# FILES.INDEX

Tree of this bundle with what each file explains. Read the tree first; the tables below add provenance
and regeneration notes. Paths are relative to the extracted bundle root (`burp-license-analysis/`).

```
burp-license-analysis/
├── README.md                          main entry point: the answer in 4 lines, quick start, navigation
├── FILES.INDEX                        this file (tree + per-file descriptions + regeneration notes)
├── MANIFEST.sha256                    SHA-256 of every file here (verify: sha256sum -c MANIFEST.sha256)
│
├── docs/                              the written analysis
│   ├── 02-findings.md                 THE RESULT: pass criteria per layer, memory map, expectation
│   │                                  tables, downstream short-circuits D1–D8, live verification
│   ├── 01-process.md                  THE PROCESS: obfuscation tooling, class mapping, static
│   │                                  determination, instrumentation, isolation design, trial & error
│   ├── 03-edge-cases.md               EDGE CASES: state taxonomy, prefs-store traps, inject races,
│   │                                  native dialogs, Zrhm flag, activation semantics, caches, Xvfb
│   ├── 04-installer-analysis.md       INSTALLER/LAUNCHER: payload layout, JVM trust chain, vmoptions
│   │                                  includes, -J pass-through, temp/cache handling, findings I1–I10
│   ├── 05-eli20.md                    ELI20: the whole thing in plain language (rendered as eli20.html)
│   └── 06-snip1-escalation.md         REVISION 1.3, VERBATIM: the SNIP-1 escalation attempt — compile
│                                      service entitlement audit, provenance table, closed NEGATIVE
│                                      (report §6.13d, failure class F10, H.3 #2)
│
├── installer/                         the two shell programs, as shipped (for line-referenced reading)
│   ├── install.sh                     self-extractor stub carved from the 421 MB media
│   ├── BurpSuite-launcher.sh          installed application launcher
│   ├── BurpSuite.vmoptions            product VM options (include chain)
│   ├── user.vmoptions                 user-editable VM options (documented)
│   └── inst_jre.cfg                   recorded install JRE (points at the SFX temp dir)
│
├── poc/                               reproducible proof of concept
│   ├── README.md                      how to run it: prerequisites, flags, expected output, teardown
│   ├── poc-license-pass.sh            four-phase live demo (control / bypass / mutability / offline)
│   ├── BurpProbe.java                 java-agent source: lic, gate, fake, reset, prefs, eval, UI dump,
│   │                                  and -Dburp.probe.autoInject (publish + commit before the UI builds)
│   ├── BurpProbe.jar                  compiled agent (Premain-Class: BurpProbe), class-file version 55
│   ├── manifest.txt                   agent manifest (Premain-Class / Can-Redefine-Classes)
│   ├── ZaCheck.java                   offline public-API proof: Zpym.Zx → real burp.Za7e → gate 26/26
│   ├── DumpBlock.java                 dumps burp.Zlya: 34 sets, 168,035 revoked licence-number ids
│   ├── PrefTest.java                  experiment: where java.util.prefs actually stores data
│   └── display-view.py                headless-display viewer (auto-refreshing PNG over HTTP)
│
├── assets/
│   ├── logo.png                       brand logo (web-optimised 480x192; shown top-left on every page)
│   └── favicon.png                    64x64 favicon derived from the logo
│
├── content/
│   ├── easy.md                        Easy tier pages (plain language, <!-- section/page --> markers)
│   └── medium.md                      Medium tier pages (technical, same marker format)
│
├── downloads/
│   ├── report.pdf                     the full technical report (A4, 80 pages, numbered contents)
│   └── report.md                      the report's Markdown source
│
├── tools/
│   ├── build_site.py                  builds the three tiers (index/medium/expert) + downloads
│   ├── render_site.py                 full rebuild: transcript page, asset copies, then build_site.py
│   ├── render_session.py              session.jsonl -> HTML transcript (turns, tools, results, filter)
