Natorion — a v12 Reverse-Engineering Case Study

Live site: bradleyhomelinuxnet-prog.github.io/NatorionCipherPredictiveEngine — three browser apps, the report and the Hardened Engine Lab. Nothing to install, and nothing leaves your machine.

A white-box reverse-engineering study of the original v12, an offline Electron date-projection / cycle-prediction tool, taken apart as an educational study of .exe packaging and Electron attack surface — then rebuilt more safely.

Authorization. This is the owner’s own software, studied with permission for a portfolio write-up. All work is white-box on artifacts in this repo; nothing here targets third-party systems.

The apps

App	What it is	Open
Natorion Cipher · natorion/	The flagship: the v12 engine rebuilt front-end-only and joined to the Chronicon's clocks, cycles and calendars, with a Studio that writes an animated-documentary production package (script, look cards, image and animation prompts, thumbnail, upload text) from the numbers.	live · quick start · manual
Natorion Web · web/	The same v12 engine with a new interface and no Chronicon: plain HTML, CSS and JavaScript, no build step. The ten extra operations and the ten Mirrors are one click away.	live · README · how it works
The original v12, in a browser · ophis/	The original .exe's own renderer, copied out of app.asar, with Electron replaced by a small browser bridge. It behaves like the desktop app, including its new Function() evaluator, so open only .oph files you trust. The bridge saves only to files you pick, or as a download.	live · README

Both rebuilds parse formulas instead of running them as code, and each is checked against the original v12 engine by a parity test that runs both on the same events and compares every result (see Tests). Natorion Cipher and Natorion Web also open straight from their index.html with no server; the ophis/ build wants one for PDF export (see its README). The landing page is index.html; .github/workflows/pages.yml publishes the site on every push to main.

---

What Natorion is

You give it ≥2 anchor dates (X-Dates); it counts the whole days between each pair (Y), runs a table of small formulas that turn Y into day-offsets, and projects Z-Dates that it scores against resonance number-sets (“MSRF”) and bundled eclipse/moon tables. It’s Gann-style cycle work in astronomical dress — fully offline, no live data, no telemetry. Branded Natorion; the codebase calls itself the original v12.

The headline finding

The app is un-obfuscated Electron 39 and ships its own source, so a full read was possible. A crafted .oph preset chains to host code execution:

malicious .oph  →  operation string hits new Function()  →  renderer code execution
   (open/recalc)     (math.js validates a *stripped* string, not the compiled body;
                      v12 GUI defaults to the permissive LOOSE mode)
                →  electronBridge.autoSaveToFile(path, data)  →  fs.writeFile, NO path check
                →  drop payload in the Startup folder  →  code execution at next login

nodeIntegration:true is confirmed (main.js:367) — recovered by extracting the Electron main process from inside the shipped .exe (see METHOD.md). The v9 pass could only infer it.

This is the beginning of the README. Read the rest at the original. Read the full README ↗