Classroom Public page

Week 12: Capstone + Bridge

1,070 words

You have covered binary, encoding, logic, circuits, CPU architecture, the Linux shell, Git, and networking. Week 12 is where it becomes one coherent thing: you decode a real file, byte by byte, explain exactly what each byte means, and write it up. Then we close with a map of where each FND-101 skill leads next.

Theme

The capstone is a "decoded artifact": you choose a small real-world binary file, identify its format, read the format specification, and annotate the file's bytes in a written report. Every byte has a meaning. You explain the meaning of each one.

This is not a programming project. You do not write code that parses the file. You read the raw bytes with xxd, look up what the specification says they mean, and write plain English explanations. That is the core skill FND-101 was building toward: the ability to read a byte sequence with understanding.

Reading list (~1 hour)

  1. Reread your capstone specification file (CAPSTONE.md) carefully; it specifies the deliverables and grading criteria
  2. Choose a target file format and find its public specification:
    • PNG: http://www.libpng.org/pub/png/spec/iso/index-object.html (the chunk structure starting at §4)
    • ZIP: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (the local file header at §4.3)
    • PDF: https://pdfa.org/norm-refs/PDF32000_2008.pdf (the file header and cross-reference table, §7.5)
    • GZIP: RFC 1952 at https://www.rfc-editor.org/rfc/rfc1952 (the member structure, §2.2)
  3. Read the specific section of the specification that covers the file header, not the full document

Lecture outline (~2 hours)

Section 1: Closing lecture -- what you can do now

By the end of week 11, you can:

  • Read a hex dump and identify the encoding of every byte
  • Trace a Boolean expression through a truth table
  • Explain the fetch-decode-execute cycle step by step
  • Navigate a Unix filesystem and write a bash script
  • Commit changes to a Git repository and resolve a merge conflict
  • Run traceroute, interpret the hop pattern, and use curl to inspect HTTP responses

None of this was available to you 12 weeks ago. You now have the working knowledge that sits below every downstream course.

Section 2: What each FND-101 topic feeds into

Binary and hex (Weeks 1-2)

  • NET-101: reading packet captures requires fluent hex interpretation; every protocol header is a hex dump
  • SEC-101: malware samples, forensic images, and encrypted data are all hex dumps you will need to read
  • RE-011: disassembly output includes machine code bytes; you need hex fluency to follow it
  • CSA-101: every instruction byte your RV32I-Lite CPU fetches is a hex value you defined in week 1's encoding

Boolean logic and circuits (Weeks 3-4)

  • CSA-101 Ch 1-2: you design AND, OR, NAND gates and adder circuits in Verilog; this week's paper designs are the conceptual prerequisites
  • CSA-101 Ch 5: your FPGA ALU is a synthesized version of the 4-bit ripple-carry adder you traced in week 4

Memory and state (Week 5)

  • CSA-101 Ch 3: you implement flip-flops and registers in Verilog; the timing diagrams from Lab 5.1 are directly applicable
  • CSA-201: pipeline registers, hazard detection, and forwarding paths are flip-flop arrays

Computer architecture (Week 6)

  • CSA-101 Ch 5: you build the CPU whose block diagram you drew this week, in Verilog, running on an FPGA
  • CSA-201: you extend that CPU with pipelining, caches, and a memory hierarchy

Fetch-decode-execute (Week 7)

  • CSA-101 Ch 4-5: the RV32I-Lite instruction encoding and the CPU implementation; FDE is the organizing principle throughout
  • RE-011: reverse engineering is reading what a CPU was told to do by examining its byte stream

Linux shell (Weeks 8-9)

  • Every downstream course assumes shell fluency; lab submissions are via Git (shell); course tools run from the terminal
  • SEC-101 and NET-101 labs are shell-driven entirely (Wireshark can be launched from the shell; tcpdump is shell-only)

Git (Week 10)

  • All course labs across the pipeline are committed to Git repositories; Git is the universal submission mechanism

Networking (Week 11)

  • NET-101: packet capture, protocol analysis, and network scripting are all built on the mental model from week 11
  • SEC-101: understanding the attack surface requires understanding the network layer

Section 3: The capstone in context

The capstone asks you to decode one small file completely. This is the foundational skill underlying:

  • Forensics (analyzing a disk image or memory dump)
  • Reverse engineering (understanding a file format an attacker is using)
  • Protocol analysis (reading a captured packet byte by byte)
  • Vulnerability research (understanding what format a program parses, then finding what happens with malformed input)

You are not being asked to do any of those things yet. You are being asked to do the one thing they all require: read bytes, consult a spec, and explain what you find.

Labs (~90 minutes)

Capstone: (CAPSTONE.md)

  • Choose your file format (PNG, ZIP, GZIP, or another approved format)
  • Produce a hex dump: xxd your_file | head -40
  • Annotate the first 16-32 bytes against the format specification
  • Write the decoding report: 400-800 words, structured per CAPSTONE.md
  • Commit the report, the annotated hex dump, and the original file to your Git repository

This is the full capstone week; see CAPSTONE.md for the complete specification.

Independent practice (capstone week)

The independent practice time this week is entirely for the capstone. Recommended day-by-day approach:

  • Day 1-2: choose format; read the specification section; produce the hex dump; start annotating
  • Day 3-4: complete the byte-by-byte annotation; write the first draft of the report
  • Day 5: revise the report; verify the Git repository is complete; check against the capstone checklist
  • Day 6: submit; revisit any week whose topic you still feel uncertain about

Reflection prompts (~30 minutes, final)

  1. What was the hardest part of FND-101 for you? Why?
  2. What was the most surprising thing you learned?
  3. Which downstream course are you most interested in taking next? What from FND-101 do you feel most prepared for?
  4. Before FND-101, how would you have answered the question "what is a computer?" How would you answer it now?
  5. Your capstone decoded one file. What other file formats would you want to decode, now that you know how?

Where to go next

The academy's recommended next courses for FND-101 graduates:

  • NET-101 (Networking I): packet capture, protocol analysis, and network scanning. Builds directly on weeks 2, 11.
  • SEC-101 (Cybersecurity Principles): CIA triad, threat modeling, common vulnerability classes. Builds on weeks 1, 7, 11.
  • RE-011 (Introduction to Reverse Engineering): disassembly, binary analysis, format reversing. Builds on weeks 1-7.
  • CSA-101 (Computer Systems Architecture I): build a working CPU in Verilog. Builds on every week of FND-101.

You do not have to take them in any particular order. Pick the one that most interests you.