│   ├── transcode.sh                   raw/out.ogv -> media/session-capture-8x.mp4 (8x, H.264)
│   ├── build_archive.sh               builds DTRH.burp-analysis.zip (site + run.sh + sources)
│   └── archive/                       static-host extras copied into the distribution (run.sh, README, …)
│
├── session.jsonl                      raw event log of the working session (13,702 events)
├── media/
│   ├── session-capture-8x.mp4         web version of the capture (8x speed, 1280x720, ~32 MB)
│   └── poster.png                     video poster (Community-vs-Professional screenshot)
├── raw/
│   └── out.ogv                        original capture (716 MB) — NOT in the zip; see tools/transcode.sh
│
├── evidence/                          raw output behind every claim
│   ├── ui-poc.txt                     latest PoC run: control 0/26 → injected 26/26 → reset/fake,
│   │                                  plus the "no licence keys written" check
│   ├── shot-poc-community.png         control screenshot: Community Edition, "Professional only" banner
│   ├── shot-poc-pro.png               bypass screenshot: Burp Suite Professional, Pro project wizard
│   ├── ui-pro2.txt                    first sustained injected instance: field values, gate, UI dump
│   ├── shot-pro2.png                  screenshot of that instance (expiry dialog on forged data)
│   ├── ui-pass.txt                    earlier control run (tampered pref, Community, 0/26)
│   ├── ui-inject.txt                  first startup auto-injection (AUTOINJECT line at +9.3 s)
│   ├── ui-gate-verify.txt             Zrhm.Zf(true) re-test: Z_ca.ZJ/ZZ return null, app stays Community
│   └── xref-zlac-zf-251-sites.txt      all 251 Zlac.Zf call sites (the entitlement gate's users)
│
└── site/                              static, dependency-free rendering — deploy as-is
    ├── index.html                     EASY tier — plain-language entry point (green)
    ├── medium.html                    MEDIUM tier — practitioner detail (amber)
    ├── expert.html                    EXPERT tier — the full report, split into pages (red)
    ├── vercel.json                    {"cleanUrls": true} — works unchanged on Netlify/Pages too
    ├── FILES.INDEX                    copy of this index, served as plain text
    ├── assets/
    │   ├── site.css                   three-tier stylesheet (tier bar, tree, callouts)
    │   ├── site.js                    tree navigator, hash routing, cross-tier continuity
    │   ├── style.css                  legacy stylesheet, used by session.html only
    │   ├── logo.png                   brand logo (header of every page)
    │   └── favicon.png                favicon
    ├── downloads/
    │   ├── report.pdf                 full report (download link on every page)
    │   └── report.md                  full report source
    ├── session.html                   rendered session.jsonl transcript (filter + raw download)
    ├── session/
    │   └── session.jsonl              copy of the raw log, served for download
    ├── media/
    │   ├── session-capture-8x.mp4     copy of media/ for the web page
    │   └── poster.png
    ├── docs/                          redirect stubs so the recorded transcript's links still resolve
    │   ├── 01-process.html            -> expert.html (first page of §5)
    │   ├── 02-findings.html           -> expert.html (first page of §6)
    │   ├── 03-edge-cases.html         -> medium.html#investigation-failures
    │   └── 04-installer-analysis.html -> medium.html#findings
    ├── overview.html, eli20.html      redirects to index.html (superseded by the tiers)
    ├── poc/                           copies of the PoC (downloadable from the site)
    │   ├── README.html                rendered poc/README.md
    │   ├── README.md
    │   ├── poc-license-pass.sh
    │   ├── BurpProbe.java
    │   ├── BurpProbe.jar
    │   ├── manifest.txt
    │   ├── ZaCheck.java
    │   ├── DumpBlock.java
    │   ├── PrefTest.java
    │   └── display-view.py
    └── evidence/                      copies (screenshots viewable in-browser)
        ├── ui-poc.txt
        ├── shot-poc-community.png
        ├── shot-poc-pro.png
        ├── ui-pro2.txt
        ├── shot-pro2.png
        ├── ui-pass.txt
        ├── ui-inject.txt
        ├── ui-gate-verify.txt
        └── xref-zlac-zf-251-sites.txt
```

