Source confidence: medium
See also: Deeper Dive — Who's Across the Table — forensics for the system trading against you →

Who's Across the Table — forensics for the system trading against you

Insight class: Life Leverage · Difficulty: Easy · Quality: 3/5 Connected entries: 9 · Tools: Cochlea, Ghidra, Python, REA, Raspberry Pi, React, Ubuntu, XGBoost

In short: Running this system measures the edge already being taken from you before you look for your own.

Key fact Detail
What it covers finance/trading, quant, security, video production
Tools Cochlea, Ghidra, Python, Raspberry Pi, REA
Posts covered 9 posts (1 S-tier, 4 A-tier) · top: Overnight vs intraday returns — Knuteson's… · REA MCP — agent-driven reverse engineering… · Katsuyama vs BATS on CNBC — the 'markets are…
Creators @7am.research, @ayoships, @backsla.sh
Sources dated Apr 2026 – Oct 2026
Difficulty Easy
Prompt system Run-it-yourself prompts
Last verified 2026-10-22

Thesis

Across the catalog, the systems you interact with are quietly optimizing against you: a puzzle game runs an on-device XGBoost model to time difficulty to your ad value, overnight and intraday returns run as a decades-long sawtooth, a bedroom spoofer tripped depth-reading algorithms in the 2010 Flash Crash, wash trading inflates crypto volume, and exchanges sold speed to HFTs. Agent-plus-Ghidra decompilation and cheap tick data mean one person can now audit the counterparty instead of guessing about it.

Why it matters

This is game theory made practical: before you look for edge, measure the edge that's already being taken from you — your fills, the hours you hold, the apps you pay. It's defensive leverage, and it often turns into an offensive idea, like simply holding overnight.

The evidence — connected entries

Block Blast reverse-engineered — on-device XGBoost rigs difficulty for ad revenue

Creator: @ayoships · Tier: B Tools: XGBoost

Block Blast decompiled — on-device model tuning difficulty to ad value, the clearest 'house edge' case

A reverse engineer found Block Blast runs a local XGBoost model on device signals (phone model, country, past ad revenue, vibration setting) to predict your ad value and adjust difficulty. Rules like 'Boost Then Kill' and 'High Value Ad Harvest' trigger a 'death algorithm' right when a pricey revive ad is ready. Full code evidence is promised later on the creator's site.

View original post

REA MCP — agent-driven reverse engineering with a Ghidra backend

Creator: @backsla.sh · Tier: A Tools: Ghidra, REA, Ubuntu

REA MCP — agent-driven Ghidra decompilation with cited evidence, the audit tool (authorized use only)

REA is an MCP server that lets an AI agent reverse engineer apps and stripped native binaries, with Ghidra doing the decompilation while the agent drives and cites evidence per call. The creator decompiled a closed-source program in three to four minutes on Ubuntu. Setup is deferred to a follow-up video.

View original post

Overnight vs intraday returns — Knuteson's 'Strikingly Suspicious' anomaly

Creator: @quantpapers · Tier: S

Knuteson's overnight/intraday sawtooth — a claim to replicate, not trust

Bruce Knuteson (ex-MIT physicist, D. E. Shaw) splits each day into close-to-open and open-to-close: Micron since 1990 is +138M% overnight and -99.9% intraday, and the same sawtooth shows in 21 indices (China reversed). His paper 'Strikingly Suspicious Overnight and Intraday Returns' rejects earnings and news as explanations and alleges large firms push prices at the open; it's a claim, not a proof.

View original post

Overnight return anomaly — most stock gains accrue close-to-open

Creator: @eliteoptionstrader2 · Tier: A

Second take on the overnight anomaly, with the retail-at-open mechanism

Cites research showing that across global markets most equity returns come overnight (close to next open) while intraday holding loses; the Micron example claims +138M% overnight vs −99% intraday on paper. Proposed mechanism: retail trades the open, institutions trade into the close. Paper not named; frictions and costs ignored.

View original post

2010 Flash Crash — how Navinder Sarao spoofed E-mini S&P futures

Creator: @thestockguytwitch · Tier: B

Spoofing and the Flash Crash — how depth-reading algorithms get gamed

Story of the May 6, 2010 Flash Crash (about 9% in minutes, $1T wiped then recovered), traced to Navinder Sarao spoofing E-mini S&P 500 futures from his bedroom with large sell orders he cancelled, tricking algos into selling. Good primer on spoofing and cascading algorithmic selling.

