060708090A0B0C0D0E0F 1FDF4A0763B9F83BF3EE13199041B8EF
+48 000122030405060708090A0B0C0D0E0F 932DC9C97C441E66F3EE13199041B8EF
+49 000142030405060708090A0B0C0D0E0F 18BA761EF97D5766F3EE13199041B8EF
+50 000182030405060708090A0B0C0D0E0F 86BBB870A3D2D245F3EE13199041B8EF
+51 000102020405060708090A0B0C0D0E0F 876784940262E686F3EE13199041B8EF
+52 000102010405060708090A0B0C0D0E0F BEFCCE7E438B0A31F3EE13199041B8EF
+53 000102070405060708090A0B0C0D0E0F 249BE14E8C537EC6F3EE13199041B8EF
+54 0001020B0405060708090A0B0C0D0E0F C593B7EB96B434F9F3EE13199041B8EF
+55 000102130405060708090A0B0C0D0E0F A449CCE9CDD9937BF3EE13199041B8EF
+56 000102230405060708090A0B0C0D0E0F A83EF09EEACC3EF9F3EE13199041B8EF
+57 000102430405060708090A0B0C0D0E0F 5049ACD27CE7CC18F3EE13199041B8EF
+58 000102830405060708090A0B0C0D0E0F 22F90834F70AC2FDF3EE13199041B8EF
+59 000102030505060708090A0B0C0D0E0F 6C3C483C112BF4A5F3EE13199041B8EF
+60 000102030605060708090A0B0C0D0E0F B090ED887529E1C8F3EE13199041B8EF
+61 000102030005060708090A0B0C0D0E0F 2E926606B0294C9DF3EE13199041B8EF
+62 000102030C05060708090A0B0C0D0E0F AEEF4164A1CBA00DF3EE13199041B8EF
+63 000102031405060708090A0B0C0D0E0F C8C629BC2A2694B8F3EE13199041B8EF
+64 000102032405060708090A0B0C0D0E0F 8E07759B6844E0E9F3EE13199041B8EF
+65 000102034405060708090A0B0C0D0E0F 759D964D0C40CC1FF3EE13199041B8EF
+66 000102038405060708090A0B0C0D0E0F FD4090C4A77C4B72F3EE13199041B8EF
+67 000102030404060708090A0B0C0D0E0F F46AFCCCD96861CAF3EE13199041B8EF
+68 000102030407060708090A0B0C0D0E0F E9323C9D59A033E5F3EE13199041B8EF
+69 000102030401060708090A0B0C0D0E0F 598BD0DF5D9E7250F3EE13199041B8EF
+70 00010203040D060708090A0B0C0D0E0F 334E6948C674FA42F3EE13199041B8EF
+71 000102030415060708090A0B0C0D0E0F C9F599B0C58D1092F3EE13199041B8EF
+72 000102030425060708090A0B0C0D0E0F 2F482E0CEA3B8C9BF3EE13199041B8EF
+73 000102030445060708090A0B0C0D0E0F 638C609AEAFCC4BCF3EE13199041B8EF
+74 000102030485060708090A0B0C0D0E0F 92B400ED0B282E70F3EE13199041B8EF
+75 000102030405070708090A0B0C0D0E0F 1D5D0E33202104C4F3EE13199041B8EF
+76 000102030405040708090A0B0C0D0E0F FAE5E314891347B1F3EE13199041B8EF
+77 000102030405020708090A0B0C0D0E0F 5439E903E0ACADB9F3EE13199041B8EF
+78 0001020304050E0708090A0B0C0D0E0F 0CFAED9F09FA568EF3EE13199041B8EF
+79 000102030405160708090A0B0C0D0E0F 31AD575576D6BA77F3EE13199041B8EF
+80 000102030405260708090A0B0C0D0E0F D3AD6AF78B407CCDF3EE13199041B8EF
+81 000102030405460708090A0B0C0D0E0F 6A8D0B396A2A9FAEF3EE13199041B8EF
+82 000102030405860708090A0B0C0D0E0F C4E4173D22348AD4F3EE13199041B8EF
+83 000102030405060608090A0B0C0D0E0F 7B6AB5D4C1731566F3EE13199041B8EF
+84 000102030405060508090A0B0C0D0E0F E1AD86D595EE2004F3EE13199041B8EF
+85 000102030405060308090A0B0C0D0E0F B2E4C1BC21486D9AF3EE13199041B8EF
+86 000102030405060F08090A0B0C0D0E0F 5CC4B03FA98A98C3F3EE13199041B8EF
+87 000102030405061708090A0B0C0D0E0F A12FFD65E0D144DDF3EE13199041B8EF
+88 000102030405062708090A0B0C0D0E0F A640E50DB6B1F841F3EE13199041B8EF
+89 000102030405064708090A0B0C0D0E0F C6A07E62940EAFA8F3EE13199041B8EF
+90 000102030405068708090A0B0C0D0E0F 31C89B8122781DBCF3EE13199041B8EF
+91 000102030405060709090A0B0C0D0E0F 490621BA1F7A2F9AC716E3D7791FEE58
+92 000102030405060708080A0B0C0D0E0F 490621BA1F7A2F9A6E5E338E84F025B7
+93 000102030405060708090B0B0C0D0E0F 490621BA1F7A2F9A0F49DDCFAF30192A
+94 000102030405060708090A0A0C0D0E0F 490621BA1F7A2F9AAAA449BF0B87891F
+95 000102030405060708090A0B0D0D0E0F 490621BA1F7A2F9ADF98D6B3C074A265
+96 000102030405060708090A0B0C0C0E0F 490621BA1F7A2F9A1EA4227224DBB1E9
+97 000102030405060708090A0B0C0D0F0F 490621BA1F7A2F9AE8EFE545C1C86949
+98 000102030405060708090A0B0C0D0E0E 490621BA1F7A2F9A52705DB9168BFBCB
+99 3501026C15E723A90000000000000000 7356BEBF9EFA99D690DE09B472855817
+100 3501026C15E723A9FFFFFFFFFFFFFFFF 7356BEBF9EFA99D66A81040BF2294479
+101 B26233A118609E470000000000000000 795A7CFE96A7460590DE09B472855817
+102 B26233A118609E47FFFFFFFFFFFFFFFF 795A7CFE96A746056A81040BF2294479
+103 CD055494378D8C260000000000000000 0EA29507D5F9AF1390DE09B472855817
+104 CD055494378D8C26FFFFFFFFFFFFFFFF 0EA29507D5F9AF136A81040BF2294479
+105 0D66C35B5D0E17000000000000000000 B268C381A0D29AF590DE09B472855817
+106 0D66C35B5D0E1700FFFFFFFFFFFFFFFF B268C381A0D29AF56A81040BF2294479
+107 1D1EA39547625C8C0000000000000000 381F7A0F0C40D91490DE09B472855817
+108 1D1EA39547625C8CFFFFFFFFFFFFFFFF 381F7A0F0C40D9146A81040BF2294479
+109 CDDF89707ED28CA00000000000000000 2A9F66460C954E0F90DE09B472855817
+110 CDDF89707ED28CA0FFFFFFFFFFFFFFFF 2A9F66460C954E0F6A81040BF2294479
+111 30C654040AB964900000000000000000 4B96772686A6414490DE09B472855817
+112 30C654040AB96490FFFFFFFFFFFFFFFF 4B96772686A641446A81040BF2294479
+113 225412226117A6DB0000000000000000 94DFBB7B696FF68890DE09B472855817
+114 225412226117A6DBFFFFFFFFFFFFFFFF 94DFBB7B696FF6886A81040BF2294479
+115 0000000000000000748AADD2DC1FFDF2 90DE09B4728558174F042D404735FBC2
+116 FFFFFFFFFFFFFFFF748AADD2DC1FFDF2 6A81040BF22944794F042D404735FBC2
+117 00000000000000004AA500E87EDC64C4 90DE09B472855817F7BEA28401464AA9
+118 FFFFFFFFFFFFFFFF4AA500E87EDC64C4 6A81040BF2294479F7BEA28401464AA9
+119 00000000000000006B6A5FB00237CAD2 90DE09B472855817794F1F3EB90C3F7C
+120 FFFFFFFFFFFFFFFF6B6A5FB00237CAD2 6A81040BF2294479794F1F3EB90C3F7C
+121 00000000000000008C8FF951A25F1570 90DE09B472855817F867951521BD7C78
+122 FFFFFFFFFFFFFFFF8C8FF951A25F1570 6A81040BF2294479F867951521BD7C78
+123 0000000000000000EB8A6A6991B61FF5 90DE09B4728558170741BEF82537B2D2
+124 FFFFFFFFFFFFFFFFEB8A6A6991B61FF5 6A81040BF22944790741BEF82537B2D2
+125 00000000000000003A5EB345FFE4B82C 90DE09B472855817670D4E8E84E288A3
+126 FFFFFFFFFFFFFFFF3A5EB345FFE4B82C 6A81040BF2294479670D4E8E84E288A3
+127 00000000000000000D022175A50D18FC 90DE09B4728558170A2E1C9971E91D1B
+128 FFFFFFFFFFFFFFFF0D022175A50D18FC 6A81040BF22944790A2E1C9971E91D1B
+129 00000000000000004A8D5E79AEBDB5C8 90DE09B47285581759AD04B586354818
+130 FFFFFFFFFFFFFFFF4A8D5E79AEBDB5C8 6A81040BF229447959AD04B586354818
+131 8735CA449D06E48E92D9A690779E4F9A B6F66EF5F2A5CEDD30E1A1FB479AB692
+132 1A068AD8DC21DDE0230F2E171BDF6835 60CBAE07071171FAFE324AF662D56547
+133 939999E9CFEFB9A939E89B16CA161AB5 4BCB501A7C79B71F9E2D2DF7D0F9970A
+134 AD34B10C287FD20998FAA0AF457B4709 D4232710A53156107F0626F57F27107A
+135 47D34BA7B939955A047CF68D737A61EA A251C1CBDC69BE78D58EBBC1F3D245E1
+136 C3A2B00938D11FA1C92C641E712ACA34 5B660019C0379E8E87549E42DDD8DC91
+137 E00AD1AD276852A1A5F2DF2231952729 E5BCBAA614D6EAC3D2BAE6DFB65ADB39
+138 3AF2E6BABF44EC5C1A55F0BAA5FA9BDA 45D82CB113CBD25D673BC3E62822A3DA
+139 8A3B6D96439A3C3A00FE89B197F1C6D9 ADF093B70042B643DDE4A30B27D911D7
+140 00C5DE6DB0D87AC62982036BC9DCFC65 6288D3E03AE6F7E14ECA401C5BA5FD27
+141 3D69BAF6A6FB385684057EF71C02A84F DC44EC4BE6E8C4D8B7BA15FFC141C2C3
+142 DC771563DFAB03F5B61486F08D0420ED BB4BC8C0DA0F67F067F1E050CCCC4496
+143 72DBC7AE27D3F52777C23A5AAD142793 A08EAD92445C042EC35E0E35CCBF4D63
+144 E87423730BA482D37D2C5B81998A6E11 E27DBC03E384000E6856245C601C066C
+145 485CC3950CF9BBA76EA9A66114D74306 6CEB557795AF089EBA4E64DE032E7B0C
+146 EDDC3862D2B887A09387B95D22F28D16 9063E689A041631B5E4221F07C6C2547
+147 98D7DDA8C2C3D7A2CEF816D1C57DD25B 4B4DBF8AB4AEFD03A982AD51D10C36B4
+148 E59918D7F7440E10E34BB57226B23E3E CADE8C78EE6A226D1371950638D6E524
+149 795DD0F1748F2FCC6DA86E78E523A6DB 4D0AF9FDDE099932CCEAE634E6A6E4F2
+150 FF374E2BECD41DDFC34EF995BAD74103 53E283C3D30CA9B14B819686A25F04EF
+151 79B01497977C38E8CADFBAD60EB67E76 6B1D1EC7F7CA646D4D8D767DD61D9D70
+152 A65FC3F7D66DA24E73BBDACD9CE12C94 988849D83BE204C765C6B42BEB78DCDF
+153 A60B9669D2C984782CFA89992AE6A9D2 6657BFCA2E87A070AF6045DBEFCCF55F
+154 9CAC25C867B7E079DED45D428B2EFCF9 F39D44D3E059E4E01127F65B9FBB20B6
+155 4908BBB17763CE521276697474F8D19B 016964D9028D40780288FA31A2BD56F7
+156 A7BA8DEA495B0258C1E7782EA394C06A 1A13C5630A767779570AF70E38937996
+157 83F052520B2AD979727161DE54D9581C 7D242666DBE8B30EFE5E4830923218A0
+158 A08E2045B24736220446C0637C406AB2 AFC79C27120E812F3A767842CEC3F8F4
+159 490A2794E95FF3FAF368B3693D3FF730 5CB8795143440BF5481E9B7D3F2BECCC
+160 BBDE52C3FBE8CE87E330574E622A72C6 3C5AF926F6E820BA1ADDBC9449CE9AEB
+161 FEF29072DCAA31A29FEF6013F989BC3D 10C67B8B791D948F0F946CCF8E6C195E
+162 56201529BC79958577F97AB3D0633F0F 010A4F36BBC6229FF7538406754CDC9A
+163 F711DA57A41D0B5B846DB5E5C0EAD574 8582DCF8562B6E7F7E66F3354C21A503
+164 DD7B13E7479CB46208E84B6DCCF5D7DF 79F9A78684ADCD5BF1BFE7701C18CE01
+165 29563BA35966FDDD90AB8DF4F8D46F53 A9C1E15117EE664024EBB66BE44FDD3E
+166 6951DF1546B54E9A7902CB6D1F0CCFE8 31BD9E6914FF5D15229DB8AC1315ED84
+167 5F9BBBC7778BE7198BEE4284AC65FA5C E825EBCD5AB616A4C376755A70DD5D85
+168 4C5242B528B8D14A761C0989779B3E71 7131EC719F72A11319139DD9D9DCA7A5
+169 FA3CBBE6139D9465CF5EFC777D1EA6C5 ABE7686EED7024017E1FCAFAA6B87F74
+170 02E3AA2BE481A7B4195C3A6435EBEB58 2D11D2406B8E1F2D8029F710E0477610
+171 3ED28369F5ACEF0097BB500BDF8D1115 C6240578965F1A4FB77BF238BD903B39
+172 38CEDAA0D9D0FBA6829F37D697154869 4A8A4CC4E5F5F8F8809C5F96357942E8
+173 91145732A012B25CB686760EDFDBCEA2 D1410B2F2B76ECFA4B2EAFF0C3308013
+174 10591AFF4360AFF4EE77EF3D32DB9BF7 DF82591209484A8E43282118EB19E424
+175 393952F7A6DD08EC511E329F7F57C94E 81A173BF7CB18B44A8AC7214F662C513
+176 5BFE98265BFA6885E6CE29783DCDB264 7C514C2CC9B44C1F490844A9EEC42370
+177 DE3A6461E30E89F4C2CFC154D11CB171 7B5E780F51CE26A7A3CFD770C8007984
+178 F824D54A780F4FA96F6350D34E8BD760 858DA30DD7E423F22EF0076AE22D19CE
+179 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+180 000102030405060708090A0B0C0D0E0F 490621BA1F7A2F9AF3EE13199041B8EF
diff --git a/dwt/evidence/oracle/runA/stdout.log b/dwt/evidence/oracle/runA/stdout.log
new file mode 100644
index 0000000..6cdf071
--- /dev/null
+++ b/dwt/evidence/oracle/runA/stdout.log
@@ -0,0 +1,55 @@
+Warning: -video none doesn't make much sense without -seconds_to_run
+vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
+runA: loaded 180 vectors from /home/arti/code/k-space/vt1200/dwt/evidence/oracle/runA/in.txt
+vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
+vt1200: scanline#1 line=1 enabled=1
+vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
+vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
+vt1200: scanline#2 line=0 enabled=1
+vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
+vt1200: scanline#3 line=1 enabled=1
+vt1200: scanline#4 line=2 enabled=1
+runA: frame 3000 hijack pc=3F579970 sp=007F52B0 a14=007DDC90
+runA: init returned; @1C0200=007AB930 @1C0220=00000000 @1C0240=00000000 @1C0260=007AF970
+runA: expand returned; keyptr=007AF970 fontptr=00000000 renderptr=00000000
+runA: seed+000 55F861C7E51311D4C80000000000000000000000000000000000000000000000
+runA: seed+020 0000000000003A322A221A120A023C342C241C140C043E362E261E160E064038
+runA: seed+040 30282018100839312921191109013B332B231B130B033D352D251D150D053F37
+runA: seed+060 2F271F170F07280830103818402027072F0F37173F1F26062E0E36163E1E2505
+runA: key+000 2C3E1F020130080D2D23281F080019120B333920171A00063227333C09041308
+runA: key+020 370E1D18020B0107112D3C2B292C12203A3B250702003D030A1E3B0B272C0010
+runA: key+040 3B110B1C2010212E052D2B2C11092A10262725320410113D2B063D2D02392200
+runA: key+060 30371C0D0006143512193F310A302204351F232B3004061323082E3E2D1A2400
+runA: aux+000 39312921191109013A322A221A120A023B332B231B130B033C342C243F372F27
+runA: aux+020 1F170F073E362E261E160E063D352D251D150D051C140C0401020406080A0C0E
+runA: aux+040 0F11131517191B1C0E110B180105031C0F06150A17130C041A0810071B140D02
+runA: aux+060 29341F252F371E28332D21302C31273822352E2A32241D200E040D01020F0B08
+runA: aux+080 030A060C05090007000F07040E020D010A060C0B0905030804010E080D06020B
+runA: aux+0A0 0F0C0907030A05000F0C080204090107050B030E0A00060D0F01080E060B0304
+runA: aux+0C0 0907020D0C00050A030D04070F02080E0C00010A06090B05000E070B0A040D01
+runA: aux+0E0 05080C060903020F0D080A01030F04020B06070C00050E090A00090E06030F05
+runA: aux+100 010D0C070B0402080D0700090304060A0208050E0C0B0F010D060409080F0300
+runA: aux+120 0B01020C050A0E07010A0D0006090807040F0E030B05020C070D0E030006090A
+runA: aux+140 010208050B0C040F0D080B05060F00030407020C010A0E090A0609000C0B070D
+runA: aux+160 0F01030E05020804030F00060A010D080904050B0C07020E020C0401070A0B06
+runA: aux+180 0805030F0D000E090E0B020C04070D0105000F0A030908060402010B0A0D0708
+runA: aux+1A0 0F090C050603000E0B080C07010E020D060F00090A0405030C010A0F09020608
+runA: aux+1C0 000D03040E07050B0A0F0402070C090506010D0E000B0308090E0F0502080C03
+runA: aux+1E0 0700040A010D0B060403020C09050F0A0B0E01070600080D040B020E0F00080D
+runA: aux+200 030C0907050A06010D000B070409010A0E03050C020F080601040B0D0C03070E
+runA: aux+220 0A0F060800050902060B0D0801040A070905000F0E02030C0D020804060F0B01
+runA: aux+240 0A09030E05000C07010F0D080A0307040C05060B000E0902070B0401090C0E02
+runA: aux+260 00060A0D0F03050802010E07040A080D0F0C09000305060B100714151D0C1C11
+runA: aux+280 010F171A05121F0A0208180E201B0309130D1E06160B041930B97A0000000000
+runA: aux+2A0 0000000070F97A00800000004000000020000000100000000800000004000000
+runA: 24/180 vectors
+runA: 49/180 vectors
+runA: 74/180 vectors
+runA: 99/180 vectors
+runA: 124/180 vectors
+runA: 149/180 vectors
+runA: 174/180 vectors
+runA: 180/180 vectors
+runA: free returned; exiting
+runA: done (free_run), rc=0
+Average speed: 372.44% (41 seconds)
diff --git a/dwt/evidence/oracle/runB/debug.log b/dwt/evidence/oracle/runB/debug.log
new file mode 100644
index 0000000..4b005fe
--- /dev/null
+++ b/dwt/evidence/oracle/runB/debug.log
@@ -0,0 +1,920 @@
+MAME debugger version 0.289 (mame0289-dirty)
+Currently targeting vt1200 (VT1200 X terminal (v2.2 firmware))
+>bclear
+ ^
+unknown command
