Assets

File Status
hero.jpg Hero image — 1200×800, JPEG q88 progressive, 211 KB (cropped 3:2 from a 1200×960 master)

The three figures live in _includes/figures/ at the repository root, not here. They are inlined into the article by Liquid rather than loaded through <img>, because an external SVG can only see prefers-color-scheme — it would stay on the OS setting when a reader flips the site’s theme toggle. Inlined, their colours come from the site stylesheet’s --fig-* variables and follow the toggle.

File Figure
_includes/figures/accuracy-chart.svg Figure 1 — accuracy across the three samples
_includes/figures/ryuk-file-layout.svg Figure 2 — Ryuk on-disk layout before/after encryption
_includes/figures/xloader-layers.svg Figure 3 — XLoader’s six obfuscation layers

SVGs are hand-written and under 4 KB each. Colours come from the validated data-viz reference palette: a blue ordinal ramp for the accuracy bars (single series — length carries the data) and the fixed status palette elsewhere. Value labels use ink tokens, never the series colour.