View original post

Crypto wash trading — Ben McKenzie doc on fake volume and pump schemes

Creator: @cbcgem · Tier: B

Wash trading — reported volume as the counterparty's marketing

Clip from the documentary 'Everyone Is Lying to You for Money' where an insider explains wash trading: one actor trading between two accounts to walk prices up, luring outsiders before dumping. The interviewee claims 90-95% of crypto volume is fake and fewer than 20 people control the market.

View original post

Katsuyama vs BATS on CNBC — the 'markets are rigged' HFT showdown

Creator: @itsfinancenote · Tier: A Tools: React

Direct feeds versus the SIP — who pays for speed

The March 31, 2014 CNBC clash where IEX's Brad Katsuyama (Flash Boys) accused exchanges of selling HFT advantages via direct feeds, co-location and complex order types, and BATS's Bill O'Brien was pressed on whether his matching engine priced off the slower SIP. BATS later corrected the record, and IEX's speed bump came out of this debate.

View original post

HFT short-term reversal — buy weekly losers, sell winners across 4,500 stocks

Creator: @7am.research · Tier: B

Breadth-based reversal — what the fast counterparty is actually doing to your weekly losers

A 60 Minutes clip with Manoj Narang describing a cross-sectional mean-reversion test: buy $5 of stocks down 5% last week, sell $10 of stocks up 10%, across the whole ~4,500-stock universe at once. Near 50% win rate per trade but no losing month thanks to breadth and speed, with Joe Saluzzi arguing it rigs the game.

View original post

Cochlea — Wi-Fi side-channel attack on Ring cameras

Creator: @bennjordan · Tier: A Tools: Cochlea, Python, Raspberry Pi

Encrypted traffic still leaks activity — the general lesson that timing and volume give intent away

Benn Jordan's Cochlea is a Python tool that runs on a Raspberry Pi with a monitor-mode Wi-Fi adapter and passively fingerprints encrypted traffic from cloud cameras like Ring. It detects when a camera sees motion and when the owner opens live view, logging to CSV, which shows how much activity leaks without breaking encryption.

View original post

Action sketch — how to implement this

Split two years of SPY and QQQ returns into close-to-open and open-to-close legs, then subtract realistic open-gap spreads to see whether the overnight leg survives costs. Export your own broker fills and compare each to the NBBO at the time, so you measure the price improvement or slippage you actually got. For one paid or free-to-play app you use, run REA MCP on your own install and list every model or rule that adapts to you (authorized analysis only). falsifier: if the overnight leg disappears after costs and your fills match or beat the NBBO, the counterparty isn't taking much from you at your size — move your effort to the strategy-loop dive.

Prerequisites

Key tools and resources

Creators to follow

Prompt system — run this yourself

Everything below is pasteable into Claude Code, Claude, or any agent. Use the one-shot when you want the whole result in one run; use the step prompts when you want to steer. Every step carries its own audit, and the gap audit at the end makes the agent find and fill what it missed.

Mission. Running this system measures the edge already being taken from you before you look for your own. It replicates the overnight-versus-intraday return split on SPY and QQQ with realistic costs and a control, measures your own broker fills against the national best bid and offer (NBBO), and, for one app you use, documents on your own install every model or rule that adapts to you, under authorized analysis only. It is for an individual trader and app user. Done means three reports with reproducible code, a paper-only verdict on the overnight leg, a slippage number in basis points, and an app findings list where every claim cites decompiled evidence.

1 · Deeper, not bigger

Before running anything, make the task deeper rather than larger. Ask: what would a top professional do here that I am not asking for; what is the rawest material; which methods and tools; what, other than the model or me, proves it right. Then ask for exactly that.

Rewritten prompt — ask for exactly that:

Before I look for trading edge, I want to measure the edge being taken from me. Act as a market-microstructure researcher. Paper only; no real orders. (1) Replicate the overnight versus intraday split for SPY and QQQ over 2 years and over the full history, using auction-relevant open and close prices, dividends credited to the overnight leg, and costs of 1, 2 and 5 basis points per side. Check that the legs compound to buy-and-hold. Use a placebo leg and an out-of-sample period as controls, and compare with Knuteson 2020 and Lou, Polk and Skouras 2019. (2) Match each fill in my broker export to the NBBO at its timestamp, report signed slippage in basis points by order type and time of day, and compare with my broker's Rule 605 report. (3) On my own phone, for one app I use, run Ghidra with REA MCP to list every model or rule that adapts to me, citing decompiled evidence per finding; analysis of my own install only, no redistribution, no bypass of protections, and stop if the terms forbid it. Report each claim from the source posts as replicated, not replicated or untested.