+Breakpoint 1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 10 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 11 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 12 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 13 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 14 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 15 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 16 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 17 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 18 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 19 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 20 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 21 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 22 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 23 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 24 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 25 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 26 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 27 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 28 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 29 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 30 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 31 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 32 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 33 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 34 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 35 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 36 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 37 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 38 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 39 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 40 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 41 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 42 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 43 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 44 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 45 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 46 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 47 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 48 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 49 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 50 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 51 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 52 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 53 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 54 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 55 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 56 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 57 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 58 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 59 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 60 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 61 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 62 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 63 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 64 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 65 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 66 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 67 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 68 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 69 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 70 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 71 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 72 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 73 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 74 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 75 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 76 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 77 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 78 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 79 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 80 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 81 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 82 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 83 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 84 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 85 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 86 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 87 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 88 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 89 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 90 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 91 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 92 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 93 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 94 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 95 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 96 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 97 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 98 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 99 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A0 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A9 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AA set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AB set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AC set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AD set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AE set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AF set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B0 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
diff --git a/dwt/evidence/oracle/runB/in.txt b/dwt/evidence/oracle/runB/in.txt
new file mode 100644
index 0000000..17052e0
--- /dev/null
+++ b/dwt/evidence/oracle/runB/in.txt
@@ -0,0 +1,180 @@
+00000000000000000000000000000000
+ffffffffffffffffffffffffffffffff
+000102030405060708090a0b0c0d0e0f
+0f0e0d0c0b0a09080706050403020100
+aa55aa55aa55aa55aa55aa55aa55aa55
+55aa55aa55aa55aa55aa55aa55aa55aa
+0000000000000000ffffffffffffffff
+ffffffffffffffff0000000000000000
+80000000000000000000000000000000
+00000000000000008000000000000000
+7f000000000000000000000000000000
+00000000000000000100000000000000
+00112233445566770011223344556677
+f32cec8d0000ead00263a8c0f324ec8e
+8dec2cf3d0ea0000c0a863028eec24f3
+00000000000000000000000000000000
+00000001000000000000000000000000
+00000002000000000000000000000000
+00000003000000000000000000000000
+00000010000000000000000000000000
+00000020000000000000000000000000
+00000030000000000000000000000000
+00000080000000000000000000000000
+000000ff000000000000000000000000
+00000100000000000000000000000000
+00000000010000000000000000000000
+010102030405060708090a0b0c0d0e0f
+020102030405060708090a0b0c0d0e0f
+040102030405060708090a0b0c0d0e0f
+080102030405060708090a0b0c0d0e0f
+100102030405060708090a0b0c0d0e0f
+200102030405060708090a0b0c0d0e0f
+400102030405060708090a0b0c0d0e0f
+800102030405060708090a0b0c0d0e0f
+000002030405060708090a0b0c0d0e0f
+000302030405060708090a0b0c0d0e0f
+000502030405060708090a0b0c0d0e0f
+000902030405060708090a0b0c0d0e0f
+001102030405060708090a0b0c0d0e0f
+002102030405060708090a0b0c0d0e0f
+004102030405060708090a0b0c0d0e0f
+008102030405060708090a0b0c0d0e0f
+000103030405060708090a0b0c0d0e0f
+000100030405060708090a0b0c0d0e0f
+000106030405060708090a0b0c0d0e0f
+00010a030405060708090a0b0c0d0e0f
+000112030405060708090a0b0c0d0e0f
+000122030405060708090a0b0c0d0e0f
+000142030405060708090a0b0c0d0e0f
+000182030405060708090a0b0c0d0e0f
+000102020405060708090a0b0c0d0e0f
+000102010405060708090a0b0c0d0e0f
+000102070405060708090a0b0c0d0e0f
+0001020b0405060708090a0b0c0d0e0f
+000102130405060708090a0b0c0d0e0f
+000102230405060708090a0b0c0d0e0f
+000102430405060708090a0b0c0d0e0f
+000102830405060708090a0b0c0d0e0f
+000102030505060708090a0b0c0d0e0f
+000102030605060708090a0b0c0d0e0f
+000102030005060708090a0b0c0d0e0f
+000102030c05060708090a0b0c0d0e0f
+000102031405060708090a0b0c0d0e0f
+000102032405060708090a0b0c0d0e0f
+000102034405060708090a0b0c0d0e0f
+000102038405060708090a0b0c0d0e0f
+000102030404060708090a0b0c0d0e0f
+000102030407060708090a0b0c0d0e0f
+000102030401060708090a0b0c0d0e0f
+00010203040d060708090a0b0c0d0e0f
+000102030415060708090a0b0c0d0e0f
+000102030425060708090a0b0c0d0e0f
+000102030445060708090a0b0c0d0e0f
+000102030485060708090a0b0c0d0e0f
+000102030405070708090a0b0c0d0e0f
+000102030405040708090a0b0c0d0e0f
+000102030405020708090a0b0c0d0e0f
+0001020304050e0708090a0b0c0d0e0f
+000102030405160708090a0b0c0d0e0f
+000102030405260708090a0b0c0d0e0f
+000102030405460708090a0b0c0d0e0f
+000102030405860708090a0b0c0d0e0f
+000102030405060608090a0b0c0d0e0f
+000102030405060508090a0b0c0d0e0f
+000102030405060308090a0b0c0d0e0f
+000102030405060f08090a0b0c0d0e0f
+000102030405061708090a0b0c0d0e0f
+000102030405062708090a0b0c0d0e0f
+000102030405064708090a0b0c0d0e0f
+000102030405068708090a0b0c0d0e0f
+000102030405060709090a0b0c0d0e0f
+000102030405060708080a0b0c0d0e0f
+000102030405060708090b0b0c0d0e0f
+000102030405060708090a0a0c0d0e0f
+000102030405060708090a0b0d0d0e0f
+000102030405060708090a0b0c0c0e0f
+000102030405060708090a0b0c0d0f0f
+000102030405060708090a0b0c0d0e0e
+3501026c15e723a90000000000000000
+3501026c15e723a9ffffffffffffffff
+b26233a118609e470000000000000000
+b26233a118609e47ffffffffffffffff
+cd055494378d8c260000000000000000
+cd055494378d8c26ffffffffffffffff
+0d66c35b5d0e17000000000000000000
+0d66c35b5d0e1700ffffffffffffffff
+1d1ea39547625c8c0000000000000000
+1d1ea39547625c8cffffffffffffffff
+cddf89707ed28ca00000000000000000
+cddf89707ed28ca0ffffffffffffffff
+30c654040ab964900000000000000000
+30c654040ab96490ffffffffffffffff
+225412226117a6db0000000000000000
+225412226117a6dbffffffffffffffff
+0000000000000000748aadd2dc1ffdf2
+ffffffffffffffff748aadd2dc1ffdf2
+00000000000000004aa500e87edc64c4
+ffffffffffffffff4aa500e87edc64c4
+00000000000000006b6a5fb00237cad2
+ffffffffffffffff6b6a5fb00237cad2
+00000000000000008c8ff951a25f1570
+ffffffffffffffff8c8ff951a25f1570
+0000000000000000eb8a6a6991b61ff5
+ffffffffffffffffeb8a6a6991b61ff5
+00000000000000003a5eb345ffe4b82c
+ffffffffffffffff3a5eb345ffe4b82c
+00000000000000000d022175a50d18fc
+ffffffffffffffff0d022175a50d18fc
+00000000000000004a8d5e79aebdb5c8
+ffffffffffffffff4a8d5e79aebdb5c8
+8735ca449d06e48e92d9a690779e4f9a
+1a068ad8dc21dde0230f2e171bdf6835
+939999e9cfefb9a939e89b16ca161ab5
+ad34b10c287fd20998faa0af457b4709
+47d34ba7b939955a047cf68d737a61ea
+c3a2b00938d11fa1c92c641e712aca34
+e00ad1ad276852a1a5f2df2231952729
+3af2e6babf44ec5c1a55f0baa5fa9bda
+8a3b6d96439a3c3a00fe89b197f1c6d9
+00c5de6db0d87ac62982036bc9dcfc65
+3d69baf6a6fb385684057ef71c02a84f
+dc771563dfab03f5b61486f08d0420ed
+72dbc7ae27d3f52777c23a5aad142793
+e87423730ba482d37d2c5b81998a6e11
+485cc3950cf9bba76ea9a66114d74306
+eddc3862d2b887a09387b95d22f28d16
+98d7dda8c2c3d7a2cef816d1c57dd25b
+e59918d7f7440e10e34bb57226b23e3e
+795dd0f1748f2fcc6da86e78e523a6db
+ff374e2becd41ddfc34ef995bad74103
+79b01497977c38e8cadfbad60eb67e76
+a65fc3f7d66da24e73bbdacd9ce12c94
+a60b9669d2c984782cfa89992ae6a9d2
+9cac25c867b7e079ded45d428b2efcf9
+4908bbb17763ce521276697474f8d19b
+a7ba8dea495b0258c1e7782ea394c06a
+83f052520b2ad979727161de54d9581c
+a08e2045b24736220446c0637c406ab2
+490a2794e95ff3faf368b3693d3ff730
+bbde52c3fbe8ce87e330574e622a72c6
+fef29072dcaa31a29fef6013f989bc3d
+56201529bc79958577f97ab3d0633f0f
+f711da57a41d0b5b846db5e5c0ead574
+dd7b13e7479cb46208e84b6dccf5d7df
+29563ba35966fddd90ab8df4f8d46f53
+6951df1546b54e9a7902cb6d1f0ccfe8
+5f9bbbc7778be7198bee4284ac65fa5c
+4c5242b528b8d14a761c0989779b3e71
+fa3cbbe6139d9465cf5efc777d1ea6c5
+02e3aa2be481a7b4195c3a6435ebeb58
+3ed28369f5acef0097bb500bdf8d1115
+38cedaa0d9d0fba6829f37d697154869
+91145732a012b25cb686760edfdbcea2
+10591aff4360aff4ee77ef3d32db9bf7
+393952f7a6dd08ec511e329f7f57c94e
+5bfe98265bfa6885e6ce29783dcdb264
+de3a6461e30e89f4c2cfc154d11cb171
+f824d54a780f4fa96f6350d34e8bd760
+00000000000000000000000000000000
+000102030405060708090a0b0c0d0e0f
diff --git a/dwt/evidence/oracle/runB/nvram/vt1200/nvram b/dwt/evidence/oracle/runB/nvram/vt1200/nvram
new file mode 100644
index 0000000..08e7df1
Binary files /dev/null and b/dwt/evidence/oracle/runB/nvram/vt1200/nvram differ
diff --git a/dwt/evidence/oracle/runB/out.txt b/dwt/evidence/oracle/runB/out.txt
new file mode 100644
index 0000000..6b5b765
--- /dev/null
+++ b/dwt/evidence/oracle/runB/out.txt
@@ -0,0 +1,180 @@
+1 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+2 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 6A81040BF22944796A81040BF2294479
+3 000102030405060708090A0B0C0D0E0F 490621BA1F7A2F9AF3EE13199041B8EF
+4 0F0E0D0C0B0A09080706050403020100 47340C29C8B7BD41B8D97E1542ED3C35
+5 AA55AA55AA55AA55AA55AA55AA55AA55 BFF91EB2093E0FF1BFF91EB2093E0FF1
+6 55AA55AA55AA55AA55AA55AA55AA55AA 6A5628027555C59B6A5628027555C59B
+7 0000000000000000FFFFFFFFFFFFFFFF 90DE09B4728558176A81040BF2294479
+8 FFFFFFFFFFFFFFFF0000000000000000 6A81040BF229447990DE09B472855817
+9 80000000000000000000000000000000 C12005491321E97590DE09B472855817
+10 00000000000000008000000000000000 90DE09B472855817C12005491321E975
+11 7F000000000000000000000000000000 0A24C5C7784A080F90DE09B472855817
+12 00000000000000000100000000000000 90DE09B47285581705C18845D2682FBA
+13 00112233445566770011223344556677 DF11BB36BA20F348DF11BB36BA20F348
+14 F32CEC8D0000EAD00263A8C0F324EC8E 5D02BB9C37D40A5BE4F2363831815699
+15 8DEC2CF3D0EA0000C0A863028EEC24F3 BDB2D3E0FC00DB5FE31ECBD30F1E1B93
+16 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+17 00000001000000000000000000000000 B1975FF1D78D032A90DE09B472855817
+18 00000002000000000000000000000000 5865800E5D8C3C5590DE09B472855817
+19 00000003000000000000000000000000 EE590DF03C2BDBDD90DE09B472855817
+20 00000010000000000000000000000000 0B9AB22E400A068F90DE09B472855817
+21 00000020000000000000000000000000 362CF798EC8AE91890DE09B472855817
+22 00000030000000000000000000000000 9ECAE2E539A1635790DE09B472855817
+23 00000080000000000000000000000000 57D8297C38F7783B90DE09B472855817
+24 000000FF000000000000000000000000 FC00338C744B2D1B90DE09B472855817
+25 00000100000000000000000000000000 21105DAED5E13EC590DE09B472855817
+26 00000000010000000000000000000000 46BA798D00E10CDB90DE09B472855817
+27 010102030405060708090A0B0C0D0E0F 92BC012D93A116AEF3EE13199041B8EF
+28 020102030405060708090A0B0C0D0E0F 164015F196B01410F3EE13199041B8EF
+29 040102030405060708090A0B0C0D0E0F ABBD32F93542E6DFF3EE13199041B8EF
+30 080102030405060708090A0B0C0D0E0F 56DC26E290E8BE41F3EE13199041B8EF
+31 100102030405060708090A0B0C0D0E0F 301E846CBD602214F3EE13199041B8EF
+32 200102030405060708090A0B0C0D0E0F D30C1CC792BB30C9F3EE13199041B8EF
+33 400102030405060708090A0B0C0D0E0F FFC252AD921795ABF3EE13199041B8EF
+34 800102030405060708090A0B0C0D0E0F CFB469B1A5881636F3EE13199041B8EF
+35 000002030405060708090A0B0C0D0E0F AC8C291D71256BFBF3EE13199041B8EF
+36 000302030405060708090A0B0C0D0E0F 5CE92F90A6D5D14AF3EE13199041B8EF
+37 000502030405060708090A0B0C0D0E0F 22ACB5CAB75350ACF3EE13199041B8EF
+38 000902030405060708090A0B0C0D0E0F 68A54DDEE96445F3F3EE13199041B8EF
+39 001102030405060708090A0B0C0D0E0F 02346AA75DC726AFF3EE13199041B8EF
+40 002102030405060708090A0B0C0D0E0F DADD787249314ABAF3EE13199041B8EF
+41 004102030405060708090A0B0C0D0E0F 2B9C5C6FFC3A1F9EF3EE13199041B8EF
+42 008102030405060708090A0B0C0D0E0F F4E3474ACF62420CF3EE13199041B8EF
+43 000103030405060708090A0B0C0D0E0F EF72B6CC68559E6AF3EE13199041B8EF
+44 000100030405060708090A0B0C0D0E0F E4FDF0DD779B07ABF3EE13199041B8EF
+45 000106030405060708090A0B0C0D0E0F 4FFEB9CCE4068E81F3EE13199041B8EF
+46 00010A030405060708090A0B0C0D0E0F 9947C7DFF3D05245F3EE13199041B8EF
+47 000112030405060708090A0B0C0D0E0F 1FDF4A0763B9F83BF3EE13199041B8EF
+48 000122030405060708090A0B0C0D0E0F 932DC9C97C441E66F3EE13199041B8EF
+49 000142030405060708090A0B0C0D0E0F 18BA761EF97D5766F3EE13199041B8EF
+50 000182030405060708090A0B0C0D0E0F 86BBB870A3D2D245F3EE13199041B8EF
+51 000102020405060708090A0B0C0D0E0F 876784940262E686F3EE13199041B8EF
+52 000102010405060708090A0B0C0D0E0F BEFCCE7E438B0A31F3EE13199041B8EF
+53 000102070405060708090A0B0C0D0E0F 249BE14E8C537EC6F3EE13199041B8EF
+54 0001020B0405060708090A0B0C0D0E0F C593B7EB96B434F9F3EE13199041B8EF
+55 000102130405060708090A0B0C0D0E0F A449CCE9CDD9937BF3EE13199041B8EF
+56 000102230405060708090A0B0C0D0E0F A83EF09EEACC3EF9F3EE13199041B8EF
+57 000102430405060708090A0B0C0D0E0F 5049ACD27CE7CC18F3EE13199041B8EF
+58 000102830405060708090A0B0C0D0E0F 22F90834F70AC2FDF3EE13199041B8EF
+59 000102030505060708090A0B0C0D0E0F 6C3C483C112BF4A5F3EE13199041B8EF
+60 000102030605060708090A0B0C0D0E0F B090ED887529E1C8F3EE13199041B8EF
+61 000102030005060708090A0B0C0D0E0F 2E926606B0294C9DF3EE13199041B8EF
+62 000102030C05060708090A0B0C0D0E0F AEEF4164A1CBA00DF3EE13199041B8EF
+63 000102031405060708090A0B0C0D0E0F C8C629BC2A2694B8F3EE13199041B8EF
