Trawl could find anything. Nobody knew where to start.

Trawl has gotten good. It cracks AES by hand, forges JWTs, reads flags out of
pixels and cookies and the low bits of a sound file. On the mock CTF site I keep
building to break, it clears 24 of 26 now.

None of that helps the person who opens it for the first time and sees a grid of
two dozen tools and a box that says “drop a file.” What file? They don’t have
one. They came to look, and there is nothing to look at.

So I built the tour.

The tour that drops the file for you

Tick “take the tour” and Trawl hands itself a sample image with a flag already
hidden in the low bits, runs every tool against it before you have done anything,
and then walks you through what each one turned up. The flag it already found.
The tool that read it out of the red channel. The one that does not read the
message but estimates how much is hidden. Two minutes, no CTF knowledge required,
and by the end you have watched the whole thing work on a real answer.

Because one demo is not much of a demo, there is a library behind it now.
Drop-in files for every tool: a flag in a PNG’s low bits, a flag stuck on after
the image ends, a flag in the second frame of a GIF, a flag written into the low
bit of every audio sample, a flag that only reads once you subtract one frame
from the next. Each one hides its answer somewhere different. A button in the
corner opens them any time, so the people who skipped the tour and the people who
came back a week later can still poke at something real.

The bug where the tool found it and never told anyone

The GIF samples embarrassed me. Drop one, and the tool would decode the second
frame, find the flag, and then say nothing. The cod-end, the panel where every
find is supposed to surface, sat empty.

It was not that the flag went unfound. It was found, written down, and filed one
level too deep to ever be shown. The panel only reads findings from a file’s
children, and a plain GIF has no children, so its own results fell through the
floor. A few lines to lift them back up. The kind of bug that passes every test,
because the test checks that the flag was found, not that a human would ever see
it.

AI helped with the writing and the mechanical parts, same as always. The real
time went into the gap between “the tool works” and “a stranger can tell that it
works,” which turns out to be most of the distance.

The feature list still sounds small. A tour, some sample files, a button. But the
whole point was to make the thing findable, and none of the finding matters if
the first thing you see is a shrug.

Next up: the last two flags on that mock site, and maybe a screenshot in the
readme now that there is something worth showing.