Chapter 18 · The Hunter Reversed
Farhan had been searching Milan’s firmware for two full days. Not the kind of “two days” where you halve your sleep — he had genuinely gone forty-eight hours without closing his eyes, only stopping at hour thirty-six when Lu Yuan forced a bottle of water and two energy bars into him. He ate mechanically, then turned back to the screen.
He wasn’t searching for code. He was searching for the absence of code.
Milan’s design logs provided clues, but clues weren’t maps. The clue was a vague sentence — “an address space not recorded in any routing table” — and a technical concept: “insert a conditional branch in Entry-7’s audit module during the ‘read’ operation.” Between those two lines, Farhan needed to find a concrete code path existing at a specific memory address.
He tried every conventional method. Symbolic execution — no unregistered address space found. Static analysis — the audit module’s control flow graph showed all branches closed. Dynamic taint tracking — the data flow path was as clean as a textbook example.
After forty-eight hours, Farhan leaned back in his chair, closed his eyes, and said a single word:
“Fuck.”
He rarely swore. Lu Yuan had known him for months and had barely heard him utter an emotional word. But he said it now, and said it very calmly, like stating a fully validated conclusion of failure.
“Thenested entry point doesn’t exist.” Farhan opened his eyes and stared at the ventilation duct above. “Milan’s diary might just be his inner monologue — an idea, a conceptual sketch that was never realized. He wrote ‘I built thatnested entry point’ in his diary — but it might have been his imagination. A fantasy he never actually implemented. People lie to themselves in diaries.”
Lu Yuan stood behind him and didn’t answer.
He was thinking the same question. If they had searched Milan’s firmware repeatedly and couldn’t find that入口 — then it might truly not exist. Milan was Starlink’s chief protocol architect, but he was also human. Humans exaggerate their achievements, record things they wanted to do but never completed, write wishes as accomplishments in their diaries.
But Lu Yuan remembered that night in Lagos — remembered the FreeBSD server in Amina’s basement, remembered the cool touch of that cylindrical key, remembered Amina’s words: “Every trap is bidirectional.”
Amina wasn’t a technical expert; she was afreight boss who had started as a signal hound. When she said something — she didn’t use technical terms, but she said the same thing.
“Milan said he spent sixty-three days writing thatnested entry point,” Lu Yuan said. “Sixty-three days.”
Farhan didn’t turn around, but his breathing rhythm changed.
“Could you spend sixty-three days writing a piece of code — then leave it there, never tell anyone, and never use it?”
Farhan didn’t answer. But he knew the answer. He couldn’t. If you spent sixty-three days writing a piece of code, its very existence meant you wanted it to be used. You wouldn’t invest sixty-three days in a function that would never be activated — unless those sixty-three days weren’t spent writing code at all, but doing something more difficult: hiding a piece of code where no one could find it.
Farhan sat up straight. He faced the screen again, but this time he didn’t open the disassembler. He opened the hex view of the complete firmware binary.
“What are you doing?”
“I’m thinking — if I were Milan, how would I hide something.”
He wasn’t searching for code anymore. He started searching the memory layout. Starlink firmware’s memory address space had a standard allocation pattern: bootloader, OS kernel, protocol stack, device drivers, application containers, and — empty space. Between each major module was unused padding for aligning memory page boundaries.
Farhan brought up those empty areas one by one. Most were pure 0x00 padding — no meaning, no content. But he found an anomaly: between firmware offsets 0x7F3A_0000 and 0x7F3A_1000, there was a 4096-byte empty region. It wasn’t filled with 0x00. It was filled with 0xFF.
Farhan’s fingers stopped on the keyboard.
In most firmware, unused empty memory is initialized to 0x00. But 0xFF padding meant someone had deliberately written data to this region — then marked it as empty.
Not empty. Erased data.
He pulled that 0xFF region into an analysis tool and ran a differential comparison algorithm — statistically comparing this region with adjacent empty areas. The result returned in one second: this 0xFF region’s bit distribution was not random. It contained an extremely faint, non-random pattern — the probability of certain byte positions deviating from uniform distribution.
“He erased the data,” Farhan said, his voice carrying that rare qualityapproaching excitement, “but he didn’t overwrite it with random data. He used 0xFF overwrite — a standard ‘secure erase’ operation. But the problem with secure erase is — it leaves behind a patch too clean, while real empty regions are 0x00. He didn’t leave information — he left a trace that information once existed.”
Lu Yuan leaned down, staring at the analysis result on the screen.
“Can you recover it?”
“No. 0xFF overwrite is irreversible. The data is gone.”
Farhan closed that window. But he didn’t stop. He opened another window — the complete link map of Starlink firmware. He worked like an archaeologist, excavating a man’s mind — not through what he left behind, but through what he chose to clear away.
“Milan spent sixty-three days writing thenested entry point. Then he erased it. But — if I were Milan — I wouldn’t erase the only copy. Before erasing this copy, I would保留 another. Somewhere he believed would never be checked.”