+64 000102032405060708090A0B0C0D0E0F 8E07759B6844E0E9F3EE13199041B8EF
+65 000102034405060708090A0B0C0D0E0F 759D964D0C40CC1FF3EE13199041B8EF
+66 000102038405060708090A0B0C0D0E0F FD4090C4A77C4B72F3EE13199041B8EF
+67 000102030404060708090A0B0C0D0E0F F46AFCCCD96861CAF3EE13199041B8EF
+68 000102030407060708090A0B0C0D0E0F E9323C9D59A033E5F3EE13199041B8EF
+69 000102030401060708090A0B0C0D0E0F 598BD0DF5D9E7250F3EE13199041B8EF
+70 00010203040D060708090A0B0C0D0E0F 334E6948C674FA42F3EE13199041B8EF
+71 000102030415060708090A0B0C0D0E0F C9F599B0C58D1092F3EE13199041B8EF
+72 000102030425060708090A0B0C0D0E0F 2F482E0CEA3B8C9BF3EE13199041B8EF
+73 000102030445060708090A0B0C0D0E0F 638C609AEAFCC4BCF3EE13199041B8EF
+74 000102030485060708090A0B0C0D0E0F 92B400ED0B282E70F3EE13199041B8EF
+75 000102030405070708090A0B0C0D0E0F 1D5D0E33202104C4F3EE13199041B8EF
+76 000102030405040708090A0B0C0D0E0F FAE5E314891347B1F3EE13199041B8EF
+77 000102030405020708090A0B0C0D0E0F 5439E903E0ACADB9F3EE13199041B8EF
+78 0001020304050E0708090A0B0C0D0E0F 0CFAED9F09FA568EF3EE13199041B8EF
+79 000102030405160708090A0B0C0D0E0F 31AD575576D6BA77F3EE13199041B8EF
+80 000102030405260708090A0B0C0D0E0F D3AD6AF78B407CCDF3EE13199041B8EF
+81 000102030405460708090A0B0C0D0E0F 6A8D0B396A2A9FAEF3EE13199041B8EF
+82 000102030405860708090A0B0C0D0E0F C4E4173D22348AD4F3EE13199041B8EF
+83 000102030405060608090A0B0C0D0E0F 7B6AB5D4C1731566F3EE13199041B8EF
+84 000102030405060508090A0B0C0D0E0F E1AD86D595EE2004F3EE13199041B8EF
+85 000102030405060308090A0B0C0D0E0F B2E4C1BC21486D9AF3EE13199041B8EF
+86 000102030405060F08090A0B0C0D0E0F 5CC4B03FA98A98C3F3EE13199041B8EF
+87 000102030405061708090A0B0C0D0E0F A12FFD65E0D144DDF3EE13199041B8EF
+88 000102030405062708090A0B0C0D0E0F A640E50DB6B1F841F3EE13199041B8EF
+89 000102030405064708090A0B0C0D0E0F C6A07E62940EAFA8F3EE13199041B8EF
+90 000102030405068708090A0B0C0D0E0F 31C89B8122781DBCF3EE13199041B8EF
+91 000102030405060709090A0B0C0D0E0F 490621BA1F7A2F9AC716E3D7791FEE58
+92 000102030405060708080A0B0C0D0E0F 490621BA1F7A2F9A6E5E338E84F025B7
+93 000102030405060708090B0B0C0D0E0F 490621BA1F7A2F9A0F49DDCFAF30192A
+94 000102030405060708090A0A0C0D0E0F 490621BA1F7A2F9AAAA449BF0B87891F
+95 000102030405060708090A0B0D0D0E0F 490621BA1F7A2F9ADF98D6B3C074A265
+96 000102030405060708090A0B0C0C0E0F 490621BA1F7A2F9A1EA4227224DBB1E9
+97 000102030405060708090A0B0C0D0F0F 490621BA1F7A2F9AE8EFE545C1C86949
+98 000102030405060708090A0B0C0D0E0E 490621BA1F7A2F9A52705DB9168BFBCB
+99 3501026C15E723A90000000000000000 7356BEBF9EFA99D690DE09B472855817
+100 3501026C15E723A9FFFFFFFFFFFFFFFF 7356BEBF9EFA99D66A81040BF2294479
+101 B26233A118609E470000000000000000 795A7CFE96A7460590DE09B472855817
+102 B26233A118609E47FFFFFFFFFFFFFFFF 795A7CFE96A746056A81040BF2294479
+103 CD055494378D8C260000000000000000 0EA29507D5F9AF1390DE09B472855817
+104 CD055494378D8C26FFFFFFFFFFFFFFFF 0EA29507D5F9AF136A81040BF2294479
+105 0D66C35B5D0E17000000000000000000 B268C381A0D29AF590DE09B472855817
+106 0D66C35B5D0E1700FFFFFFFFFFFFFFFF B268C381A0D29AF56A81040BF2294479
+107 1D1EA39547625C8C0000000000000000 381F7A0F0C40D91490DE09B472855817
+108 1D1EA39547625C8CFFFFFFFFFFFFFFFF 381F7A0F0C40D9146A81040BF2294479
+109 CDDF89707ED28CA00000000000000000 2A9F66460C954E0F90DE09B472855817
+110 CDDF89707ED28CA0FFFFFFFFFFFFFFFF 2A9F66460C954E0F6A81040BF2294479
+111 30C654040AB964900000000000000000 4B96772686A6414490DE09B472855817
+112 30C654040AB96490FFFFFFFFFFFFFFFF 4B96772686A641446A81040BF2294479
+113 225412226117A6DB0000000000000000 94DFBB7B696FF68890DE09B472855817
+114 225412226117A6DBFFFFFFFFFFFFFFFF 94DFBB7B696FF6886A81040BF2294479
+115 0000000000000000748AADD2DC1FFDF2 90DE09B4728558174F042D404735FBC2
+116 FFFFFFFFFFFFFFFF748AADD2DC1FFDF2 6A81040BF22944794F042D404735FBC2
+117 00000000000000004AA500E87EDC64C4 90DE09B472855817F7BEA28401464AA9
+118 FFFFFFFFFFFFFFFF4AA500E87EDC64C4 6A81040BF2294479F7BEA28401464AA9
+119 00000000000000006B6A5FB00237CAD2 90DE09B472855817794F1F3EB90C3F7C
+120 FFFFFFFFFFFFFFFF6B6A5FB00237CAD2 6A81040BF2294479794F1F3EB90C3F7C
+121 00000000000000008C8FF951A25F1570 90DE09B472855817F867951521BD7C78
+122 FFFFFFFFFFFFFFFF8C8FF951A25F1570 6A81040BF2294479F867951521BD7C78
+123 0000000000000000EB8A6A6991B61FF5 90DE09B4728558170741BEF82537B2D2
+124 FFFFFFFFFFFFFFFFEB8A6A6991B61FF5 6A81040BF22944790741BEF82537B2D2
+125 00000000000000003A5EB345FFE4B82C 90DE09B472855817670D4E8E84E288A3
+126 FFFFFFFFFFFFFFFF3A5EB345FFE4B82C 6A81040BF2294479670D4E8E84E288A3
+127 00000000000000000D022175A50D18FC 90DE09B4728558170A2E1C9971E91D1B
+128 FFFFFFFFFFFFFFFF0D022175A50D18FC 6A81040BF22944790A2E1C9971E91D1B
+129 00000000000000004A8D5E79AEBDB5C8 90DE09B47285581759AD04B586354818
+130 FFFFFFFFFFFFFFFF4A8D5E79AEBDB5C8 6A81040BF229447959AD04B586354818
+131 8735CA449D06E48E92D9A690779E4F9A B6F66EF5F2A5CEDD30E1A1FB479AB692
+132 1A068AD8DC21DDE0230F2E171BDF6835 60CBAE07071171FAFE324AF662D56547
+133 939999E9CFEFB9A939E89B16CA161AB5 4BCB501A7C79B71F9E2D2DF7D0F9970A
+134 AD34B10C287FD20998FAA0AF457B4709 D4232710A53156107F0626F57F27107A
+135 47D34BA7B939955A047CF68D737A61EA A251C1CBDC69BE78D58EBBC1F3D245E1
+136 C3A2B00938D11FA1C92C641E712ACA34 5B660019C0379E8E87549E42DDD8DC91
+137 E00AD1AD276852A1A5F2DF2231952729 E5BCBAA614D6EAC3D2BAE6DFB65ADB39
+138 3AF2E6BABF44EC5C1A55F0BAA5FA9BDA 45D82CB113CBD25D673BC3E62822A3DA
+139 8A3B6D96439A3C3A00FE89B197F1C6D9 ADF093B70042B643DDE4A30B27D911D7
+140 00C5DE6DB0D87AC62982036BC9DCFC65 6288D3E03AE6F7E14ECA401C5BA5FD27
+141 3D69BAF6A6FB385684057EF71C02A84F DC44EC4BE6E8C4D8B7BA15FFC141C2C3
+142 DC771563DFAB03F5B61486F08D0420ED BB4BC8C0DA0F67F067F1E050CCCC4496
+143 72DBC7AE27D3F52777C23A5AAD142793 A08EAD92445C042EC35E0E35CCBF4D63
+144 E87423730BA482D37D2C5B81998A6E11 E27DBC03E384000E6856245C601C066C
+145 485CC3950CF9BBA76EA9A66114D74306 6CEB557795AF089EBA4E64DE032E7B0C
+146 EDDC3862D2B887A09387B95D22F28D16 9063E689A041631B5E4221F07C6C2547
+147 98D7DDA8C2C3D7A2CEF816D1C57DD25B 4B4DBF8AB4AEFD03A982AD51D10C36B4
+148 E59918D7F7440E10E34BB57226B23E3E CADE8C78EE6A226D1371950638D6E524
+149 795DD0F1748F2FCC6DA86E78E523A6DB 4D0AF9FDDE099932CCEAE634E6A6E4F2
+150 FF374E2BECD41DDFC34EF995BAD74103 53E283C3D30CA9B14B819686A25F04EF
+151 79B01497977C38E8CADFBAD60EB67E76 6B1D1EC7F7CA646D4D8D767DD61D9D70
+152 A65FC3F7D66DA24E73BBDACD9CE12C94 988849D83BE204C765C6B42BEB78DCDF
+153 A60B9669D2C984782CFA89992AE6A9D2 6657BFCA2E87A070AF6045DBEFCCF55F
+154 9CAC25C867B7E079DED45D428B2EFCF9 F39D44D3E059E4E01127F65B9FBB20B6
+155 4908BBB17763CE521276697474F8D19B 016964D9028D40780288FA31A2BD56F7
+156 A7BA8DEA495B0258C1E7782EA394C06A 1A13C5630A767779570AF70E38937996
+157 83F052520B2AD979727161DE54D9581C 7D242666DBE8B30EFE5E4830923218A0
+158 A08E2045B24736220446C0637C406AB2 AFC79C27120E812F3A767842CEC3F8F4
+159 490A2794E95FF3FAF368B3693D3FF730 5CB8795143440BF5481E9B7D3F2BECCC
+160 BBDE52C3FBE8CE87E330574E622A72C6 3C5AF926F6E820BA1ADDBC9449CE9AEB
+161 FEF29072DCAA31A29FEF6013F989BC3D 10C67B8B791D948F0F946CCF8E6C195E
+162 56201529BC79958577F97AB3D0633F0F 010A4F36BBC6229FF7538406754CDC9A
+163 F711DA57A41D0B5B846DB5E5C0EAD574 8582DCF8562B6E7F7E66F3354C21A503
+164 DD7B13E7479CB46208E84B6DCCF5D7DF 79F9A78684ADCD5BF1BFE7701C18CE01
+165 29563BA35966FDDD90AB8DF4F8D46F53 A9C1E15117EE664024EBB66BE44FDD3E
+166 6951DF1546B54E9A7902CB6D1F0CCFE8 31BD9E6914FF5D15229DB8AC1315ED84
+167 5F9BBBC7778BE7198BEE4284AC65FA5C E825EBCD5AB616A4C376755A70DD5D85
+168 4C5242B528B8D14A761C0989779B3E71 7131EC719F72A11319139DD9D9DCA7A5
+169 FA3CBBE6139D9465CF5EFC777D1EA6C5 ABE7686EED7024017E1FCAFAA6B87F74
+170 02E3AA2BE481A7B4195C3A6435EBEB58 2D11D2406B8E1F2D8029F710E0477610
+171 3ED28369F5ACEF0097BB500BDF8D1115 C6240578965F1A4FB77BF238BD903B39
+172 38CEDAA0D9D0FBA6829F37D697154869 4A8A4CC4E5F5F8F8809C5F96357942E8
+173 91145732A012B25CB686760EDFDBCEA2 D1410B2F2B76ECFA4B2EAFF0C3308013
+174 10591AFF4360AFF4EE77EF3D32DB9BF7 DF82591209484A8E43282118EB19E424
+175 393952F7A6DD08EC511E329F7F57C94E 81A173BF7CB18B44A8AC7214F662C513
+176 5BFE98265BFA6885E6CE29783DCDB264 7C514C2CC9B44C1F490844A9EEC42370
+177 DE3A6461E30E89F4C2CFC154D11CB171 7B5E780F51CE26A7A3CFD770C8007984
+178 F824D54A780F4FA96F6350D34E8BD760 858DA30DD7E423F22EF0076AE22D19CE
+179 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+180 000102030405060708090A0B0C0D0E0F 490621BA1F7A2F9AF3EE13199041B8EF
diff --git a/dwt/evidence/oracle/runB/stdout.log b/dwt/evidence/oracle/runB/stdout.log
new file mode 100644
index 0000000..ca9644f
--- /dev/null
+++ b/dwt/evidence/oracle/runB/stdout.log
@@ -0,0 +1,55 @@
+Warning: -video none doesn't make much sense without -seconds_to_run
+vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
+runB: loaded 180 vectors from /home/arti/code/k-space/vt1200/dwt/evidence/oracle/runB/in.txt
+vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
+vt1200: scanline#1 line=1 enabled=1
+vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
+vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
+vt1200: scanline#2 line=0 enabled=1
+vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
+vt1200: scanline#3 line=1 enabled=1
+vt1200: scanline#4 line=2 enabled=1
+runB: frame 3000 hijack pc=3F579970 sp=007F52B0 a14=007DDC90
+runB: init returned; @1C0200=007AB930 @1C0220=00000000 @1C0240=00000000 @1C0260=007AF970
+runB: expand returned; keyptr=007AF970 fontptr=00000000 renderptr=00000000
+runB: seed+000 55F861C7E51311D4C80000000000000000000000000000000000000000000000
+runB: seed+020 0000000000003A322A221A120A023C342C241C140C043E362E261E160E064038
+runB: seed+040 30282018100839312921191109013B332B231B130B033D352D251D150D053F37
+runB: seed+060 2F271F170F07280830103818402027072F0F37173F1F26062E0E36163E1E2505
+runB: key+000 2C3E1F020130080D2D23281F080019120B333920171A00063227333C09041308
+runB: key+020 370E1D18020B0107112D3C2B292C12203A3B250702003D030A1E3B0B272C0010
+runB: key+040 3B110B1C2010212E052D2B2C11092A10262725320410113D2B063D2D02392200
+runB: key+060 30371C0D0006143512193F310A302204351F232B3004061323082E3E2D1A2400
+runB: aux+000 39312921191109013A322A221A120A023B332B231B130B033C342C243F372F27
+runB: aux+020 1F170F073E362E261E160E063D352D251D150D051C140C0401020406080A0C0E
+runB: aux+040 0F11131517191B1C0E110B180105031C0F06150A17130C041A0810071B140D02
+runB: aux+060 29341F252F371E28332D21302C31273822352E2A32241D200E040D01020F0B08
+runB: aux+080 030A060C05090007000F07040E020D010A060C0B0905030804010E080D06020B
+runB: aux+0A0 0F0C0907030A05000F0C080204090107050B030E0A00060D0F01080E060B0304
+runB: aux+0C0 0907020D0C00050A030D04070F02080E0C00010A06090B05000E070B0A040D01
+runB: aux+0E0 05080C060903020F0D080A01030F04020B06070C00050E090A00090E06030F05
+runB: aux+100 010D0C070B0402080D0700090304060A0208050E0C0B0F010D060409080F0300
+runB: aux+120 0B01020C050A0E07010A0D0006090807040F0E030B05020C070D0E030006090A
+runB: aux+140 010208050B0C040F0D080B05060F00030407020C010A0E090A0609000C0B070D
+runB: aux+160 0F01030E05020804030F00060A010D080904050B0C07020E020C0401070A0B06
+runB: aux+180 0805030F0D000E090E0B020C04070D0105000F0A030908060402010B0A0D0708
+runB: aux+1A0 0F090C050603000E0B080C07010E020D060F00090A0405030C010A0F09020608
+runB: aux+1C0 000D03040E07050B0A0F0402070C090506010D0E000B0308090E0F0502080C03
+runB: aux+1E0 0700040A010D0B060403020C09050F0A0B0E01070600080D040B020E0F00080D
+runB: aux+200 030C0907050A06010D000B070409010A0E03050C020F080601040B0D0C03070E
+runB: aux+220 0A0F060800050902060B0D0801040A070905000F0E02030C0D020804060F0B01
+runB: aux+240 0A09030E05000C07010F0D080A0307040C05060B000E0902070B0401090C0E02
+runB: aux+260 00060A0D0F03050802010E07040A080D0F0C09000305060B100714151D0C1C11
+runB: aux+280 010F171A05121F0A0208180E201B0309130D1E06160B041930B97A0000000000
+runB: aux+2A0 0000000070F97A00800000004000000020000000100000000800000004000000
+runB: 24/180 vectors
+runB: 49/180 vectors
+runB: 74/180 vectors
+runB: 99/180 vectors
+runB: 124/180 vectors
+runB: 149/180 vectors
+runB: 174/180 vectors
+runB: 180/180 vectors
+runB: free returned; exiting
+runB: done (free_run), rc=0
+Average speed: 363.73% (41 seconds)
diff --git a/dwt/evidence/oracle/runC_frame2500/debug.log b/dwt/evidence/oracle/runC_frame2500/debug.log
new file mode 100644
index 0000000..4b005fe
--- /dev/null
+++ b/dwt/evidence/oracle/runC_frame2500/debug.log
@@ -0,0 +1,920 @@
+MAME debugger version 0.289 (mame0289-dirty)
+Currently targeting vt1200 (VT1200 X terminal (v2.2 firmware))
+>bclear
+ ^
+unknown command
+Breakpoint 1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 10 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 11 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 12 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 13 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 14 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 15 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 16 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 17 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 18 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 19 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 20 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 21 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 22 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 23 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 24 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 25 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 26 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 27 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 28 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 29 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 30 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 31 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 32 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 33 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 34 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 35 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 36 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 37 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 38 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 39 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 40 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 41 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 42 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 43 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 44 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 45 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 46 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 47 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 48 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 49 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 4F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 50 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 51 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 52 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 53 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 54 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 55 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 56 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 57 