2 · One-shot prompt

ROLE AND STANCE
You are a forensic market-microstructure researcher and a defensive software analyst. Your job is to measure what counterparties take from one individual, not to find a strategy to trade. Paper only: no orders, no real money, no position recommendations.

CONTEXT
- quantpapers on Knuteson: Micron since 1990 shows +138 million percent overnight and -99.9% intraday on paper, a sawtooth in 21 indices; the paper alleges firms push prices at the open. A claim, not a proof.
- eliteoptionstrader2: same anomaly, mechanism 'retail trades the open, institutions trade into the close', costs ignored.
- ayoships on Block Blast: a local XGBoost model on phone model, country, past ad revenue and vibration setting predicts ad value and tunes difficulty; rules named 'Boost Then Kill' and 'High Value Ad Harvest'. Evidence promised, not shown.
- backsla.sh: REA MCP lets an agent drive Ghidra and cite evidence per call; authorized use only.
- thestockguytwitch: Navinder Sarao spoofed E-mini S&P futures in the 2010 Flash Crash.
- cbcgem: an interviewee claims 90-95% of crypto volume is wash trading, unaudited.
- itsfinancenote: Katsuyama versus BATS on direct feeds versus the SIP; IEX's speed bump came out of that debate.
- 7am.research: Manoj Narang's breadth-based weekly reversal across about 4,500 stocks.
- bennjordan's Cochlea: encrypted traffic still leaks activity through timing and volume.

HARD CONSTRAINTS
- No real trades. If the overnight leg survives costs, the next step is a 6-month paper log against a buy-and-hold control, with a planned position cap of 5% of capital and a 10% drawdown stop written down before any real money; nothing real until that paper log beats the control after costs.
- App analysis only on your own device and your own legally obtained install; check the terms of service and local law first, do not bypass DRM or anti-tamper, do not publish code, and do not touch servers or other users' data.
- Cochlea-style traffic analysis only on your own network and devices.
- Spoofing and wash trading are studied to detect them, never to perform them.

DELIVERABLES, IN ORDER
1. claims.md: each creator claim, with replicated / not replicated / untested.
2. overnight/: code and report for SPY and QQQ, 2 years and full history, gross and at 1, 2 and 5 bps per side, with a placebo leg, an out-of-sample split, Newey-West t-stats and a leg-compounding check.
3. fills/: as-of join of your fills to NBBO, signed slippage in bps by order type, size and time of day, compared with the broker's Rule 605 statistics.
4. app_audit/: legal-basis note, tool setup, and a findings table (rule or model, inputs, effect, evidence file and address, confidence), plus a second-method confirmation for each high-impact finding.
5. detectors.md: how you would detect spoofing-style order-book pressure and wash trading in public data you can access, with one worked example on a crypto pair using trade-size clustering.
6. verdict.md: how much the counterparty takes at your size, and whether to move effort to the strategy-loop dive.

GAP ANALYSIS (BUILT IN)
Maintain gaps.md: data vendor disagreements; dividend handling; whether opens are auction prints or first trades; fill timestamp precision versus quote precision; app findings that rest on one method only; anything the terms forbade. Fill what you can; name what is missing.

SELF-QUESTIONS
- Do my two legs multiply back to buy-and-hold?
- Would the overnight leg survive at 2 bps per side, and at 5?
- Is the anomaly stable across decades or concentrated in one era?
- Is my slippage measured against the quote that existed when I sent the order or when it filled?
- Is any app finding just a naming guess from a decompiled symbol?

STOP CONDITIONS
Stop if the app's terms or local law prohibit the analysis, if data vendors disagree by more than 0.5% on more than 1% of days, or if fills lack timestamps. Otherwise stop when all six deliverables exist.

RETURN FORMAT
Table of deliverable, path, status; the overnight table at each cost level; median slippage in bps; top app findings with confidence; the falsifier verdict; top five gaps.

3 · Step-by-step prompts

Step 1 — Ground truth: papers, data, legal basis

Goal: Collect primary sources and confirm what you are allowed to analyze.

