Atumos
Documentation.

Purpose

A reproducible NixOS-based security research environment for vulnerability discovery, reverse engineering, fuzzing, and low-level systems research. The documentation explains the project boundary, architecture, setup flow, operational model, security considerations, and known limitations.

Installation

Start from a clean, supported environment. Obtain the project source, verify the revision and inputs, and follow the project-specific bootstrap procedure. Do not execute unknown artifacts before inspecting them.

$ inspect source
$ verify revision and inputs
$ apply the documented setup
$ validate the resulting state

Architecture

Atumos uses NixOS to describe the research environment as code. Toolchains, dependencies, and utilities can be rebuilt from a known configuration instead of relying on an undocumented workstation.

Configuration

Configuration should be explicit and version-controlled wherever practical. Keep environment-specific secrets, credentials, and private operational values outside the public configuration. The goal is a small, reviewable set of inputs.

Security model

Atumos is a research project, not a blanket security guarantee. Establish trust boundaries, minimize exposed interfaces, isolate untrusted inputs, and verify the resulting state. Only test software you are authorized to analyze.

Operational constraints

• Only test software you are authorized to analyze.
• Keep untrusted samples isolated.
• Record versions and hashes for meaningful reproduction.
• Prefer disposable targets when executing hostile binaries.

Operations

Use the documented workflow to create, inspect, reset, and reproduce the environment. Record versions, configuration changes, test inputs, and relevant observations so another operator can understand the result.

Troubleshooting

When something fails, first verify the environment, versions, inputs, and network boundaries. Reduce the problem to the smallest reproducible case, capture logs, and compare against a known-good configuration.

First checks

• Confirm the documented version and environment.
• Check logs and system state before changing multiple variables.
• Reproduce from a clean state where possible.