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 58 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 59 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 5F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 60 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 61 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 62 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 63 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 64 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 65 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 66 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 67 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 68 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 69 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 6F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 70 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 71 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 72 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 73 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 74 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 75 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 76 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 77 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 78 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 79 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 7F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 80 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 81 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 82 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 83 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 84 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 85 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 86 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 87 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 88 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 89 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 8F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 90 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 91 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 92 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 93 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 94 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 95 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 96 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 97 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 98 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 99 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9B set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9C set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9D set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9F set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A0 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint A9 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AA set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AB set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AC set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AD set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AE set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint AF set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B0 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B3 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B4 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B5 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B6 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint B7 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
diff --git a/dwt/evidence/oracle/runC_frame2500/in.txt b/dwt/evidence/oracle/runC_frame2500/in.txt
new file mode 100644
index 0000000..17052e0
--- /dev/null
+++ b/dwt/evidence/oracle/runC_frame2500/in.txt
@@ -0,0 +1,180 @@
+00000000000000000000000000000000
+ffffffffffffffffffffffffffffffff
+000102030405060708090a0b0c0d0e0f
+0f0e0d0c0b0a09080706050403020100
+aa55aa55aa55aa55aa55aa55aa55aa55
+55aa55aa55aa55aa55aa55aa55aa55aa
+0000000000000000ffffffffffffffff
+ffffffffffffffff0000000000000000
+80000000000000000000000000000000
+00000000000000008000000000000000
+7f000000000000000000000000000000
+00000000000000000100000000000000
+00112233445566770011223344556677
+f32cec8d0000ead00263a8c0f324ec8e
+8dec2cf3d0ea0000c0a863028eec24f3
+00000000000000000000000000000000
+00000001000000000000000000000000
+00000002000000000000000000000000
+00000003000000000000000000000000
+00000010000000000000000000000000
+00000020000000000000000000000000
+00000030000000000000000000000000
+00000080000000000000000000000000
+000000ff000000000000000000000000
+00000100000000000000000000000000
+00000000010000000000000000000000
+010102030405060708090a0b0c0d0e0f
+020102030405060708090a0b0c0d0e0f
+040102030405060708090a0b0c0d0e0f
+080102030405060708090a0b0c0d0e0f
+100102030405060708090a0b0c0d0e0f
+200102030405060708090a0b0c0d0e0f
+400102030405060708090a0b0c0d0e0f
+800102030405060708090a0b0c0d0e0f
+000002030405060708090a0b0c0d0e0f
+000302030405060708090a0b0c0d0e0f
+000502030405060708090a0b0c0d0e0f
+000902030405060708090a0b0c0d0e0f
+001102030405060708090a0b0c0d0e0f
+002102030405060708090a0b0c0d0e0f
+004102030405060708090a0b0c0d0e0f
+008102030405060708090a0b0c0d0e0f
+000103030405060708090a0b0c0d0e0f
+000100030405060708090a0b0c0d0e0f
+000106030405060708090a0b0c0d0e0f
+00010a030405060708090a0b0c0d0e0f
+000112030405060708090a0b0c0d0e0f
+000122030405060708090a0b0c0d0e0f
+000142030405060708090a0b0c0d0e0f
+000182030405060708090a0b0c0d0e0f
+000102020405060708090a0b0c0d0e0f
+000102010405060708090a0b0c0d0e0f
+000102070405060708090a0b0c0d0e0f
+0001020b0405060708090a0b0c0d0e0f
+000102130405060708090a0b0c0d0e0f
+000102230405060708090a0b0c0d0e0f
+000102430405060708090a0b0c0d0e0f
+000102830405060708090a0b0c0d0e0f
+000102030505060708090a0b0c0d0e0f
+000102030605060708090a0b0c0d0e0f
+000102030005060708090a0b0c0d0e0f
+000102030c05060708090a0b0c0d0e0f
+000102031405060708090a0b0c0d0e0f
+000102032405060708090a0b0c0d0e0f
+000102034405060708090a0b0c0d0e0f
+000102038405060708090a0b0c0d0e0f
+000102030404060708090a0b0c0d0e0f
+000102030407060708090a0b0c0d0e0f
+000102030401060708090a0b0c0d0e0f
+00010203040d060708090a0b0c0d0e0f
+000102030415060708090a0b0c0d0e0f
+000102030425060708090a0b0c0d0e0f
+000102030445060708090a0b0c0d0e0f
+000102030485060708090a0b0c0d0e0f
+000102030405070708090a0b0c0d0e0f
+000102030405040708090a0b0c0d0e0f
+000102030405020708090a0b0c0d0e0f
+0001020304050e0708090a0b0c0d0e0f
+000102030405160708090a0b0c0d0e0f
+000102030405260708090a0b0c0d0e0f
+000102030405460708090a0b0c0d0e0f
+000102030405860708090a0b0c0d0e0f
+000102030405060608090a0b0c0d0e0f
+000102030405060508090a0b0c0d0e0f
+000102030405060308090a0b0c0d0e0f
+000102030405060f08090a0b0c0d0e0f
+000102030405061708090a0b0c0d0e0f
+000102030405062708090a0b0c0d0e0f
+000102030405064708090a0b0c0d0e0f
+000102030405068708090a0b0c0d0e0f
+000102030405060709090a0b0c0d0e0f
+000102030405060708080a0b0c0d0e0f
+000102030405060708090b0b0c0d0e0f
+000102030405060708090a0a0c0d0e0f
+000102030405060708090a0b0d0d0e0f
+000102030405060708090a0b0c0c0e0f
+000102030405060708090a0b0c0d0f0f
+000102030405060708090a0b0c0d0e0e
+3501026c15e723a90000000000000000
+3501026c15e723a9ffffffffffffffff
+b26233a118609e470000000000000000
+b26233a118609e47ffffffffffffffff
+cd055494378d8c260000000000000000
+cd055494378d8c26ffffffffffffffff
+0d66c35b5d0e17000000000000000000
+0d66c35b5d0e1700ffffffffffffffff
+1d1ea39547625c8c0000000000000000
+1d1ea39547625c8cffffffffffffffff
+cddf89707ed28ca00000000000000000
+cddf89707ed28ca0ffffffffffffffff
+30c654040ab964900000000000000000
+30c654040ab96490ffffffffffffffff
+225412226117a6db0000000000000000
+225412226117a6dbffffffffffffffff
+0000000000000000748aadd2dc1ffdf2
+ffffffffffffffff748aadd2dc1ffdf2
+00000000000000004aa500e87edc64c4
+ffffffffffffffff4aa500e87edc64c4
+00000000000000006b6a5fb00237cad2
+ffffffffffffffff6b6a5fb00237cad2
+00000000000000008c8ff951a25f1570
+ffffffffffffffff8c8ff951a25f1570
+0000000000000000eb8a6a6991b61ff5
+ffffffffffffffffeb8a6a6991b61ff5
+00000000000000003a5eb345ffe4b82c
+ffffffffffffffff3a5eb345ffe4b82c
+00000000000000000d022175a50d18fc
+ffffffffffffffff0d022175a50d18fc
+00000000000000004a8d5e79aebdb5c8
+ffffffffffffffff4a8d5e79aebdb5c8
+8735ca449d06e48e92d9a690779e4f9a
+1a068ad8dc21dde0230f2e171bdf6835
+939999e9cfefb9a939e89b16ca161ab5
+ad34b10c287fd20998faa0af457b4709
+47d34ba7b939955a047cf68d737a61ea
+c3a2b00938d11fa1c92c641e712aca34
+e00ad1ad276852a1a5f2df2231952729
+3af2e6babf44ec5c1a55f0baa5fa9bda
+8a3b6d96439a3c3a00fe89b197f1c6d9
+00c5de6db0d87ac62982036bc9dcfc65
+3d69baf6a6fb385684057ef71c02a84f
+dc771563dfab03f5b61486f08d0420ed
+72dbc7ae27d3f52777c23a5aad142793
+e87423730ba482d37d2c5b81998a6e11
+485cc3950cf9bba76ea9a66114d74306
+eddc3862d2b887a09387b95d22f28d16
+98d7dda8c2c3d7a2cef816d1c57dd25b
+e59918d7f7440e10e34bb57226b23e3e
+795dd0f1748f2fcc6da86e78e523a6db
+ff374e2becd41ddfc34ef995bad74103
+79b01497977c38e8cadfbad60eb67e76
+a65fc3f7d66da24e73bbdacd9ce12c94
+a60b9669d2c984782cfa89992ae6a9d2
+9cac25c867b7e079ded45d428b2efcf9
+4908bbb17763ce521276697474f8d19b
+a7ba8dea495b0258c1e7782ea394c06a
+83f052520b2ad979727161de54d9581c
+a08e2045b24736220446c0637c406ab2
+490a2794e95ff3faf368b3693d3ff730
+bbde52c3fbe8ce87e330574e622a72c6
+fef29072dcaa31a29fef6013f989bc3d
+56201529bc79958577f97ab3d0633f0f
+f711da57a41d0b5b846db5e5c0ead574
+dd7b13e7479cb46208e84b6dccf5d7df
+29563ba35966fddd90ab8df4f8d46f53
+6951df1546b54e9a7902cb6d1f0ccfe8
+5f9bbbc7778be7198bee4284ac65fa5c
+4c5242b528b8d14a761c0989779b3e71
+fa3cbbe6139d9465cf5efc777d1ea6c5
+02e3aa2be481a7b4195c3a6435ebeb58
+3ed28369f5acef0097bb500bdf8d1115
+38cedaa0d9d0fba6829f37d697154869
+91145732a012b25cb686760edfdbcea2
+10591aff4360aff4ee77ef3d32db9bf7
+393952f7a6dd08ec511e329f7f57c94e
+5bfe98265bfa6885e6ce29783dcdb264
+de3a6461e30e89f4c2cfc154d11cb171
+f824d54a780f4fa96f6350d34e8bd760
+00000000000000000000000000000000
+000102030405060708090a0b0c0d0e0f
diff --git a/dwt/evidence/oracle/runC_frame2500/nvram/vt1200/nvram b/dwt/evidence/oracle/runC_frame2500/nvram/vt1200/nvram
new file mode 100644
index 0000000..08e7df1
Binary files /dev/null and b/dwt/evidence/oracle/runC_frame2500/nvram/vt1200/nvram differ
diff --git a/dwt/evidence/oracle/runC_frame2500/out.txt b/dwt/evidence/oracle/runC_frame2500/out.txt
new file mode 100644
index 0000000..6b5b765
--- /dev/null
+++ b/dwt/evidence/oracle/runC_frame2500/out.txt
@@ -0,0 +1,180 @@
+1 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+2 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 6A81040BF22944796A81040BF2294479
+3 000102030405060708090A0B0C0D0E0F 490621BA1F7A2F9AF3EE13199041B8EF
+4 0F0E0D0C0B0A09080706050403020100 47340C29C8B7BD41B8D97E1542ED3C35
+5 AA55AA55AA55AA55AA55AA55AA55AA55 BFF91EB2093E0FF1BFF91EB2093E0FF1
+6 55AA55AA55AA55AA55AA55AA55AA55AA 6A5628027555C59B6A5628027555C59B
+7 0000000000000000FFFFFFFFFFFFFFFF 90DE09B4728558176A81040BF2294479
+8 FFFFFFFFFFFFFFFF0000000000000000 6A81040BF229447990DE09B472855817
+9 80000000000000000000000000000000 C12005491321E97590DE09B472855817
+10 00000000000000008000000000000000 90DE09B472855817C12005491321E975
+11 7F000000000000000000000000000000 0A24C5C7784A080F90DE09B472855817
+12 00000000000000000100000000000000 90DE09B47285581705C18845D2682FBA
+13 00112233445566770011223344556677 DF11BB36BA20F348DF11BB36BA20F348
+14 F32CEC8D0000EAD00263A8C0F324EC8E 5D02BB9C37D40A5BE4F2363831815699
+15 8DEC2CF3D0EA0000C0A863028EEC24F3 BDB2D3E0FC00DB5FE31ECBD30F1E1B93
+16 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+17 00000001000000000000000000000000 B1975FF1D78D032A90DE09B472855817
+18 00000002000000000000000000000000 5865800E5D8C3C5590DE09B472855817
+19 00000003000000000000000000000000 EE590DF03C2BDBDD90DE09B472855817
+20 00000010000000000000000000000000 0B9AB22E400A068F90DE09B472855817
+21 00000020000000000000000000000000 362CF798EC8AE91890DE09B472855817
+22 00000030000000000000000000000000 9ECAE2E539A1635790DE09B472855817
+23 00000080000000000000000000000000 57D8297C38F7783B90DE09B472855817
+24 000000FF000000000000000000000000 FC00338C744B2D1B90DE09B472855817
+25 00000100000000000000000000000000 21105DAED5E13EC590DE09B472855817
+26 00000000010000000000000000000000 46BA798D00E10CDB90DE09B472855817
+27 010102030405060708090A0B0C0D0E0F 92BC012D93A116AEF3EE13199041B8EF
+28 020102030405060708090A0B0C0D0E0F 164015F196B01410F3EE13199041B8EF
+29 040102030405060708090A0B0C0D0E0F ABBD32F93542E6DFF3EE13199041B8EF
+30 080102030405060708090A0B0C0D0E0F 56DC26E290E8BE41F3EE13199041B8EF
+31 100102030405060708090A0B0C0D0E0F 301E846CBD602214F3EE13199041B8EF
+32 200102030405060708090A0B0C0D0E0F D30C1CC792BB30C9F3EE13199041B8EF
+33 400102030405060708090A0B0C0D0E0F FFC252AD921795ABF3EE13199041B8EF
+34 800102030405060708090A0B0C0D0E0F CFB469B1A5881636F3EE13199041B8EF
+35 000002030405060708090A0B0C0D0E0F AC8C291D71256BFBF3EE13199041B8EF
+36 000302030405060708090A0B0C0D0E0F 5CE92F90A6D5D14AF3EE13199041B8EF
+37 000502030405060708090A0B0C0D0E0F 22ACB5CAB75350ACF3EE13199041B8EF
+38 000902030405060708090A0B0C0D0E0F 68A54DDEE96445F3F3EE13199041B8EF
+39 001102030405060708090A0B0C0D0E0F 02346AA75DC726AFF3EE13199041B8EF
+40 002102030405060708090A0B0C0D0E0F DADD787249314ABAF3EE13199041B8EF
+41 004102030405060708090A0B0C0D0E0F 2B9C5C6FFC3A1F9EF3EE13199041B8EF
+42 008102030405060708090A0B0C0D0E0F F4E3474ACF62420CF3EE13199041B8EF
+43 000103030405060708090A0B0C0D0E0F EF72B6CC68559E6AF3EE13199041B8EF
+44 000100030405060708090A0B0C0D0E0F E4FDF0DD779B07ABF3EE13199041B8EF
+45 000106030405060708090A0B0C0D0E0F 4FFEB9CCE4068E81F3EE13199041B8EF
+46 00010A030405060708090A0B0C0D0E0F 9947C7DFF3D05245F3EE13199041B8EF
+47 000112030405060708090A0B0C0D0E0F 1FDF4A0763B9F83BF3EE13199041B8EF
+48 000122030405060708090A0B0C0D0E0F 932DC9C97C441E66F3EE13199041B8EF
+49 000142030405060708090A0B0C0D0E0F 18BA761EF97D5766F3EE13199041B8EF
+50 000182030405060708090A0B0C0D0E0F 86BBB870A3D2D245F3EE13199041B8EF
+51 000102020405060708090A0B0C0D0E0F 876784940262E686F3EE13199041B8EF
+52 000102010405060708090A0B0C0D0E0F BEFCCE7E438B0A31F3EE13199041B8EF
+53 000102070405060708090A0B0C0D0E0F 249BE14E8C537EC6F3EE13199041B8EF
+54 0001020B0405060708090A0B0C0D0E0F C593B7EB96B434F9F3EE13199041B8EF
+55 000102130405060708090A0B0C0D0E0F A449CCE9CDD9937BF3EE13199041B8EF
+56 000102230405060708090A0B0C0D0E0F A83EF09EEACC3EF9F3EE13199041B8EF
+57 000102430405060708090A0B0C0D0E0F 5049ACD27CE7CC18F3EE13199041B8EF
+58 000102830405060708090A0B0C0D0E0F 22F90834F70AC2FDF3EE13199041B8EF
+59 000102030505060708090A0B0C0D0E0F 6C3C483C112BF4A5F3EE13199041B8EF
+60 000102030605060708090A0B0C0D0E0F B090ED887529E1C8F3EE13199041B8EF
+61 000102030005060708090A0B0C0D0E0F 2E926606B0294C9DF3EE13199041B8EF
+62 000102030C05060708090A0B0C0D0E0F AEEF4164A1CBA00DF3EE13199041B8EF
+63 000102031405060708090A0B0C0D0E0F C8C629BC2A2694B8F3EE13199041B8EF
+64 000102032405060708090A0B0C0D0E0F 8E07759B6844E0E9F3EE13199041B8EF
+65 000102034405060708090A0B0C0D0E0F 759D964D0C40CC1FF3EE13199041B8EF
+66 000102038405060708090A0B0C0D0E0F FD4090C4A77C4B72F3EE13199041B8EF