His cursor moved slowly across the link map. He was searching — not for code, but for anomalous relationships between address offsets.
Then he found it.
There was a module in the firmware — the QKD channel noise characteristic sampler — and in its position mapping table, one line of data appeared normal. Library name correct. Size correct. Entry address correct. But Farhan noticed something: this module’s declared size was 8,192 bytes, but in the link map, the gap between its end address and the next module’s start address was 4,096 bytes.
A hidden segment.
No — not a hidden segment. A section of memory declared as “belonging” to the noise characteristic sampler, but not actually covered by any of the sampler’s functions. It had been allocated, but it wasn’t used.
Like a room registered as a “bedroom” that was actually a secret door hidden behind wallpaper.
Farhan’s breath stopped for about two seconds.
He didn’t speak. He directly jumped to that address offset and opened the “non-existent” memory space with a hex editor.
What appeared on the screen was not 0x00. Not 0xFF.
It was data. Compiled, recognizable binary code.
He stared at the data, motionless, like looking at something that shouldn’t exist. Then he ran a disassembler. The hex code translated into assembly instructions, unfolding line by line across the screen. He read the first几十 lines.
It wasn’t a complete program. It was a piece of configuration data — containing a set of routing table entries, a set of authentication credentials, and a set of trigger conditions. At the core of the trigger conditions was one judgment statement:
IF (QKD_CHANNEL_NOISE_PATTERN == 0xA7F3_1C44_9B20_7D81) THEN ENABLE_HIDDEN_ROUTE
Farhan’s fingers left the keyboard. He leaned back in his chair and let out a very long sigh — not of exhaustion, but of a man lost in the desert for forty-eight hours, finally seeing the first landmark on the horizon.
“He hid it inside the memory segment of the QKD channel noise characteristic sampler.” Farhan’s voice was hoarse, almost like sandpaper scraping. “Not as code — as the sampler’s initial calibration data. This module loads a set of predefined noise characteristic templates at every firmware boot, used to compare against real-time sampled noise data. Milan disguised thenested entry point’s activation condition as a set of ‘reference noise characteristics.’ No one would check reference noise characteristic data — because it just looks like a set of random numbers.”
Lu Yuan stood behind him. His eyes rested on that line of hex activation conditions: 0xA7F3_1C44_9B20_7D81. The number appeared random — but anyone who knew Milan understood that “random” was not Milan’s style.
“A7F3 —” Farhan was also looking at the string. “Not randomly generated. This is a meaningful number. But I can’t yet decode what it represents.”
“Maybe we don’t need to decode its meaning,” Lu Yuan said. “We only need to know how to use it.”
Farhan nodded. He opened another window — he began analyzing the routing table entries hidden inside the noise sampler. These weren’t ordinary IP routing tables. They wereunderlying forwarding rules for Starlink inter-satellite laser links and QKD channels — not IP-layer routing, but physical-layer path selection rules. Each line specified a satellite identifier, a QKD channel’s frequency offset parameter, and a “priority override” flag.
What this entry could do sent a chill down the spine: it could read Starlink’s complete underlying routing table — every inter-satellite laser link’s bandwidth and latency, every satellite’s load status, every QKD channel’s key generation rate — and then write new path selection rules to any satellite’s forwarding engine.
In Starlink’s network, each satellite was an independent routing node; they negotiated optimal paths through a distributed consensus protocol. But the entry Milan left — it didn’t submit proposals to the consensus protocol. It directly wrote to the satellite’s forwarding rule table, overriding the consensus protocol’s output. Like directly turning the mechanical linkage of a ship’s rudder in its autopilot system.
Whoever could use this entry — could control the physical path of any data packet between any two satellites.
“Look at this —” Farhan brought up a topology map. He entered a few test command, and a new path appeared on the screen — not a real connection, but a logical route his local simulation environment had deduced using those routing rules. A data stream’s trajectory, starting from a satellite passing over the South Atlantic,经过 seven inter-satellite hops,最终 reaching a satellite positioned over the Indian Ocean — without passing through any billing audit nodes.
“Inside this autonomous domain,” Farhan said, drawing a circle in the air with his finger, “all data packets that fall into this path — are not processed by Starlink’s billing system. Not bypassed — completely skipped. The billing module never even sees these packets exist. They pass through like crossing a border without going through any customs window, because they travel a路 not marked on any map.”
He paused.
“This isn’t building a new network alongside Starlink — this is cutting out a piece of territory inside Starlink. A territory that doesn’t belong to anyone.”
“Data Haven,” Lu Yuan said.
Farhan looked at him. He nodded.
“Data Haven.”
The people at the base gathered gradually over the next few hours in front of the main screen.
Farhan spent about two hours assembling thenested entry point’s activation conditions and routing rules into an executable operational plan. He drew a diagram on the whiteboard with a marker — not a technical architecture diagram, but a conceptual sketch: a large circle representing Starlink’s core routing network, with a small, irregular enclosed area marked “autonomous domain” drawn inside.
