Math and code rendering lab

Why this note exists

This post is a fixture for checking that the blog renders technical writing cleanly. It mixes inline math like $p_{hit} = 1 - p_{miss}$ with code blocks in several languages, tables, and display equations.

The examples are intentionally small and benign: enough structure to stress the typography without turning the post into a full implementation guide.

A tiny triage score

Suppose a reversing queue assigns each sample a rough priority from three signals:

Signal	Meaning	Range
$E$	Normalized byte entropy	$0 \le E \le 1$
$I$	Count of suspicious imports	$I \ge 0$
$S$	Static signature confidence	$0 \le S \le 1$

A compact scoring model might look like this:

$$R = \alpha E + \beta \log_2(I + 1) + \gamma S$$

The weights are useful only if they are explicit. A good starting point is:

$$\alpha + \beta + \gamma = 1,\qquad \alpha = 0.35,\quad \beta = 0.25,\quad \gamma = 0.40$$

TypeScript sketch

type SampleSignals = {
  entropy: number;
  importCount: number;
  signatureConfidence: number;
};

const weights = {
  entropy: 0.35,
  imports: 0.25,
  signature: 0.4,
} as const;

export function triageScore(sample: SampleSignals): number {
  const importSignal = Math.log2(sample.importCount + 1);

  return (
    weights.entropy * sample.entropy +
    weights.imports * importSignal +
    weights.signature * sample.signatureConfidence
  );
}

Rust parser stub

#[derive(Debug, Clone, Copy)]
struct Section {
    virtual_address: u32,
    virtual_size: u32,
    raw_size: u32,
}

impl Section {
    fn contains_rva(&self, rva: u32) -> bool {
        let end = self.virtual_address.saturating_add(self.virtual_size);
        rva >= self.virtual_address && rva < end
    }

    fn density(&self) -> f32 {
        if self.virtual_size == 0 {
            return 0.0;
        }

        self.raw_size as f32 / self.virtual_size as f32
    }
}

Byte windows

For simple byte-window analysis, define a window $W_i$ as the slice from offset $i$ to $i + n$. The mean byte value is:

$$\mu(W_i) = \frac{1}{n}\sum_{k=0}^{n-1} b_{i+k}$$

The variance gives a coarse signal for whether a region is flat, packed, or mixed:

$$\sigma^2(W_i) = \frac{1}{n}\sum_{k=0}^{n-1}\left(b_{i+k} - \mu(W_i)\right)^2$$

Python prototype

from __future__ import annotations

from dataclasses import dataclass
from statistics import mean, pvariance


@dataclass(frozen=True)
class WindowStats:
    offset: int
    mean: float
    variance: float


def scan_windows(blob: bytes, size: int = 64, step: int = 32) -> list[WindowStats]:
    windows: list[WindowStats] = []

    for offset in range(0, max(len(blob) - size + 1, 0), step):
        chunk = blob[offset : offset + size]
        values = list(chunk)
        windows.append(
            WindowStats(
                offset=offset,
                mean=mean(values),
                variance=pvariance(values),
            )
        )

    return windows

Register notes

Short assembly blocks should stay readable too. This one is just a placeholder for documenting calling-convention observations.

; Windows x64: rcx, rdx, r8, r9 carry the first four integer args.
push rbp
mov  rbp, rsp
sub  rsp, 20h

mov  rax, [rcx+18h]
test rax, rax
jz   short .missing

add  rsp, 20h
pop  rbp
ret

.missing:
xor  eax, eax
add  rsp, 20h
pop  rbp
ret

Repro log

Terminal transcripts should feel distinct from source code while still matching the theme.

$ npm run build

> blog@0.0.1 build
> astro build

generating static routes
complete

Closing

If this note looks clean, the post renderer is handling the common shapes of technical research notes: equations, typed snippets, tables, shell logs, and nested headings for the table of contents.