+67 000102030404060708090A0B0C0D0E0F F46AFCCCD96861CAF3EE13199041B8EF
+68 000102030407060708090A0B0C0D0E0F E9323C9D59A033E5F3EE13199041B8EF
+69 000102030401060708090A0B0C0D0E0F 598BD0DF5D9E7250F3EE13199041B8EF
+70 00010203040D060708090A0B0C0D0E0F 334E6948C674FA42F3EE13199041B8EF
+71 000102030415060708090A0B0C0D0E0F C9F599B0C58D1092F3EE13199041B8EF
+72 000102030425060708090A0B0C0D0E0F 2F482E0CEA3B8C9BF3EE13199041B8EF
+73 000102030445060708090A0B0C0D0E0F 638C609AEAFCC4BCF3EE13199041B8EF
+74 000102030485060708090A0B0C0D0E0F 92B400ED0B282E70F3EE13199041B8EF
+75 000102030405070708090A0B0C0D0E0F 1D5D0E33202104C4F3EE13199041B8EF
+76 000102030405040708090A0B0C0D0E0F FAE5E314891347B1F3EE13199041B8EF
+77 000102030405020708090A0B0C0D0E0F 5439E903E0ACADB9F3EE13199041B8EF
+78 0001020304050E0708090A0B0C0D0E0F 0CFAED9F09FA568EF3EE13199041B8EF
+79 000102030405160708090A0B0C0D0E0F 31AD575576D6BA77F3EE13199041B8EF
+80 000102030405260708090A0B0C0D0E0F D3AD6AF78B407CCDF3EE13199041B8EF
+81 000102030405460708090A0B0C0D0E0F 6A8D0B396A2A9FAEF3EE13199041B8EF
+82 000102030405860708090A0B0C0D0E0F C4E4173D22348AD4F3EE13199041B8EF
+83 000102030405060608090A0B0C0D0E0F 7B6AB5D4C1731566F3EE13199041B8EF
+84 000102030405060508090A0B0C0D0E0F E1AD86D595EE2004F3EE13199041B8EF
+85 000102030405060308090A0B0C0D0E0F B2E4C1BC21486D9AF3EE13199041B8EF
+86 000102030405060F08090A0B0C0D0E0F 5CC4B03FA98A98C3F3EE13199041B8EF
+87 000102030405061708090A0B0C0D0E0F A12FFD65E0D144DDF3EE13199041B8EF
+88 000102030405062708090A0B0C0D0E0F A640E50DB6B1F841F3EE13199041B8EF
+89 000102030405064708090A0B0C0D0E0F C6A07E62940EAFA8F3EE13199041B8EF
+90 000102030405068708090A0B0C0D0E0F 31C89B8122781DBCF3EE13199041B8EF
+91 000102030405060709090A0B0C0D0E0F 490621BA1F7A2F9AC716E3D7791FEE58
+92 000102030405060708080A0B0C0D0E0F 490621BA1F7A2F9A6E5E338E84F025B7
+93 000102030405060708090B0B0C0D0E0F 490621BA1F7A2F9A0F49DDCFAF30192A
+94 000102030405060708090A0A0C0D0E0F 490621BA1F7A2F9AAAA449BF0B87891F
+95 000102030405060708090A0B0D0D0E0F 490621BA1F7A2F9ADF98D6B3C074A265
+96 000102030405060708090A0B0C0C0E0F 490621BA1F7A2F9A1EA4227224DBB1E9
+97 000102030405060708090A0B0C0D0F0F 490621BA1F7A2F9AE8EFE545C1C86949
+98 000102030405060708090A0B0C0D0E0E 490621BA1F7A2F9A52705DB9168BFBCB
+99 3501026C15E723A90000000000000000 7356BEBF9EFA99D690DE09B472855817
+100 3501026C15E723A9FFFFFFFFFFFFFFFF 7356BEBF9EFA99D66A81040BF2294479
+101 B26233A118609E470000000000000000 795A7CFE96A7460590DE09B472855817
+102 B26233A118609E47FFFFFFFFFFFFFFFF 795A7CFE96A746056A81040BF2294479
+103 CD055494378D8C260000000000000000 0EA29507D5F9AF1390DE09B472855817
+104 CD055494378D8C26FFFFFFFFFFFFFFFF 0EA29507D5F9AF136A81040BF2294479
+105 0D66C35B5D0E17000000000000000000 B268C381A0D29AF590DE09B472855817
+106 0D66C35B5D0E1700FFFFFFFFFFFFFFFF B268C381A0D29AF56A81040BF2294479
+107 1D1EA39547625C8C0000000000000000 381F7A0F0C40D91490DE09B472855817
+108 1D1EA39547625C8CFFFFFFFFFFFFFFFF 381F7A0F0C40D9146A81040BF2294479
+109 CDDF89707ED28CA00000000000000000 2A9F66460C954E0F90DE09B472855817
+110 CDDF89707ED28CA0FFFFFFFFFFFFFFFF 2A9F66460C954E0F6A81040BF2294479
+111 30C654040AB964900000000000000000 4B96772686A6414490DE09B472855817
+112 30C654040AB96490FFFFFFFFFFFFFFFF 4B96772686A641446A81040BF2294479
+113 225412226117A6DB0000000000000000 94DFBB7B696FF68890DE09B472855817
+114 225412226117A6DBFFFFFFFFFFFFFFFF 94DFBB7B696FF6886A81040BF2294479
+115 0000000000000000748AADD2DC1FFDF2 90DE09B4728558174F042D404735FBC2
+116 FFFFFFFFFFFFFFFF748AADD2DC1FFDF2 6A81040BF22944794F042D404735FBC2
+117 00000000000000004AA500E87EDC64C4 90DE09B472855817F7BEA28401464AA9
+118 FFFFFFFFFFFFFFFF4AA500E87EDC64C4 6A81040BF2294479F7BEA28401464AA9
+119 00000000000000006B6A5FB00237CAD2 90DE09B472855817794F1F3EB90C3F7C
+120 FFFFFFFFFFFFFFFF6B6A5FB00237CAD2 6A81040BF2294479794F1F3EB90C3F7C
+121 00000000000000008C8FF951A25F1570 90DE09B472855817F867951521BD7C78
+122 FFFFFFFFFFFFFFFF8C8FF951A25F1570 6A81040BF2294479F867951521BD7C78
+123 0000000000000000EB8A6A6991B61FF5 90DE09B4728558170741BEF82537B2D2
+124 FFFFFFFFFFFFFFFFEB8A6A6991B61FF5 6A81040BF22944790741BEF82537B2D2
+125 00000000000000003A5EB345FFE4B82C 90DE09B472855817670D4E8E84E288A3
+126 FFFFFFFFFFFFFFFF3A5EB345FFE4B82C 6A81040BF2294479670D4E8E84E288A3
+127 00000000000000000D022175A50D18FC 90DE09B4728558170A2E1C9971E91D1B
+128 FFFFFFFFFFFFFFFF0D022175A50D18FC 6A81040BF22944790A2E1C9971E91D1B
+129 00000000000000004A8D5E79AEBDB5C8 90DE09B47285581759AD04B586354818
+130 FFFFFFFFFFFFFFFF4A8D5E79AEBDB5C8 6A81040BF229447959AD04B586354818
+131 8735CA449D06E48E92D9A690779E4F9A B6F66EF5F2A5CEDD30E1A1FB479AB692
+132 1A068AD8DC21DDE0230F2E171BDF6835 60CBAE07071171FAFE324AF662D56547
+133 939999E9CFEFB9A939E89B16CA161AB5 4BCB501A7C79B71F9E2D2DF7D0F9970A
+134 AD34B10C287FD20998FAA0AF457B4709 D4232710A53156107F0626F57F27107A
+135 47D34BA7B939955A047CF68D737A61EA A251C1CBDC69BE78D58EBBC1F3D245E1
+136 C3A2B00938D11FA1C92C641E712ACA34 5B660019C0379E8E87549E42DDD8DC91
+137 E00AD1AD276852A1A5F2DF2231952729 E5BCBAA614D6EAC3D2BAE6DFB65ADB39
+138 3AF2E6BABF44EC5C1A55F0BAA5FA9BDA 45D82CB113CBD25D673BC3E62822A3DA
+139 8A3B6D96439A3C3A00FE89B197F1C6D9 ADF093B70042B643DDE4A30B27D911D7
+140 00C5DE6DB0D87AC62982036BC9DCFC65 6288D3E03AE6F7E14ECA401C5BA5FD27
+141 3D69BAF6A6FB385684057EF71C02A84F DC44EC4BE6E8C4D8B7BA15FFC141C2C3
+142 DC771563DFAB03F5B61486F08D0420ED BB4BC8C0DA0F67F067F1E050CCCC4496
+143 72DBC7AE27D3F52777C23A5AAD142793 A08EAD92445C042EC35E0E35CCBF4D63
+144 E87423730BA482D37D2C5B81998A6E11 E27DBC03E384000E6856245C601C066C
+145 485CC3950CF9BBA76EA9A66114D74306 6CEB557795AF089EBA4E64DE032E7B0C
+146 EDDC3862D2B887A09387B95D22F28D16 9063E689A041631B5E4221F07C6C2547
+147 98D7DDA8C2C3D7A2CEF816D1C57DD25B 4B4DBF8AB4AEFD03A982AD51D10C36B4
+148 E59918D7F7440E10E34BB57226B23E3E CADE8C78EE6A226D1371950638D6E524
+149 795DD0F1748F2FCC6DA86E78E523A6DB 4D0AF9FDDE099932CCEAE634E6A6E4F2
+150 FF374E2BECD41DDFC34EF995BAD74103 53E283C3D30CA9B14B819686A25F04EF
+151 79B01497977C38E8CADFBAD60EB67E76 6B1D1EC7F7CA646D4D8D767DD61D9D70
+152 A65FC3F7D66DA24E73BBDACD9CE12C94 988849D83BE204C765C6B42BEB78DCDF
+153 A60B9669D2C984782CFA89992AE6A9D2 6657BFCA2E87A070AF6045DBEFCCF55F
+154 9CAC25C867B7E079DED45D428B2EFCF9 F39D44D3E059E4E01127F65B9FBB20B6
+155 4908BBB17763CE521276697474F8D19B 016964D9028D40780288FA31A2BD56F7
+156 A7BA8DEA495B0258C1E7782EA394C06A 1A13C5630A767779570AF70E38937996
+157 83F052520B2AD979727161DE54D9581C 7D242666DBE8B30EFE5E4830923218A0
+158 A08E2045B24736220446C0637C406AB2 AFC79C27120E812F3A767842CEC3F8F4
+159 490A2794E95FF3FAF368B3693D3FF730 5CB8795143440BF5481E9B7D3F2BECCC
+160 BBDE52C3FBE8CE87E330574E622A72C6 3C5AF926F6E820BA1ADDBC9449CE9AEB
+161 FEF29072DCAA31A29FEF6013F989BC3D 10C67B8B791D948F0F946CCF8E6C195E
+162 56201529BC79958577F97AB3D0633F0F 010A4F36BBC6229FF7538406754CDC9A
+163 F711DA57A41D0B5B846DB5E5C0EAD574 8582DCF8562B6E7F7E66F3354C21A503
+164 DD7B13E7479CB46208E84B6DCCF5D7DF 79F9A78684ADCD5BF1BFE7701C18CE01
+165 29563BA35966FDDD90AB8DF4F8D46F53 A9C1E15117EE664024EBB66BE44FDD3E
+166 6951DF1546B54E9A7902CB6D1F0CCFE8 31BD9E6914FF5D15229DB8AC1315ED84
+167 5F9BBBC7778BE7198BEE4284AC65FA5C E825EBCD5AB616A4C376755A70DD5D85
+168 4C5242B528B8D14A761C0989779B3E71 7131EC719F72A11319139DD9D9DCA7A5
+169 FA3CBBE6139D9465CF5EFC777D1EA6C5 ABE7686EED7024017E1FCAFAA6B87F74
+170 02E3AA2BE481A7B4195C3A6435EBEB58 2D11D2406B8E1F2D8029F710E0477610
+171 3ED28369F5ACEF0097BB500BDF8D1115 C6240578965F1A4FB77BF238BD903B39
+172 38CEDAA0D9D0FBA6829F37D697154869 4A8A4CC4E5F5F8F8809C5F96357942E8
+173 91145732A012B25CB686760EDFDBCEA2 D1410B2F2B76ECFA4B2EAFF0C3308013
+174 10591AFF4360AFF4EE77EF3D32DB9BF7 DF82591209484A8E43282118EB19E424
+175 393952F7A6DD08EC511E329F7F57C94E 81A173BF7CB18B44A8AC7214F662C513
+176 5BFE98265BFA6885E6CE29783DCDB264 7C514C2CC9B44C1F490844A9EEC42370
+177 DE3A6461E30E89F4C2CFC154D11CB171 7B5E780F51CE26A7A3CFD770C8007984
+178 F824D54A780F4FA96F6350D34E8BD760 858DA30DD7E423F22EF0076AE22D19CE
+179 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
+180 000102030405060708090A0B0C0D0E0F 490621BA1F7A2F9AF3EE13199041B8EF
diff --git a/dwt/evidence/oracle/runC_frame2500/stdout.log b/dwt/evidence/oracle/runC_frame2500/stdout.log
new file mode 100644
index 0000000..2dc5f06
--- /dev/null
+++ b/dwt/evidence/oracle/runC_frame2500/stdout.log
@@ -0,0 +1,27 @@
+Warning: -video none doesn't make much sense without -seconds_to_run
+vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
+runC: loaded 180 vectors from /home/arti/code/k-space/vt1200/dwt/evidence/oracle/runC_frame2500/in.txt
+vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
+vt1200: scanline#1 line=1 enabled=1
+vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
+vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
+vt1200: scanline#2 line=0 enabled=1
+vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
+vt1200: scanline#3 line=1 enabled=1
+vt1200: scanline#4 line=2 enabled=1
+runC: frame 2500 hijack pc=3F579970 sp=007F52B0 a14=007DDC90
+runC: init returned; @1C0200=0090C8D0 @1C0220=00000000 @1C0240=00000000 @1C0260=00910910
+runC: expand returned; keyptr=00910910 fontptr=00000000 renderptr=00000000
+runC: seed[0:32]=55F861C7E51311D4C80000000000000000000000000000000000000000000000
+runC: key[0:32]=2C3E1F020130080D2D23281F080019120B333920171A00063227333C09041308
+runC: 24/180 vectors
+runC: 49/180 vectors
+runC: 74/180 vectors
+runC: 99/180 vectors
+runC: 124/180 vectors
+runC: 149/180 vectors
+runC: 174/180 vectors
+runC: 180/180 vectors
+runC: free returned; exiting
+runC: done (free_run), rc=0
+Average speed: 367.02% (35 seconds)
diff --git a/dwt/evidence/oracle/stages.txt b/dwt/evidence/oracle/stages.txt
new file mode 100644
index 0000000..30bbe6b
--- /dev/null
+++ b/dwt/evidence/oracle/stages.txt
@@ -0,0 +1,6 @@
+1 0000000000000000 0000000000000000 90DE09B472855817 90DE09B472855817
+2 FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF 6A81040BF2294479 6A81040BF2294479
+3 0001020304050607 0001020304050607 490621BA1F7A2F9A 490621BA1F7A2F9A
+4 8DEC2CF3D0EA0000 8DEC2CF3D0EA0000 BDB2D3E0FC00DB5F BDB2D3E0FC00DB5F
+5 C0A863028EEC24F3 C0A863028EEC24F3 E31ECBD30F1E1B93 E31ECBD30F1E1B93
+6 0011223344556677 0011223344556677 DF11BB36BA20F348 DF11BB36BA20F348
diff --git a/dwt/evidence/oracle/stages/debug.log b/dwt/evidence/oracle/stages/debug.log
new file mode 100644
index 0000000..1e9f1ca
--- /dev/null
+++ b/dwt/evidence/oracle/stages/debug.log
@@ -0,0 +1,123 @@
+MAME debugger version 0.289 (mame0289-dirty)
+Currently targeting vt1200 (VT1200 X terminal (v2.2 firmware))
+>bclear
+ ^
+unknown command
+Breakpoint 1 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 2 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 3 set
+Breakpoint 4 set
+Breakpoint 5 set
+Stopped at breakpoint 4
+>bclear
+ ^
+unknown command
+Breakpoint 6 set
+Breakpoint 7 set
+Stopped at breakpoint 5
+>bclear
+ ^
+unknown command
+Breakpoint 8 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 9 set
+Breakpoint A set
+Breakpoint B set
+Stopped at breakpoint 4
+>bclear
+ ^
+unknown command
+Breakpoint C set
+Breakpoint D set
+Stopped at breakpoint 5
+>bclear
+ ^
+unknown command
+Breakpoint E set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint F set
+Breakpoint 10 set
+Breakpoint 11 set
+Stopped at breakpoint 4
+>bclear
+ ^
+unknown command
+Breakpoint 12 set
+Breakpoint 13 set
+Stopped at breakpoint 5
+>bclear
+ ^
+unknown command
+Breakpoint 14 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 15 set
+Breakpoint 16 set
+Breakpoint 17 set
+Stopped at breakpoint 4
+>bclear
+ ^
+unknown command
+Breakpoint 18 set
+Breakpoint 19 set
+Stopped at breakpoint 5
+>bclear
+ ^
+unknown command
+Breakpoint 1A set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 1B set
+Breakpoint 1C set
+Breakpoint 1D set
+Stopped at breakpoint 4
+>bclear
+ ^
+unknown command
+Breakpoint 1E set
+Breakpoint 1F set
+Stopped at breakpoint 5
+>bclear
+ ^
+unknown command
+Breakpoint 20 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
+Breakpoint 21 set
+Breakpoint 22 set
+Breakpoint 23 set
+Stopped at breakpoint 4
+>bclear
+ ^
+unknown command
+Breakpoint 24 set
+Breakpoint 25 set
+Stopped at breakpoint 5
+>bclear
+ ^
+unknown command
+Breakpoint 26 set
+Stopped at breakpoint 1
+>bclear
+ ^
+unknown command
diff --git a/dwt/evidence/oracle/stages/in.txt b/dwt/evidence/oracle/stages/in.txt
new file mode 100644
index 0000000..93ec516
--- /dev/null
+++ b/dwt/evidence/oracle/stages/in.txt
@@ -0,0 +1,6 @@
+0000000000000000
+ffffffffffffffff
+0001020304050607
+8dec2cf3d0ea0000
+c0a863028eec24f3
+0011223344556677
diff --git a/dwt/evidence/oracle/stages/nvram/vt1200/nvram b/dwt/evidence/oracle/stages/nvram/vt1200/nvram
new file mode 100644
index 0000000..08e7df1
Binary files /dev/null and b/dwt/evidence/oracle/stages/nvram/vt1200/nvram differ
diff --git a/dwt/evidence/oracle/stages/out.txt b/dwt/evidence/oracle/stages/out.txt
new file mode 100644
index 0000000..30bbe6b
--- /dev/null
+++ b/dwt/evidence/oracle/stages/out.txt
@@ -0,0 +1,6 @@
+1 0000000000000000 0000000000000000 90DE09B472855817 90DE09B472855817
+2 FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF 6A81040BF2294479 6A81040BF2294479
+3 0001020304050607 0001020304050607 490621BA1F7A2F9A 490621BA1F7A2F9A
+4 8DEC2CF3D0EA0000 8DEC2CF3D0EA0000 BDB2D3E0FC00DB5F BDB2D3E0FC00DB5F
+5 C0A863028EEC24F3 C0A863028EEC24F3 E31ECBD30F1E1B93 E31ECBD30F1E1B93
+6 0011223344556677 0011223344556677 DF11BB36BA20F348 DF11BB36BA20F348
diff --git a/dwt/evidence/oracle/stages/stdout.log b/dwt/evidence/oracle/stages/stdout.log
new file mode 100644
index 0000000..3465cff
--- /dev/null
+++ b/dwt/evidence/oracle/stages/stdout.log
@@ -0,0 +1,20 @@
+Warning: -video none doesn't make much sense without -seconds_to_run
+vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
+stages: 6 records
+vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
+vt1200: scanline#1 line=1 enabled=1
+vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
+vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
+vt1200: scanline#2 line=0 enabled=1
+vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
+vt1200: scanline#3 line=1 enabled=1
+vt1200: scanline#4 line=2 enabled=1
+stages: frame 3000 hijack
+stages: 1/6 0000000000000000 -> 90DE09B472855817 (in=0000000000000000 pre=90DE09B472855817)
+stages: 2/6 FFFFFFFFFFFFFFFF -> 6A81040BF2294479 (in=FFFFFFFFFFFFFFFF pre=6A81040BF2294479)
+stages: 3/6 0001020304050607 -> 490621BA1F7A2F9A (in=0001020304050607 pre=490621BA1F7A2F9A)
+stages: 4/6 8DEC2CF3D0EA0000 -> BDB2D3E0FC00DB5F (in=8DEC2CF3D0EA0000 pre=BDB2D3E0FC00DB5F)
+stages: 5/6 C0A863028EEC24F3 -> E31ECBD30F1E1B93 (in=C0A863028EEC24F3 pre=E31ECBD30F1E1B93)
+stages: 6/6 0011223344556677 -> DF11BB36BA20F348 (in=0011223344556677 pre=DF11BB36BA20F348)
+stages: done
+Average speed: 358.78% (41 seconds)
diff --git a/dwt/evidence/scripts/oracle_call_test.lua b/dwt/evidence/scripts/oracle_call_test.lua
new file mode 100644
index 0000000..0727949
--- /dev/null
+++ b/dwt/evidence/scripts/oracle_call_test.lua
@@ -0,0 +1,95 @@
+-- oracle_call_test.lua -- minimal proof that the firmware's challenge pipeline
+-- can be invoked directly from the debugger (no TCP connection).