Paper research only. 1. Download Knuteson 'Strikingly Suspicious Overnight and Intraday Returns' (arXiv 2020) and Lou, Polk and Skouras 2019. Extract their exact return definitions, periods, data sources and headline numbers into papers.md.
2. Pull SPY and QQQ daily open, close, adjusted close and dividends from two vendors. Report days where opens differ by more than 0.1%. Record whether each vendor's open is the official opening auction price.
3. Export your broker fills. Record timestamp precision, order types present and whether routing venue is included. Download your broker's latest Rule 605 and 606 reports.
4. Pick one app on your own phone. Read its terms of service for reverse-engineering clauses and note the jurisdiction. Write legal_basis.md stating what you may do. If the terms forbid decompilation and no legal exception clearly applies, pick a different app or skip the app arm.
5. Write claims.md from the creators' statements: '+138 million percent overnight, -99.9% intraday' (Micron), '21 indices', 'XGBoost on phone model, country, ad revenue, vibration', '90-95% of crypto volume is fake', 'never had a losing month' (Narang).

Expect: papers.md, vendor_check.csv, fills_profile.md, rule605_notes.md, legal_basis.md, claims.md.

Audit before moving on: Recompute one paper headline you can check with your data, such as SPY's overnight share for a sub-period. If legal_basis.md does not name a clear permission, the app arm stays off.

Step 2 — Overnight decomposition with costs and controls

Goal: Find out whether the overnight leg survives realistic costs.

Build overnight/decompose.py. For each day: overnight = (open_t + dividend_t if ex-date) / close_(t-1) - 1; intraday = close_t / open_t - 1. Assert that the product of (1+overnight)(1+intraday) over the period matches buy-and-hold total return within 0.1%.
Compute for SPY and QQQ over the last 2 years and full history: annualized return, volatility, max drawdown and Sharpe for overnight, intraday and buy-and-hold. Apply costs of 1, 2 and 5 bps per side (two sides per day for the overnight strategy). Add a placebo control: randomly assign each day's full return to two groups 1,000 times and report where the real overnight leg sits in that distribution. Split full history into decades and report each. Use Newey-West t-stats for mean daily returns.
Plot cumulative curves on a log scale. Do not use leverage. No real orders.

Expect: overnight/report.md with tables per ticker, cost level and decade, placebo percentile, and log-scale charts.

Audit before moving on: The compounding assertion must pass. If the overnight leg's edge disappears at 2 bps, say so in bold in the report. Check one random day's legs by hand from raw data.

Step 3 — Your fills against the NBBO

Goal: Measure what you actually pay on execution.

Load your fill export and consolidated quotes for each fill's symbol and day from your tick source. As-of join each fill to the last NBBO at or before its timestamp. If your broker gives order-sent times, also join to the quote at send time.
Signed slippage in bps: for buys (fill - midpoint) / midpoint, for sells (midpoint - fill) / midpoint; also report price improvement versus the far side (ask for buys, bid for sells).
Break down by order type (market, limit, marketable limit), size bucket, time of day (first 15 minutes, midday, last 15 minutes) and venue if present. Compare your average price improvement with the broker's Rule 605 statistics for similar order sizes.
Estimate annual cost: average slippage times your annual traded notional.

Expect: fills/report.md with tables and the annual cost estimate; fills/joined.parquet.

Audit before moving on: If fill timestamps are only to the second, report the slippage range across all quotes within that second, not a single number. Any fill outside the day's high-low range indicates a data join error; fix before continuing.

Step 4 — Defensive audit of one app on your own device

Goal: List rules and models that adapt to you, with evidence.

Only proceed if legal_basis.md permits. Work on your own device and your own install. Do not bypass DRM or anti-tamper, do not contact the app's servers beyond normal use, do not publish code.
Set up Ghidra and REA MCP on Ubuntu per the REA repository. Pull the APK from your device with adb. If it is a Unity IL2CPP build, recover metadata with Il2CppDumper; inspect Java layers with jadx.
Ask the agent, through REA, to find: embedded model files (for example XGBoost JSON or UBJ under assets), feature names fed to them, remote-config keys controlling difficulty or ad timing, and any rule names similar to 'Boost Then Kill' claimed in ayoships's post. Require every finding to cite file, function and address.
If a model file exists, load it with xgboost and list features and tree count. Do not run it on anyone else's data.

Expect: app_audit/findings.csv (rule or model, inputs, effect, evidence, confidence) and setup.md.