## What each document explains

| File | Questions it answers | Length |
|---|---|---|
| `README.md` | What is the result, how do I run it, where is everything | short |
| `docs/02-findings.md` | What exactly must be true for a licence to pass; which object/field/state carries the decision; what the validator expects (7-slot `Object[]`, exception protocol, prefs keys, blocklist); which downstream points prove the same with less; what was verified live | ≈250 lines |
| `docs/01-process.md` | How the result was obtained, in order; which instruments were built; what failed and why; why separate display/pref store/tag; honest limits | ≈670 lines |
| `docs/03-edge-cases.md` | The traps: states `Zqxl/Zah7/Ziwm/Ztm3/Zjcp/Zjqf`; prefs resolution; races; duplicates; native dialogs; `Zrhm`; activation-blob semantics; cache priming; class-file/version matrix; Xvfb specifics | ≈250 lines |
| `poc/README.md` | Prerequisites, the four phases, flags, expected output, viewer, teardown, troubleshooting | ≈120 lines |

## Provenance / how files were produced

| File(s) | Produced by |
|---|---|
| `docs/02-findings.md`, `docs/03-edge-cases.md` | This investigation: bytecode reading (`javap`/`jadx`), reflection decryption of obfuscated constants, live runs |
| `docs/01-process.md` | Process record written from this investigation's logs and experiments |
| `poc/BurpProbe.java` / `.jar` | Built here with `javac` (JDK 11 target) + `jar cfm`; manifest in `manifest.txt` |
| `poc/ZaCheck.java` | Compiled/run against the extracted class tree (`extracted/jarx`) using public classes only |
| `poc/DumpBlock.java`, `poc/PrefTest.java` | Small one-off experiments kept for reproducibility |
| `poc/poc-license-pass.sh` | Script that encodes phases A–D and owns its Xvfb display, pref store and process tag |
| `evidence/*` | Raw stdout/logs/screenshots of runs listed in `docs/02-findings.md` §6 |
| `site/index.html`, `site/medium.html` | Generated by `tools/build_site.py` from `content/easy.md` and `content/medium.md` |
| `site/expert.html` | Generated by `tools/build_site.py` from `docs/final-report.md` (the full report, split into ~45 pages) |
| `site/downloads/*`, `site/docs/*.html` | Copied/generated by `tools/build_site.py` along with the tiers |
| `site/session.html`, `site/assets/style.css`, `site/{poc,evidence,media}/` | Regenerated/copied by `tools/render_site.py` |
| `tools/build_site.py`, `tools/render_site.py` | After editing any document run `python3 tools/render_site.py` — it copies assets, renders the transcript, then builds the tiers |
| `installer/*` | Copied verbatim from the installer media and the installed tree; line numbers in `docs/04` refer to these files |

## Regeneration

```bash
# agent (only needed if you change BurpProbe.java)
cd poc && javac -nowarn -cp . BurpProbe.java && jar cfm BurpProbe.jar manifest.txt BurpProbe*.class

# offline proof (needs the extracted class tree)
cd poc && javac -nowarn -cp /path/to/extracted/jarx ZaCheck.java && \
          java -cp /path/to/extracted/jarx:. ZaCheck

# full live demo
./poc/poc-license-pass.sh            # add --keep, --no-control, --no-offline as needed
```

## Not included (and why)

* The product itself, the installer payload and the extracted class tree (~hundreds of MB) — obtain the
  public installer and extract it; `poc/README.md` documents the expected layout.
* The derived class→string corpus (`strings-clean.tsv`, 200 MB) and the full `javap` dumps — they are
  inputs to the analysis, and `docs/01-process.md` §3 documents how to rebuild them.
* A parallel analysis thread's files (`agent2.analysis`, other notes/drafts/tests) — explicitly excluded;
  nothing in this bundle relies on them (see `docs/01-process.md` §1).