+--
+-- Calls 0x3F5A9620(1)  (dwt_prf's allocator/init, Ghidra 0x07EB52C4)
+-- at frame 1000 and stops at the synthetic return address.
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local space = cpu.spaces['program']
+if not dbg then machine:exit(); return end
+dbg.visible_cpu = cpu
+
+local ARG    = 0x01800000
+local STACK  = 0x01840000
+local RET    = 0x018c0000
+local IE     = 0x200000
+local INIT   = 0x3F5A9620
+
+local f = 0
+local started = false
+local saved = {}
+
+local function state(name)
+	local r = cpu.state[name]
+	return r and r.value or nil
+end
+
+local function push(v)
+	local sp = state('SP') - 0x20
+	space:write_u32(sp, v)
+	cpu.state['SP'].value = sp
+end
+
+local function setup_call(target, args)
+	saved.pc  = state('PC')
+	saved.sp  = state('SP')
+	saved.a14 = state('A14')
+	saved.st  = state('ST')
+	print(string.format("TEST setup target=%08X pc=%08X sp=%08X a14=%08X st=%08X",
+		target, saved.pc, saved.sp, saved.a14, saved.st))
+	cpu.state['SP'].value = STACK
+	if #args > 0 then
+		local a = ARG
+		for i = 1, #args do
+			space:write_u32(a, args[i])
+			a = a + 0x20
+		end
+		push(saved.a14)
+		cpu.state['A14'].value = ARG + #args * 0x20
+	end
+	push(RET)
+	cpu.state['PC'].value = target
+	cpu.state['ST'].value = saved.st & ~IE
+	dbg:command('bclear')
+	dbg:command(string.format('bpset %X', RET))
+	dbg.execution_state = 'run'
+end
+
+emu.register_frame_done(function()
+	f = f + 1
+	if f == 1000 and not started then
+		started = true
+		print(string.format("TEST frame=%d @1C0200=%08X", f, space:read_u32(0x1c0200)))
+		setup_call(INIT, { 1 })
+		return
+	end
+	if started and saved.pc then
+		local es = dbg.execution_state
+		if es == 'stop' then
+			local pc = state('PC')
+			print(string.format("TEST stop frame=%d pc=%08X savedpc=%08X", f, pc, saved.pc))
+			print(string.format("TEST @1C0200=%08X @1C0220=%08X @1C0240=%08X @1C0260=%08X",
+				space:read_u32(0x1c0200), space:read_u32(0x1c0220),
+				space:read_u32(0x1c0240), space:read_u32(0x1c0260)))
+			-- dump 16 bytes at the key pointer if it looks sane
+			local kp = space:read_u32(0x1c0260)
+			if kp ~= 0 then
+				local t = {}
+				for i = 0, 15 do
+					t[#t + 1] = string.format("%02X", space:read_u8(kp + i * 8))
+				end
+				print("TEST key[0..15]=" .. table.concat(t, " "))
+			end
+			dbg:command('bclear')
+			cpu.state['PC'].value  = saved.pc
+			cpu.state['SP'].value  = saved.sp
+			cpu.state['A14'].value = saved.a14
+			cpu.state['ST'].value  = saved.st
+			print("TEST restoring and exiting")
+			machine:exit()
+		end
+	end
+end, "vt1200-oracle-call-test")
+
+dbg.execution_state = 'run'
diff --git a/dwt/evidence/scripts/oracle_stage.lua b/dwt/evidence/scripts/oracle_stage.lua
new file mode 100644
index 0000000..b66ef32
--- /dev/null
+++ b/dwt/evidence/scripts/oracle_stage.lua
@@ -0,0 +1,175 @@
+-- oracle_stage.lua -- intermediate-state capture for ONE 8-byte record of the
+-- dwt_prf challenge transform.
+--
+-- Calls the per-record stage 0x3F5ABA40 directly (Ghidra 0x07EB5748) after the
+-- same INIT/EXPAND sequence dwt/oracle.lua uses, and stops at two interior
+-- points:
+--
+--   0x3F5ABB30  immediately after the first font render returns; A13 points
+--               at the callee's 8-byte local record  -> "feistel_in"
+--   0x3F5AC620  immediately before the final font render; A13+0..7 holds the
+--               pre-final-render record               -> "pre_final_render"
+--
+-- Output line: "<index> <input8> <feistel_in> <pre_final> <output8>"
+--
+-- Inputs:  VT1200_ORACLE_IN  (one 16-hex-char record per line)
+-- Output:  VT1200_ORACLE_OUT
+-- Env:     VT1200_ORACLE_START (default 3000), VT1200_ORACLE_TAG
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local space = cpu.spaces['program']
+if not dbg then machine:exit(); return end
+dbg.visible_cpu = cpu
+
+local IN_PATH  = os.getenv("VT1200_ORACLE_IN")
+local OUT_PATH = os.getenv("VT1200_ORACLE_OUT")
+local START    = tonumber(os.getenv("VT1200_ORACLE_START") or "3000")
+local TAG      = os.getenv("VT1200_ORACLE_TAG") or "stage"
+
+local ARG    = 0x01800000
+local STACK  = 0x01840000
+local CBUF   = 0x01880000
+local RET    = 0x018C0000
+local IE     = 0x200000
+
+local INIT   = 0x3F5A9620
+local EXPAND = 0x3F5AA2C0
+local RECORD = 0x3F5ABA40
+local S1     = 0x3F5ABB30
+local S2     = 0x3F5AC620
+local SRC    = 0x1BE810
+
+local f, stage, idx = 0, "boot", 1
+local inputs, out, saved = {}, nil, {}
+local s1, s2 = nil, nil
+
+local function state(n)
+	local r = cpu.state[n]
+	return r and r.value or nil
+end
+
+local function hexbytes(bit, n)
+	local t = {}
+	for i = 0, n - 1 do
+		t[#t + 1] = string.format("%02X", space:read_u8(bit + i * 8))
+	end
+	return table.concat(t)
+end
+
+local function push(v)
+	local sp = state('SP') - 0x20
+	space:write_u32(sp, v)
+	cpu.state['SP'].value = sp
+end
+
+local function call(target, args, extra_bps)
+	saved.pc, saved.sp, saved.a14, saved.st =
+		state('PC'), state('SP'), state('A14'), state('ST')
+	cpu.state['SP'].value = STACK
+	if #args > 0 then
+		local a = ARG
+		for i = 1, #args do
+			space:write_u32(a, args[i]); a = a + 0x20
+		end
+		push(saved.a14)
+		cpu.state['A14'].value = ARG + #args * 0x20
+	end
+	push(RET)
+	cpu.state['PC'].value = target
+	cpu.state['ST'].value = saved.st & ~IE
+	dbg:command('bclear')
+	dbg:command(string.format('bpset %X', RET))
+	if extra_bps then
+		for _, bp in ipairs(extra_bps) do
+			dbg:command(string.format('bpset %X', bp))
+		end
+	end
+	dbg.execution_state = 'run'
+end
+
+local function restore_exit()
+	dbg:command('bclear')
+	cpu.state['PC'].value, cpu.state['SP'].value =
+		saved.pc, saved.sp
+	cpu.state['A14'].value, cpu.state['ST'].value =
+		saved.a14, saved.st
+	if out then out:close() end
+	print(TAG .. ": done")
+	machine:exit()
+end
+
+local fh = io.open(IN_PATH, "r")
+if not fh then print(TAG .. ": no input file"); machine:exit(); return end
+for line in fh:lines() do
+	line = line:gsub("%s+", "")
+	if #line > 0 and line:sub(1, 1) ~= "#" then
+		if #line ~= 16 then
+			print(TAG .. ": bad record length " .. #line); machine:exit(); return
+		end
+		inputs[#inputs + 1] = line:upper()
+	end
+end
+fh:close()
+out = assert(io.open(OUT_PATH, "w"))
+print(string.format("%s: %d records", TAG, #inputs))
+
+local function next_record()
+	if idx > #inputs then restore_exit(); return end
+	local v = inputs[idx]
+	for i = 0, 7 do
+		space:write_u8(CBUF + i * 8, tonumber(v:sub(i * 2 + 1, i * 2 + 2), 16))
+		space:write_u8(CBUF + (8 + i) * 8, 0)
+	end
+	s1, s2 = nil, nil
+	stage = "rec_run"
+	call(RECORD, { CBUF }, { S1, S2 })
+end
+
+emu.register_frame_done(function()
+	f = f + 1
+	if stage == "boot" and f >= START then
+		print(string.format("%s: frame %d hijack", TAG, f))
+		stage = "init_run"
+		call(INIT, { 1 })
+		return
+	end
+	if stage == "boot" then return end
+	if dbg.execution_state ~= 'stop' then return end
+	local pc = state('PC')
+
+	if stage == "init_run" then
+		stage = "expand_run"
+		call(EXPAND, { SRC })
+	elseif stage == "expand_run" then
+		stage = "records"
+		next_record()
+	elseif stage == "rec_run" then
+		if pc == S1 then
+			s1 = hexbytes(state('A13'), 8)
+			dbg:command('bclear')
+			dbg:command(string.format('bpset %X', RET))
+			dbg:command(string.format('bpset %X', S2))
+			dbg.execution_state = 'run'
+		elseif pc == S2 then
+			s2 = hexbytes(state('A13'), 8)
+			dbg:command('bclear')
+			dbg:command(string.format('bpset %X', RET))
+			dbg.execution_state = 'run'
+		elseif pc == RET then
+			local res = hexbytes(CBUF, 8)
+			out:write(string.format("%d %s %s %s %s\n", idx, inputs[idx],
+				tostring(s1), tostring(s2), res))
+			out:flush()
+			print(string.format("%s: %d/%d %s -> %s (in=%s pre=%s)",
+				TAG, idx, #inputs, inputs[idx], res, tostring(s1), tostring(s2)))
+			idx = idx + 1
+			next_record()
+		else
+			print(string.format("%s: unexpected stop %08X", TAG, pc))
+			restore_exit()
+		end
+	end
+end, "vt1200-dwt-stage")
+
+dbg.execution_state = 'run'
diff --git a/dwt/notes/CHALLENGE_ORACLE.md b/dwt/notes/CHALLENGE_ORACLE.md
new file mode 100644
index 0000000..cdb471b
--- /dev/null
+++ b/dwt/notes/CHALLENGE_ORACLE.md
@@ -0,0 +1,181 @@
+# dwt_prf challenge transform — runtime oracle (ground truth)
+
+Status: **DONE.** The firmware's `dwt_prf` transform has been driven directly on
+the emulated VT1200 with **no TCP connection**, and its input→output behaviour
+captured for 180 vector instances (177 distinct 16-byte inputs).
+ROM MD5 `b46a3e442ccb86134d2356bd70d22fd2`; no driver edits; private NVRAM.
+
+Deliverables:
+
+| path | what |
+|---|---|
+| `dwt/oracle.lua` | MAME `-autoboot_script`; calls the firmware's own INIT / EXPAND / TRANSFORM / FREE |
+| `dwt/oracle.py` | host driver: deterministic vector generation, two fresh-NVRAM boots, live-probe cross-check, characterisation, JSON writer |
+| `dwt/challenge_vectors.json` | the vectors (top-level JSON **array**) |
+| `dwt/evidence/oracle/` | per-boot inputs/outputs, full `stdout.log` with seed/key dumps, `characterisation.json` |
+
+## 1. Method — direct invocation of the firmware's own code
+
+`dwt_prf` (`0x3F59FDC0`) performs exactly this sequence around the transform
+(disassembly in `harness/mame/hostport_dis34.txt:160152`):
+
+```
+0x3F5A9620(1)          ; allocate/init      (Ghidra 0x07EB52C4)
+0x3F5AA2C0(0x1BE810)   ; expand key schedule (Ghidra 0x07EB5458)
+0x3F5A09C0(buf, 16)    ; the transform       (Ghidra 0x07EB4138)
+0x3F5A9FA0()           ; free                (Ghidra 0x07EB53F4)
+```
+
+`dwt/oracle.lua` calls those same ROM routines in that same order at frame 3000
+(OS up, `VT1200_SKIP_LEVEL1=1`), once per run for INIT/EXPAND, then once per
+vector for the transform, and FREE at the end. No reply bytes are faked and no
+firmware code is bypassed: everything between the calls is the stock firmware.
+
+Calling convention (read from the firmware's call sites, e.g. `3f5a06c0`):
+
+* caller pushes **A14**, writes arguments upward starting at A14, then `CALLA`
+  pushes the return address;
+* a routine called with one or more args ends with `rets 2`, which pops the
+  return address and the saved A14; a zero-argument routine (`0x3F5A9FA0`)
+  uses a bare `CALL` and plain `rets`.
+
+The harness supplies a scratch stack at bit `0x01840000` and argument block at
+`0x01800000` (top 1 MiB of main RAM, also used by the hello-world payload),
+disables ST.IE for the duration, and puts a breakpoint at a synthetic return
+address (`0x018C0000`). The interrupted firmware PC, SP, A14 and ST are saved
+and restored after every call. `MAME` keeps pumping frame callbacks while the
+debugger is halted (`running_machine::run` → `video.frame_update` when paused),
+which is what lets the Lua state machine advance one call per stop.
+
+### Validation against live TCP captures
+
+`dwt/evidence/run-live/render-probes.txt` has 11 chosen replies captured through
+a **real TCP connection** and the actual `dwt_prf` path. The direct call
+reproduces all 11, byte for byte, e.g.
+
+```
+live zero reply  -> out 90 de 09 b4 72 85 58 17   (x2 records)
+direct f(00*8)   ->      90 de 09 b4 72 85 58 17   (x2 records)
+```
+
+`characterisation.json` records `live_probe_agreement: 11/11`.
+
+## 2. Direction — what the buffer holds before vs after
+
+From the `dwt_prf` disassembly (`3f59ff50`..`3f5a08f0`) and the live dumps
+`chal_sent.bin` / `cmp_a9.bin`:
+
+* the terminal picks four 32-bit words `W0..W3` and stores them **host order**
+  at `frame+0x100` bits — this is the **expected** value;
+* it `ntohl`s each word into `frame+0` and sends **those** 16 bytes: the wire
+  challenge `C`, with `W = ntohl(C)` (per-word byte swap);
+* it receives the reply `R`, `ntohl`s each word **in place** → buffer `X`;
+* it applies the transform **in place** → `Y = f(X)`;
+* it compares `Y` with `W`.
+
+So the firmware transforms the reply, not the challenge. The pass condition is
+
+```
+f(ntohl(R)) == W          <=>    R = ntohl(f^-1(W)) = ntohl(f^-1(ntohl(C)))
+```
+
+The vectors' `input_hex` is `X` (post-`ntohl`); `output_hex` is `Y = f(X)`.
+An echo `R = C` gives `X = W` and fails unless `f` is the identity; the live
+memcmp returns were `0xFFFFFFFF` for echo and `1` for the word-swapped answer,
+which is exactly what a non-identity `f` predicts. Live challenge used in the
+vectors (one historical capture):
+`f32cec8d0000ead00263a8c0f324ec8e`, whose `f` input is
+`8dec2cf3d0ea0000c0a863028eec24f3`.
+
+## 3. Characterisation
+
+| property | result | evidence |
+|---|---|---|
+| **deterministic across boots** | **yes** — 177 distinct inputs identical on two fresh-NVRAM boots; a third boot that hijacks at frame 2500 is also identical | `runA/out.txt` vs `runB/out.txt` vs `runC_frame2500/out.txt` |
+| key schedule fixed | yes — seed block `0x1BE810` and full 128-byte key schedule at `@0x1C0260` are identical in both boots (`seed sha256 dafc2461…`, `key sha256 4f897a57…`) | `runA/stdout.log` |
+| **per-8-byte independence** | **yes** — records are processed separately; 0/32 independence-grid errors; 64 single-bit changes in record 0 changed record 1's output in **0** cases; a repeated record gives a repeated output | `characterisation.json` |
+| **permutation on samples** | 152 distinct inputs → 152 distinct outputs; **0 fixed points** | `characterisation.json` |
+| **avalanche** | flip one bit of the first record: **32.66 / 64** output bits change on average (min 23, max 42) | 64 flips of the ascending baseline |
+| in-place | yes — the 16-byte buffer is overwritten with the result | `0x3F5A09C0` writes through its argument pointer |
+
+### Intermediate states (`dwt/evidence/oracle/stages.txt`)
+
+`dwt/evidence/scripts/oracle_stage.lua` calls the per-record stage
+`0x3F5ABA40` alone and stops at two interior points:
+
+```
+0x3F5ABB30  after the first font render returns   -> "feistel_in"
+0x3F5AC620  before the final font render          -> "pre_final_render"
+```
+
+For all six captured records `feistel_in == input` and
+`pre_final_render == output`. That is not a broken probe: `dwt_prf` calls
+INIT with argument **1**, and that mode leaves `@0x1C0220` / `@0x1C0240`
+NULL (`0x3F5A9990: dec a9; jreq L3F5A99F0`), so both "font render" calls in
+`0x3F5ABA40` take their **memcpy branch** (`0x3FE169C0`, via the
+`jrne L3F5AC820` test on the second argument). On this path the advertised
+font-render layers are identity copies, and the effective transform is the
+16-round Feistel over the 128-byte key schedule expanded from `0x1BE810`
+(plus the `0x1BED40/0x1BEF00/0x1BEF80` auxiliary blocks). This does not
+contradict the static note that the calls are present; it says what they do
+under `dwt_prf`'s mode.
