Devlog 1: Trawl, and the bug I caught before it cost me a week
Trawl is a CTF toolkit that runs in the browser. Drop a file in, it runs every check I’ve written at once, and tells you what looked wrong. Nothing uploads anywhere, because there is no server to upload to.
It did not start out this big. The first version was only a steganography tool, because that is the category I keep landing in and the workflow is tedious: exiftool, then strings, then binwalk, then zsteg, then StegSolve, a Java applet from 2011. Five tools, five interfaces, all of them installed before you can look at a single PNG. Plenty of beginners skip forensics entirely for that reason.
A couple of weeks in I realized the same complaint covers almost every CTF category, so the scope moved. Trawl is the hub. Cuttlefish is the steganography module inside it, and the only one that exists so far. A trawl is a net you drag through water to see what comes up. Cuttlefish hide by rewriting their own surface, which is what LSB embedding does to an image.
What Cuttlefish runs now
Eight checks, PNG only: pixel decode with verification, chunk walk, CRC validation, post-IEND data, tEXt/zTXt/iTXt metadata, ASCII strings, flag-shape scan, and an LSB sweep across channel order, bit plane and bit order.
In the screenshot one of the eight fired. The sweep pulled testCTF{hello} out of RGB, bit 0, MSB first. One of 42 combinations carried anything readable.
The bug I would not have found without testing for it
Before writing any analysis I wrote a single test: build a PNG with a known pattern in the low bits, decode it through the browser, check the bits survive.
They don’t, by default. Canvas alpha premultiplication and colour management both rewrite pixel values slightly. For ordinary image work nobody notices. For steganography it destroys exactly the data you are looking for, and every detector downstream would have been measuring noise while looking completely functional.
The fix is passing colorSpaceConversion: 'none' and premultiplyAlpha: 'none' to createImageBitmap. Cuttlefish now reports the decode step as verified so I can confirm the guarantee held for the file in front of me. Had I built the sweep before checking, I would have spent days debugging math that was already correct.
On the Rust
The core is Rust compiled to WASM, running in a Web Worker, partly because the sweep is real compute and JavaScript stutters on it, partly because I wanted to learn Rust properly. I wrote the detector logic myself. AI helped me refactor it and add comments, which I am noting because it is true, and because the parts I struggled through are the parts I actually understand now.
Next
The bit-plane wall: all 8 planes across every channel rendered at once, so an anomalous plane becomes something you see rather than something you brute-force into.
Cuttlefish is not finished. The sweep only handles PNG, there is no bit-plane view, and no statistical detection at all yet. What I have proves the pipeline runs end to end on a flag I planted myself, which is a real milestone and also not much more than that. Trawl has exactly one module, which makes “hub” a generous word for it right now.