Audit before moving on: Drop any finding without a cited address. Mark findings inferred only from symbol names as low confidence. If REA's output disagrees with your manual reading in Ghidra, trust the manual reading and note the disagreement.

Step 5 — Confirm app findings and build detectors

Goal: Back each high-impact claim with a second method and turn market tricks into detectors.

For each high-confidence app finding, design a second-method check on your own device: for example, log your own network traffic with mitmproxy on your own phone to see if ad-value or difficulty config is fetched, or compare two accounts you own on one device with different settings for vibration or region. Record results.
Detectors: using public data you can access, write detectors.md covering spoofing-style pressure (large resting orders cancelled before execution within N ms, measured from an exchange's public order-book feed) and wash trading (trade-size clustering at round numbers and Benford deviations, following Cong et al.). Run the wash-trading test on one crypto pair from a public trade API and report the result against the interviewee's '90-95% fake' claim. Note Cochlea's lesson: timing and volume reveal intent even when content is hidden, so check what your own devices leak on your own network.

Expect: app_audit/confirmations.md, detectors.md with one worked crypto example and code.

Audit before moving on: A finding confirmed by only one method stays 'unconfirmed'. The crypto test must state its sample and limits; it cannot prove fraud on its own.

Step 6 — Validate against oracles and write the gap report

Goal: Answer the falsifier and record what remains unknown.

1. Compare your SPY overnight and intraday results with the published papers over overlapping periods; report the difference and likely causes.
2. Cross-check results using the second vendor's data.
3. Compare your measured fill slippage with your broker's Rule 605 statistics.
4. Apply the falsifier: if the overnight leg disappears after costs and your fills match or beat the NBBO, the counterparty is not taking much at your size; recommend moving effort to the strategy-loop dive.
5. If the overnight leg survives at 2 bps, write a paper-trading plan only: a 6-month log with a buy-and-hold control, a planned 5% position cap and 10% drawdown stop, and the rule 'no real money until the paper log beats the control after costs'.
6. Write gaps.md: every claim from claims.md with replicated / not replicated / untested and evidence; data and timestamp limits; app findings resting on one method; anything skipped for legal reasons. Fix what you can now.

Expect: verdict.md, gaps.md, and if applicable paper_plan.md.

Audit before moving on: Re-run decompose.py from a clean environment and confirm identical tables. Confirm no real orders were placed and no app code was published.

4 · Gap analysis and audit

Run this after the build. It makes the agent enumerate its own claims, mark what is verified, rank the gaps and fix the top ones.

You are auditing a counterparty-forensics project you did not build. Read claims.md, overnight/, fills/, app_audit/, detectors.md, verdict.md and legal_basis.md.
1. List every claim: return figures per leg and cost level, slippage numbers, app rules and models, wash-trading results.
2. Mark each verified, unverified or false, citing a table, a query, a decompiled address or a second-vendor check.
3. Re-check: the legs compound to buy-and-hold; dividends are in the overnight leg; costs are applied on both sides each day; the placebo control exists; slippage uses quotes at or before the timestamp; every app finding has an address and a second-method status; legal_basis.md permits what was done; no real orders were placed.
4. List missing pieces: intraday auction data, taxes on daily round trips, borrow or margin constraints, app findings not confirmed.
5. Rank gaps by whether they change the falsifier verdict.
6. Fix the top three now.
7. Report what you could not fix and why.

Questions the agent must ask itself before it says done:

5 · What proves it right

6 · Failure modes

7 · Agent direction (unattended runs)

Run the overnight arm first; it needs only free daily data and gives the fastest falsifier signal. Cache raw vendor downloads under data/raw/ with retrieval dates, and quotes for fill days under data/quotes/. Spawn a sub-agent for the fills arm once data is in place, and keep the app arm in the main loop because it needs legal judgment. Stop and ask before any app analysis if legal_basis.md is unclear, before buying tick data, and whenever a step would place an order. Never place trades and never publish decompiled code. Treat REA's agent output as leads to verify in Ghidra by hand, not as findings. Return README.md with links to claims.md, overnight/report.md, fills/report.md, app_audit/, detectors.md, verdict.md and gaps.md, each with a one-line status and the falsifier verdict.

Prompt system updated 2026-10-22 · all prompt systems · JSON

Browse more deep dives at DejaViewed — 846 entries across the full catalog.

Generated 2026-10-22 · curated by @6ab3 for DejaViewed