+
+## 4. Vector file
+
+`dwt/challenge_vectors.json` is a **top-level JSON array**:
+
+```json
+{"input_hex": "00000000000000000000000000000000",
+ "output_hex": "90de09b47285581790de09b472855817",
+ "meta": {"stage": "full", "boot": 2, "kind": "zero", "index": 0}}
+```
+
+* `input_hex` — 16 bytes, the transform's input `X` (post-`ntohl` buffer).
+* `output_hex` — 16 bytes, `Y = f(X)`.
+* `stage` — `full` for every entry; the intermediate per-record values are in
+  `dwt/evidence/oracle/stages.txt` (columns:
+  `index input feistel_in pre_final_render output`).
+* `boot` — number of independent fresh-NVRAM boots that produced the same
+  output (2 for every entry).
+
+Load with:
+
+```python
+import json
+vectors = json.load(open("dwt/challenge_vectors.json"))
+for v in vectors:
+    x = bytes.fromhex(v["input_hex"]); y = bytes.fromhex(v["output_hex"])
+```
+
+Composition: 180 instances / 177 distinct inputs — 13 structured specials,
+the live wire challenge and its word-swapped form, 11 live-probe inputs,
+64 single-bit flips of the ascending baseline's first record, 8 flips of its
+second record, a 32-vector independence grid, 48 random inputs, and two
+deliberate duplicate inputs (identical outputs).
+
+## 5. Reproduce
+
+```sh
+cd /home/arti/code/k-space/vt1200
+python3 dwt/oracle.py            # two boots + stage capture; ~35 s
+# options: --quick (one boot), --no-run (rewrite JSON from saved outputs),
+#          --skip-stages
+```
+
+Each boot is `VT1200_SKIP_LEVEL1=1`, `-video none -sound none -nothrottle`,
+`-debug -debugger none`, its own `-nvram_directory` under
+`dwt/evidence/oracle/run*/nvram`.
+
+## 6. Caveats
+
+* `VT1200_SKIP_LEVEL1=1` is the documented harness divergence used to reach the
+  OS (and therefore the same firmware code the live TCP captures reached). It
+  does not change the transform: the direct outputs equal the live captures.
+* The live challenge is time-dependent; the value in the file is one real
+  capture from `dwt/evidence/run-live/remote-attempt.txt`. Any 16-byte value is
+  a valid input to `f`.
+* "Fixed key" is established for **this** ROM image and boot state: the seed
+  and auxiliary blocks are boot-constant (two fresh NVRAMs, plus a differently
+  timed hijack). Nothing here proves another firmware version shares them.
+* No live TCP session was used during the vector runs; the live cross-check is
+  the 11 previously captured probe replies plus the challenge/memcmp dumps.
diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md
index 5045381..9e68366 100644
--- a/dwt/notes/CROSS.md
+++ b/dwt/notes/CROSS.md
@@ -197,3 +197,54 @@ tap, BOOTP address 192.168.99.2):
 The tap (`tap-mess-1000-0` / bridge `vt1200`) is free again as of 02:40; the
 MAME instance and the BOOTP server are stopped.  Full write-up:
 `dwt/notes/EXPLOIT_ATTEMPT.md`; transcript and logs under `dwt/evidence/`.
+
+## 2026-10-18 02:42 EEST — oracle agent: dwt_prf transform ground truth is captured
+
+Full method and caveats: `dwt/notes/CHALLENGE_ORACLE.md`.
+
+**Vectors:** `dwt/challenge_vectors.json` — a top-level JSON **array** of 180
+instances (177 distinct inputs). Load with
+`vectors = json.load(open("dwt/challenge_vectors.json"))`; each entry is
+`{"input_hex": <32 hex>, "output_hex": <32 hex>, "meta": {...}}`.
+`input_hex` is the 16-byte buffer **after** dwt_prf's per-word `ntohl` (the
+transform's actual input); `output_hex` is `f(input)` in place. The full
+128-byte key schedule and seed-block dumps are in
+`dwt/evidence/oracle/runA/stdout.log`.
+
+**Direction (confirmed):** the firmware transforms the reply, not the
+challenge. With host-order challenge words `W`, wire challenge
+`C = ntohl(W)` (per-32-bit-word byte swap), wire reply `R`:
+`X = ntohl(R)`, `Y = f(X)`, and dwt_prf memcmp's `Y` against `W`.
+Pass condition: `f(ntohl(R)) == W`, i.e.
+`R = ntohl(f^-1(W)) = ntohl(f^-1(ntohl(C)))`. The vectors give `f`, so the
+implementation needs the inverse (and the outer word swap).
+
+**Determinism:** yes. 177 distinct inputs give identical outputs on two
+fresh-NVRAM boots, and on a third boot that hijacks at a different frame.
+Seed block `0x1BE810` and the key schedule `@0x1C0260` are byte-identical
+across boots — the key is genuinely fixed for this image.
+
+**Per-8-byte independence:** yes. Records are processed separately: changing
+only bytes 0–7 never changes output bytes 8–15 (0/64 single-bit trials), and
+32 independence-grid pairs agree. Output for a doubled record is the doubled
+output. Permutation on samples: 152 distinct inputs → 152 distinct outputs, no
+fixed points. Avalanche: one input bit flips **32.66 of 64** first-record
+output bits on average (23–42).
+
+**Two reversing shortcuts found while building the oracle:**
+
+1. **Argument order for a direct call.** `0x3F5A09C0` expects `(len, buf)` in
+   source order, i.e. `buf` must be the **last** argument written (the callee
+   reads `*a13(0xffe0)` as the pointer and `*a13(0xffc0)` as the length).
+   Writing `(buf, 16)` gives a pointer of 16 and will not work.
+2. **The two "font render" calls are identity copies on this path.** dwt_prf
+   calls INIT with mode **1** (`0x3F5A9620(1)`); that mode leaves
+   `@0x1C0220`/`@0x1C0240` NULL, so `0x3F5ABA40`'s two render calls take their
+   memcpy branch. Captured per-record intermediates
+   (`dwt/evidence/oracle/stages.txt`) show `feistel_in == input` and
+   `pre_final_render == output` for all six samples. The effective transform is
+   the 16-round Feistel over the key schedule expanded from `0x1BE810` (+ the
+   `0x1BED40/0x1BEF00/0x1BEF80` auxiliary blocks).
+
+Reproduce: `python3 dwt/oracle.py` (~35 s, two boots + stage capture). No ROM,
+driver or `dwt_prf` code was modified; no socket was used for the vectors.
diff --git a/dwt/oracle.lua b/dwt/oracle.lua
new file mode 100644
index 0000000..00ac382
--- /dev/null
+++ b/dwt/oracle.lua
@@ -0,0 +1,248 @@
+-- dwt/oracle.lua -- direct-invocation oracle for the VT1200 rdebug `dwt_prf`
+-- challenge transform.
+--
+-- Run as a MAME -autoboot_script.  No TCP connection, no driver change, the
+-- ROM file is untouched.  The script reproduces exactly what dwt_prf does
+-- around the transform:
+--
+--     0x3F5A9620(1)          ; alloc/init tables   (Ghidra 0x07EB52C4)
+--     0x3F5AA2C0(0x1BE810)   ; expand key schedule (Ghidra 0x07EB5458)
+--     0x3F5A09C0(buf, 16)    ; the transform       (Ghidra 0x07EB4138)
+--     0x3F5A9FA0()           ; free tables         (Ghidra 0x07EB53F4)
+--
+-- by calling those ROM routines with the firmware's own stack convention
+-- (caller pushes A14, writes arguments upward from A14, CALLA pushes the
+-- return address; callee restores A14 from the stack and `rets 2` pops it).
+-- The harness borrows a scratch stack in unused top-of-RAM, pushes a
+-- synthetic return address, and stops on a breakpoint there.
+--
+-- Inputs:  VT1200_ORACLE_IN   text file, one 32-hex-char (16-byte) input per
+--                             line; '#' comments and blank lines are skipped.
+-- Output:  VT1200_ORACLE_OUT  one line per vector:
+--                             "<index> <input hex> <output hex>"
+-- Env:     VT1200_ORACLE_START  frame to hijack the CPU (default 3000)
+--          VT1200_ORACLE_TAG    label used in log lines (default "oracle")
+--
+-- The input is the buffer as the transform sees it: the 16 received bytes
+-- after dwt_prf's ntohl (i.e. each 32-bit wire word byte-swapped).  The
+-- output is the in-place transformed buffer that dwt_prf then memcmp's
+-- against the host-order challenge words.
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local space = cpu.spaces['program']
+if not dbg then machine:exit(); return end
+dbg.visible_cpu = cpu
+
+local IN_PATH  = os.getenv("VT1200_ORACLE_IN")
+local OUT_PATH = os.getenv("VT1200_ORACLE_OUT")
+local START    = tonumber(os.getenv("VT1200_ORACLE_START") or "3000")
+local TAG      = os.getenv("VT1200_ORACLE_TAG") or "oracle"
+local INTER    = os.getenv("VT1200_ORACLE_INTERMEDIATE") == "1"
+
+-- Scratch RAM: the top 1 MiB of the 4 MiB main RAM (bytes 0x300000..).
+-- hello-world and the earlier probes also used 0x01800000 without trouble.
+local ARG    = 0x01800000   -- argument block (A14 target), grows upward
+local STACK  = 0x01840000   -- scratch stack top, grows downward
+local CBUF   = 0x01880000   -- 16-byte transform buffer
+local RET    = 0x018C0000   -- synthetic return address (never executed)
+local IE     = 0x200000     -- TMS34010 ST.IE (tms34010.cpp: STBIT_IE = 1<<21)
+
+local INIT      = 0x3F5A9620
+local EXPAND    = 0x3F5AA2C0
+local TRANSFORM = 0x3F5A09C0
+local FREE      = 0x3F5A9FA0
+local SRC_BLOCK = 0x1BE810   -- 128-byte seed block expanded by EXPAND
+
+local f = 0
+local stage = "boot"
+local idx = 1
+local vectors = {}
+local out = nil
+local saved = {}
+local err = nil
+
+-- ---------------------------------------------------------------- utilities
+local function state(name)
+	local r = cpu.state[name]
+	return r and r.value or nil
+end
+
+local function hexbytes(bitaddr, n)
+	local t = {}
+	for i = 0, n - 1 do
+		t[#t + 1] = string.format("%02X", space:read_u8(bitaddr + i * 8))
+	end
+	return table.concat(t)
+end
+
+local function dump_lines(label, bitaddr, n)
+	for off = 0, n - 1, 32 do
+		local m = math.min(32, n - off)
+		print(string.format("%s: %s+%03X %s", TAG, label, off,
+			hexbytes(bitaddr + off * 8, m)))
+	end
+end
+
+local function push(v)
+	local sp = state('SP') - 0x20
+	space:write_u32(sp, v)
+	cpu.state['SP'].value = sp
+end
+
+-- Call a firmware routine with the firmware's own convention.
+--   args == {} -> bare CALL (routine does `rets`, no pushed A14)
+--   args ~= {} -> caller pushes A14, writes args upward, CALLA
+local function setup_call(target, args)
+	saved.pc  = state('PC')
+	saved.sp  = state('SP')
+	saved.a14 = state('A14')
+	saved.st  = state('ST')
+	cpu.state['SP'].value = STACK
+	if #args > 0 then
+		local a = ARG
+		for i = 1, #args do
+			space:write_u32(a, args[i])
+			a = a + 0x20
+		end
+		push(saved.a14)
+		cpu.state['A14'].value = ARG + #args * 0x20
+	end
+	push(RET)
+	cpu.state['PC'].value = target
+	cpu.state['ST'].value = saved.st & ~IE
+	dbg:command('bclear')
+	dbg:command(string.format('bpset %X', RET))
+	dbg.execution_state = 'run'
+end
+
+local function restore_and_exit(rc)
+	dbg:command('bclear')
+	if saved.pc then
+		cpu.state['PC'].value  = saved.pc
+		cpu.state['SP'].value  = saved.sp
+		cpu.state['A14'].value = saved.a14
+		cpu.state['ST'].value  = saved.st
+	end
+	if out then out:close() end
+	print(string.format("%s: done (%s), rc=%s", TAG, stage, tostring(rc)))
+	machine:exit()
+end
+
+-- ---------------------------------------------------------------- start-up
+if IN_PATH then
+	local fh, e = io.open(IN_PATH, "r")
+	if not fh then
+		print(TAG .. ": cannot open input " .. tostring(IN_PATH) .. ": " .. tostring(e))
+		machine:exit()
+		return
+	end
+	for line in fh:lines() do
+		line = line:gsub("%s+", "")
+		if #line > 0 and line:sub(1, 1) ~= "#" then
+			if #line ~= 32 then
+				print(TAG .. ": bad vector length " .. #line .. ": " .. line)
+				machine:exit()
+				return
+			end
+			vectors[#vectors + 1] = line:upper()
+		end
+	end
+	fh:close()
+end
+print(string.format("%s: loaded %d vectors from %s", TAG, #vectors, tostring(IN_PATH)))
+if OUT_PATH then
+	out = io.open(OUT_PATH, "w")
+	if not out then
+		print(TAG .. ": cannot open output " .. tostring(OUT_PATH))
+		machine:exit()
+		return
+	end
+end
+
+local function write_out(index, inhex, outhex)
+	if out then
+		out:write(string.format("%d %s %s\n", index, inhex, outhex))
+		out:flush()
+	end
+end
+
+local function next_vector()
+	if idx > #vectors then
+		-- mirror dwt_prf's teardown, then leave
+		stage = "free_run"
+		setup_call(FREE, {})
+		return
+	end
+	local v = vectors[idx]
+	for i = 0, 15 do
+		space:write_u8(CBUF + i * 8, tonumber(v:sub(i * 2 + 1, i * 2 + 2), 16))
+	end
+	stage = "transform_run"
+	setup_call(TRANSFORM, { 16, CBUF })
+end
+
+-- ---------------------------------------------------------------- main loop
+emu.register_frame_done(function()
+	f = f + 1
+
+	if stage == "boot" and f >= START then
+		print(string.format("%s: frame %d hijack pc=%08X sp=%08X a14=%08X",
+			TAG, f, state('PC'), state('SP'), state('A14')))
+		stage = "init_run"
+		setup_call(INIT, { 1 })
+		return
+	end
+
+	if stage == "boot" then return end
+
+	-- While the debugger is halted the OSD keeps pumping frame updates
+	-- (running_machine::run -> video.frame_update when paused), so this
+	-- callback still runs; act once per stop.
+	if dbg.execution_state ~= 'stop' then return end
+	local pc = state('PC')
+
+	if pc ~= RET then
+		print(string.format("%s: unexpected stop at %08X in stage %s", TAG, pc, stage))
+		err = "unexpected stop"
+		restore_and_exit(1)
+		return
+	end
+
+	if stage == "init_run" then
+		print(string.format("%s: init returned; @1C0200=%08X @1C0220=%08X @1C0240=%08X @1C0260=%08X",
+			TAG, space:read_u32(0x1c0200), space:read_u32(0x1c0220),
+			space:read_u32(0x1c0240), space:read_u32(0x1c0260)))
+		stage = "expand_run"
+		setup_call(EXPAND, { SRC_BLOCK })
+
+	elseif stage == "expand_run" then
+		print(string.format("%s: expand returned; keyptr=%08X fontptr=%08X renderptr=%08X",
+			TAG, space:read_u32(0x1c0260), space:read_u32(0x1c0220),
+			space:read_u32(0x1c0240)))
+		-- Evidence: the seed block and the full 128-byte expanded key schedule,
+		-- per run.  dwt_prf calls INIT(1), so @1C0220/@1C0240 stay NULL and
+		-- both "font render" steps are memcpy (see notes/CHALLENGE_ORACLE.md).
+		dump_lines("seed", SRC_BLOCK, 128)
+		dump_lines("key", space:read_u32(0x1c0260), 128)
+		dump_lines("aux", 0x1BED40, 0x2C0)
+		stage = "vectors"
+		next_vector()
+
+	elseif stage == "transform_run" then
+		local inhex = vectors[idx]
+		local outhex = hexbytes(CBUF, 16)
+		write_out(idx, inhex, outhex)
+		idx = idx + 1
+		if idx % 25 == 0 or idx > #vectors then
+			print(string.format("%s: %d/%d vectors", TAG, idx - 1, #vectors))
+		end
+		next_vector()
+
+	elseif stage == "free_run" then
+		print(string.format("%s: free returned; exiting", TAG))
+		restore_and_exit(0)
+	end
+end, "vt1200-dwt-oracle")
+
+dbg.execution_state = 'run'
diff --git a/dwt/oracle.py b/dwt/oracle.py
new file mode 100644
index 0000000..c327100
--- /dev/null
+++ b/dwt/oracle.py
@@ -0,0 +1,447 @@
+#!/usr/bin/env python3
+"""Host-side driver for the dwt_prf challenge-transform oracle.
+
+Generates a deterministic vector set, runs the firmware's transform twice (two
+independent fresh-NVRAM boots) through dwt/oracle.lua, checks the results
+against the live TCP captures in dwt/evidence/run-live/, writes
+dwt/challenge_vectors.json and a characterisation report.
+
+Usage:
+    python3 dwt/oracle.py            # full run (two boots), ~2-4 minutes
+    python3 dwt/oracle.py --quick    # one boot, used while developing
+    python3 dwt/oracle.py --no-run   # regenerate inputs and JSON from the
+                                     # outputs already in dwt/evidence/oracle/
+
+Conventions (important for the reverser):
+    input_hex  = the 16-byte buffer exactly as the transform sees it, i.e. the
+                 16 bytes received from the wire with each 32-bit word
+                 byte-swapped (dwt_prf's ntohl step, ROM 0x3FB2C140).
+    output_hex = the in-place transformed buffer that dwt_prf memcmp's against
+                 the host-order challenge words.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import random
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+PROJECT = Path(__file__).resolve().parent.parent
+MAME = os.environ.get("VT1200_MAME", "/home/arti/code/k-space/mame0289/vt1200")
+ROMPATH = PROJECT / "harness/mame/roms"
+EVID = PROJECT / "dwt/evidence/oracle"
+LUA = PROJECT / "dwt/oracle.lua"
+STAGE_LUA = PROJECT / "dwt/evidence/scripts/oracle_stage.lua"
+VECTORS_JSON = PROJECT / "dwt/challenge_vectors.json"
+LIVE_PROBES_PATH = PROJECT / "dwt/evidence/run-live/render-probes.txt"
+
+START_FRAME = int(os.environ.get("VT1200_ORACLE_START", "3000"))
+
+
+# --------------------------------------------------------------------------
+# vector generation
+# --------------------------------------------------------------------------
+
+def swap_words(b: bytes) -> bytes:
+    """Byte-swap each 32-bit word (the firmware's ntohl, applied in place)."""
+    out = bytearray()
+    for i in range(0, len(b), 4):
+        out += b[i:i + 4][::-1]
+    return bytes(out)
+
+
+# The 16-byte challenge a live terminal sent over TCP (dwt/evidence/
+# run-live/remote-attempt.txt, dwt/notes/EXPLOIT_ATTEMPT.md section 2).
+LIVE_WIRE_CHALLENGE = bytes.fromhex(
+    "f32cec8d0000ead00263a8c0f324ec8e")
+
+# (name, wire reply bytes, expected first 8 transformed bytes) from
+# dwt/evidence/run-live/render-probes.txt.  The transform input is the
+# wire reply with each word byte-swapped.
+LIVE_PROBES = [
+    ("live_zero", bytes(16), "90de09b472855817"),
+    ("live_p0_01", bytes.fromhex("01000000") + bytes(12), "b1975ff1d78d032a"),
+    ("live_p0_02", bytes.fromhex("02000000") + bytes(12), "5865800e5d8c3c55"),
+    ("live_p0_03", bytes.fromhex("03000000") + bytes(12), "ee590df03c2bdbdd"),
+    ("live_p0_10", bytes.fromhex("10000000") + bytes(12), "0b9ab22e400a068f"),
+    ("live_p0_20", bytes.fromhex("20000000") + bytes(12), "362cf798ec8ae918"),
+    ("live_p0_30", bytes.fromhex("30000000") + bytes(12), "9ecae2e539a16357"),
+    ("live_p0_80", bytes.fromhex("80000000") + bytes(12), "57d8297c38f7783b"),
+    ("live_p0_ff", bytes.fromhex("ff000000") + bytes(12), "fc00338c744b2d1b"),
+    ("live_p1_01", bytes.fromhex("00010000") + bytes(12), "21105daed5e13ec5"),
+    ("live_p7_01", bytes.fromhex("0000000000000001") + bytes(8), "46ba798d00e10cdb"),
+]
+
+
+def build_vectors():
+    """Return [(hex_input, kind, note_or_None), ...] deterministically."""
+    items = []
+
+    def add(b: bytes, kind: str, note: str | None = None):
+        assert len(b) == 16, (kind, len(b))
+        items.append((b.hex(), kind, note))
+
+    # --- structured specials -------------------------------------------
+    add(bytes(16), "zero")
+    add(b"\xff" * 16, "ones")
+    add(bytes(range(16)), "ascending")
+    add(bytes(range(15, -1, -1)), "descending")
+    add(bytes([0xAA, 0x55] * 8), "alternating_aa55")
+    add(bytes([0x55, 0xAA] * 8), "alternating_55aa")
+    add(bytes.fromhex("00" * 8 + "ff" * 8), "half_zero_half_ones")
+    add(bytes.fromhex("ff" * 8 + "00" * 8), "half_ones_half_zero")
+    add(bytes.fromhex("8000000000000000" + "00" * 8), "single_msb_first_half")
+    add(bytes.fromhex("00" * 8 + "8000000000000000"), "single_msb_second_half")
+    add(bytes.fromhex("7f" + "00" * 15), "byte0_7f")
+    add(bytes.fromhex("00" * 8 + "01" + "00" * 7), "last_byte_01")
+    add(bytes.fromhex("0011223344556677") * 2, "repeated_8byte_record")
+
+    # --- the live challenge, in both orders ----------------------------
+    add(LIVE_WIRE_CHALLENGE, "live_wire_challenge",
+        "the 16 bytes the terminal sent over TCP (wire order)")
+    add(swap_words(LIVE_WIRE_CHALLENGE), "live_challenge_post_ntohl",
+        "same challenge after dwt_prf's per-word ntohl; this is f's input")
+
+    # --- live probe corpus (validates the direct call) -----------------
+    for name, wire, _expected in LIVE_PROBES:
+        add(swap_words(wire), name, "live TCP probe, post-ntohl input")
+
+    # --- single-bit flips of a baseline --------------------------------
+    base = bytes(range(16))
+    for byte_i in range(8):
+        for bit in range(8):
+            v = bytearray(base)
+            v[byte_i] ^= 1 << bit
+            add(bytes(v), "flip_first8",
+                f"ascending baseline, byte {byte_i} bit {bit}")
+    for byte_i in range(8, 16):
+        v = bytearray(base)
+        v[byte_i] ^= 0x01
+        add(bytes(v), "flip_second8",
+            f"ascending baseline, byte {byte_i} bit 0")
+
+    # --- per-record independence grid ----------------------------------
+    rng = random.Random(0x771)
+    halves_a = [bytes(rng.randrange(256) for _ in range(8)) for _ in range(8)]
+    halves_b = [bytes(rng.randrange(256) for _ in range(8)) for _ in range(8)]
+    for h in halves_a:
+        add(h + bytes(8), "indep_a_zero")
+        add(h + b"\xff" * 8, "indep_a_ones")
+    for h in halves_b:
+        add(bytes(8) + h, "indep_b_zero")
+        add(b"\xff" * 8 + h, "indep_b_ones")
+
+    # --- random inputs --------------------------------------------------
+    for _ in range(48):
+        add(bytes(rng.randrange(256) for _ in range(16)), "random")
+
+    # --- two deliberate duplicates (in-run determinism) -----------------
+    add(bytes(16), "zero_duplicate", "repeat of the first vector")
+    add(bytes(range(16)), "ascending_duplicate", "repeat of ascending")
+
+    return items
+
+
+# --------------------------------------------------------------------------
+# emulator run
+# --------------------------------------------------------------------------
+
+def run_once(tag: str, inputs: list[str]) -> tuple[dict[str, str], Path]:
+    run_dir = EVID / tag
+    if run_dir.exists():
+        shutil.rmtree(run_dir)
+    (run_dir / "nvram").mkdir(parents=True)
+    in_path = run_dir / "in.txt"
+    out_path = run_dir / "out.txt"
+    in_path.write_text("\n".join(inputs) + "\n")
+
+    env = dict(os.environ)
+    env.update({
+        "VT1200_SKIP_LEVEL1": "1",
+        "VT1200_ORACLE_IN": str(in_path),
+        "VT1200_ORACLE_OUT": str(out_path),
+        "VT1200_ORACLE_START": str(START_FRAME),
+        "VT1200_ORACLE_TAG": tag,
+    })
+    cmd = [
+        MAME, "vt1200",
+        "-rompath", str(ROMPATH),
+        "-video", "none", "-sound", "none", "-nothrottle",
+        "-debug", "-debugger", "none", "-debuglog",
+        "-nvram_directory", str(run_dir / "nvram"),
+        "-autoboot_script", str(LUA), "-autoboot_delay", "0",
+    ]
+    t0 = time.time()
+    with open(run_dir / "stdout.log", "w") as log:
+        proc = subprocess.run(cmd, cwd=run_dir, env=env, stdout=log,
+                              stderr=subprocess.STDOUT, timeout=1800)
+    dt = time.time() - t0
+    print(f"[{tag}] mame exit={proc.returncode} wall={dt:.1f}s")
+    if not out_path.exists():
+        raise SystemExit(f"[{tag}] no output file; see {run_dir}/stdout.log")
+    result = {}
+    for line in out_path.read_text().splitlines():
+        parts = line.split()
+        if len(parts) == 3:
+            result[parts[1].lower()] = parts[2].lower()
+    print(f"[{tag}] {len(result)} outputs")
+    return result, run_dir
+
+
+# --------------------------------------------------------------------------
+# intermediate-state capture (one 8-byte record at a time)
+# --------------------------------------------------------------------------
+
+STAGE_RECORDS = [
+    "0000000000000000",
+    "ffffffffffffffff",
+    "0001020304050607",
+    "8dec2cf3d0ea0000",
+    "c0a863028eec24f3",
+    "0011223344556677",
+]
+
+
+def run_stages() -> Path | None:
+    """Run the per-record stage capture; returns the combined output path."""
+    run_dir = EVID / "stages"
+    if run_dir.exists():
+        shutil.rmtree(run_dir)
+    (run_dir / "nvram").mkdir(parents=True)
+    in_path = run_dir / "in.txt"
+    out_path = run_dir / "out.txt"
+    in_path.write_text("\n".join(STAGE_RECORDS) + "\n")
+    env = dict(os.environ)
+    env.update({
+        "VT1200_SKIP_LEVEL1": "1",
+        "VT1200_ORACLE_IN": str(in_path),
+        "VT1200_ORACLE_OUT": str(out_path),
+        "VT1200_ORACLE_START": str(START_FRAME),
+        "VT1200_ORACLE_TAG": "stages",
+    })
+    cmd = [
+        MAME, "vt1200", "-rompath", str(ROMPATH),
+        "-video", "none", "-sound", "none", "-nothrottle",
+        "-debug", "-debugger", "none", "-debuglog",
+        "-nvram_directory", str(run_dir / "nvram"),
+        "-autoboot_script", str(STAGE_LUA), "-autoboot_delay", "0",
+    ]
+    with open(run_dir / "stdout.log", "w") as log:
+        subprocess.run(cmd, cwd=run_dir, env=env, stdout=log,
+                       stderr=subprocess.STDOUT, timeout=900)
+    if not out_path.exists():
+        print(f"[stages] no output; see {run_dir}/stdout.log")
+        return None
+    combined = EVID / "stages.txt"
+    combined.write_text(out_path.read_text())
+    print(f"[stages] wrote {combined}")
+    return combined
+
+
+# --------------------------------------------------------------------------
+# checks and characterisation
+# --------------------------------------------------------------------------
+
+def hamming(a: bytes, b: bytes) -> int:
+    return sum(bin(x ^ y).count("1") for x, y in zip(a, b))
+
+
+def main(argv):
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--quick", action="store_true", help="one boot only")
+    ap.add_argument("--no-run", action="store_true",
+                    help="reuse dwt/evidence/oracle/run*/out.txt")
+    ap.add_argument("--skip-stages", action="store_true",
+                    help="do not run the intermediate-state capture")
+    args = ap.parse_args(argv[1:])
+
+    EVID.mkdir(parents=True, exist_ok=True)
+    items = build_vectors()
+    inputs = [h for h, _k, _n in items]
+    print(f"{len(items)} vectors")
+
+    if args.no_run:
+        runs = {}
+        for tag in ("runA", "runB"):
+            p = EVID / tag / "out.txt"
+            if not p.exists():
+                raise SystemExit(f"missing {p}")
+            runs[tag] = {}
+            for line in p.read_text().splitlines():
+                parts = line.split()
+                if len(parts) == 3:
+                    runs[tag][parts[1].lower()] = parts[2].lower()
+        run_dirs = {"runA": EVID / "runA", "runB": EVID / "runB"}
+    else:
+        runA, dirA = run_once("runA", inputs)
+        run_dirs = {"runA": dirA}
+        if args.quick:
+            runs = {"runA": runA}
+        else:
+            runB, dirB = run_once("runB", inputs)
+            run_dirs["runB"] = dirB
+            runs = {"runA": runA, "runB": runB}
+
+    # Assemble vectors; an input is only emitted once both boots agree.
+    vectors = []
+    missing = []
+    for i, (h, kind, note) in enumerate(items):
+        outs = [r.get(h) for r in runs.values()]
+        if any(o is None for o in outs):
+            missing.append((i, h, kind))
+            continue
+        if len(set(outs)) != 1:
+            print(f"MISMATCH boot outputs for {h}: {outs}")
+            continue
+        meta = {"stage": "full", "boot": len(runs), "kind": kind, "index": i}
+        if note:
+            meta["note"] = note
+        vectors.append({"input_hex": h, "output_hex": outs[0], "meta": meta})
+
+    if missing:
+        print(f"WARNING: {len(missing)} vectors missing from a run: {missing[:5]}")
+    VECTORS_JSON.write_text(json.dumps(vectors, indent=1) + "\n")
+    print(f"wrote {VECTORS_JSON} ({len(vectors)} vectors)")
+
+    # ---------------- intermediate states ------------------------------
+    stage_path = None
+    if not args.no_run and not args.skip_stages:
+        stage_path = run_stages()
+    if stage_path is None:
+        stage_path = EVID / "stages.txt" if (EVID / "stages.txt").exists() else None
+
+    # ---------------- cross-check against the live TCP probes -----------
+    by_input = {v["input_hex"]: v["output_hex"] for v in vectors}
+    live_ok, live_bad = 0, []
+    for name, wire, expected in LIVE_PROBES:
+        h = swap_words(wire).hex()
+        got = by_input.get(h)
+        if got is not None and got[:16] == expected:
+            live_ok += 1
+        else:
+            live_bad.append((name, h, expected, got))
+    print(f"live-probe agreement: {live_ok}/{len(LIVE_PROBES)}")
+    for row in live_bad:
+        print("  MISMATCH", row)
+
+    # ---------------- characterisation ---------------------------------
+    report = {}
+
+    # determinism across boots
+    common = set(runs["runA"]) & set(runs.get("runB", runs["runA"]))
+    diffs = [h for h in common if len(runs) > 1 and
+             runs["runA"][h] != runs["runB"][h]]
+    report["determinism"] = {
+        "boots": len(runs),
+        "inputs_compared": len(common),
+        "differences": len(diffs),
+        "first_differences": diffs[:5],
+    }
+
+    # per-record independence from the dedicated grid
+    def out(h):
+        return by_input.get(h)
+
+    indep_errors = []
+    for h in [v["input_hex"] for v in vectors if v["meta"]["kind"] == "indep_a_zero"]:
+        first = bytes.fromhex(h)[:8]
+        o_zero = out((first + bytes(8)).hex())
+        o_ones = out((first + b"\xff" * 8).hex())
+        if o_zero and o_ones and o_zero[:16] != o_ones[:16]:
+            indep_errors.append(("a", h))
+    for h in [v["input_hex"] for v in vectors if v["meta"]["kind"] == "indep_b_zero"]:
+        second = bytes.fromhex(h)[8:]
+        o_zero = out((bytes(8) + second).hex())
+        o_ones = out((b"\xff" * 8 + second).hex())
+        if o_zero and o_ones and o_zero[16:] != o_ones[16:]:
+            indep_errors.append(("b", h))
+    report["per_record_independence"] = {
+        "errors": len(indep_errors),
+        "examples": indep_errors[:5],
+    }
+
+    # permutation / duplicates / fixed points
+    distinct_inputs = {}
+    for v in vectors:
+        if v["meta"]["kind"].startswith(("random", "flip", "indep")):
+            distinct_inputs.setdefault(v["input_hex"], v["output_hex"])
+    out_vals = list(distinct_inputs.values())
+    report["permutation"] = {
+        "distinct_inputs": len(distinct_inputs),
+        "distinct_outputs": len(set(out_vals)),
+        "fixed_points": [v["input_hex"] for v in vectors
+                         if v["input_hex"] == v["output_hex"]],
+    }
+
+    # avalanche: single-bit flips of the ascending baseline
+    base = bytes(range(16))
+    base_out = out(base.hex())
+    aval = []
+    record_leaks = 0
+    if base_out:
+        base_out_b = bytes.fromhex(base_out)
+        for v in vectors:
+            if v["meta"]["kind"] != "flip_first8":
+                continue
+            ob = bytes.fromhex(v["output_hex"])
+            aval.append(hamming(ob[:8], base_out_b[:8]))
+            if ob[8:] != base_out_b[8:]:
+                record_leaks += 1
+    report["avalanche"] = {
+        "samples": len(aval),
+        "mean_output_bits_changed_first_record": (
+            round(sum(aval) / len(aval), 3) if aval else None),
+        "min": min(aval) if aval else None,
+        "max": max(aval) if aval else None,
+        "second_record_changed": record_leaks,
+    }
+
+    # first/second half outputs are identical for a doubled record
+    doubled = out((bytes.fromhex("0011223344556677") * 2).hex())
+    report["record_is_repeated"] = bool(
+        doubled and doubled[:16] == doubled[16:])
+
+    # intermediate states: with dwt_prf's INIT(1) the two "font render" calls
+    # are memcpy (their tables @1C0220/@1C0240 are NULL), so feistel_in ==
+    # input and pre_final_render == output.
+    if stage_path and stage_path.exists():
+        rows = []
+        for line in stage_path.read_text().splitlines():
+            p = line.split()
+            if len(p) == 5:
+                rows.append(p)
+        report["intermediate"] = {
+            "captured": len(rows),
+            "feistel_in_equals_input": all(r[2] == r[1] for r in rows),
+            "pre_final_render_equals_output": all(r[3] == r[4] for r in rows),
+            "file": str(stage_path.relative_to(PROJECT)),
+        }
+
+    # direction / convention notes are static; record the evidence sources
+    report["direction"] = {
+        "wire_challenge": LIVE_WIRE_CHALLENGE.hex(),
+        "challenge_post_ntohl": swap_words(LIVE_WIRE_CHALLENGE).hex(),
+        "before_transform": "buffer = received 16 bytes with each 32-bit word byte-swapped (dwt_prf ntohl, in place)",
+        "after_transform": "buffer = f(before) in place; dwt_prf memcmp's it against the host-order challenge words",
+        "pass_condition": "f(ntohl(reply_on_wire)) == host_order_challenge; reply = ntohl(f^-1(host_order_challenge))",
+    }
+    report["live_probe_agreement"] = {
+        "matched": live_ok,
+        "total": len(LIVE_PROBES),
+        "failures": live_bad,
+    }
+    report["vector_count"] = len(vectors)
+
+    (EVID / "characterisation.json").write_text(json.dumps(report, indent=2) + "\n")
+    print(json.dumps(report, indent=2))
+    return 0 if (not live_bad and not diffs and not missing) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))