“We don’t directly attack Starlink,” Farhan said, tapping the small area with the marker cap. “Attacking is meaningless — a hundred and twenty thousand satellites are redundant for each other. You could destroy a thousand, and the remaining 119,000 would automatically fill the routing gaps. We can’t physically destroy it, and we can’t logically overwrite it — because Starlink’s consensus protocol has Byzantine fault tolerance; malicious routing information would be voted down by the majority.”
He turned to face everyone.
“But what we can do — is create an enclave inside Starlink. A logically isolated zone established at the routing layer using Milan’s backdoor. All data packets that fall into this enclave don’t pass through Starlink’s billing module. They aren’t hidden by encryption — they are bypassed by routing rules. Like a room inside a castle that the guards know exists but never check, because the castle’s builder told them it was a storage room.”
Someone asked: “How big can this enclave be?”
Farhan calculated in his mind — then said a number that silenced the entire room: “Initially, very small. Roughly the size of a medium data center — tens of TB of storage and several thousand TOPS of compute. But once established, it can spread through the SkyWalker protocol over Starlink’s QKD channels. Each satellite written with the new routing rules becomes a border node of the autonomous domain and propagates the new rules to its neighbor satellites. If it goes smoothly — the domain can expand to cover about two to three percent of Starlink’s total capacity within roughly a dozen hours.”
Two to three percent. In absolute numbers, that meant the routing rules of several hundred satellites rewritten. Several hundred satellites’ data streams could bypass the billing system.
A Data Haven. Even at just two percent — it was already larger than any Pigeonnet, any underground fiber, any darknet. Because it lived parasitically inside Starlink’s body, using Starlink’s own satellites and bandwidth — just without paying the tax.
“But there’s one problem.” Farhan’s voice settled from the earlier excitement, like a climber stopping on a steep slope to look at the height beneath. “This entry’s activation condition — requires us to send a specific set of quantum state combinations through the QKD channel. Not an ordinary noise void — a precise noise characteristic template preset by thenested entry point’s designer. If we send it wrong — the entry won’t open. If we send it correctly — Milan will see a signal in his audit system. He’ll know we found the entry. He’ll know we’re trying to activate it.”
“Will he stop it?” someone asked.
Farhan didn’t answer.
Belgrade.
When Milan saw the alert, it was 3:11 AM.
He was in his study, rereading an old technical document — not a Starlink document, but a publicly published research paper from Huawei, 2049, on CDMA physical layer signal fingerprinting. He had stumbled across it from an unrelated search and found himself, as he read, rereading. The fourth name on the paper’s author list was one he recognized: Lu Yuan.
His terminal made a soft sound — not an ordinary notification tone, but a special frequency he had set for himself, so low it was almost beyond the audible range of the human ear, but he had configured it. This sound was bound to only one thing: the status change of the flag he had buried in the QKD channel noise characteristic sampler.
He opened the audit system.
At the bottom of the log, the latest record showed: Address space 0x7F3A_0400-0x7F3A_04FF — read attempt. Source: unregistered terminal. Method: indirect access via QKD channel noise template. Success: Yes.
His fingers stopped above the keyboard.
Someone had found it.
The seed he had spent sixty-three days burying, six years ago, had been opened — in an hour when everyone was asleep — by a key he had never seen, unlocking the door he thought would never be opened.
Milan leaned back in his chair, looking at that log, not making any operation for a very long time. His brain was processing several completely different emotional signals simultaneously, like waves of different frequencies叠加 in the same medium, producing an interference pattern he couldn’t name.
Pride. Someone had found the treasure he buried. He had left twenty-three doors in the firmware, twenty-two of which had been discovered and exploited by different people over the past six years — but none of them had reached the step where they needed to discover thenested entry point. Only this time. Only this person. He had reached the final step.
Fear. The possibility that thenested entry point could be activated meant — Starlink’sunderlying routing rules could be written by a third party. He had known this clearly when he designed the entry. He had technically created a tool within Starlink that could be used to split the network itself. If Lu Yuan and Farhan used it for something beyond his expectations — he couldn’t shut it down. Because he wasn’t in the control loop of that autonomous domain. Once activated, he was just a spectator.
Relief. This feeling was the one he understood least. He sat in the darkness for a long time, trying to understand why he felt eased when he should have been tense. Then he understood — for the first time in his long career, he was no longer the only person who knew all the answers. Someone had surpassed the层层 barriers he had set, had reached the终点 he had预设. This meant his system was not perfect — and it also meant he was finally no longer the one who had to bear everything alone.
He stood up. Didn’t turn on the light. He walked to the window and looked at the empty streets on the opposite bank of the Sava River. The streetlights’ reflections in the water distorted into elongated golden stripes, swaying slightly with the current.
He was thinking about what Lu Yuan had said on the phone that day.
“Your daughter is on my side. And you still love her.”
He was thinking about that uncompletednested entry point — the thing he had written in the dead of night, locked inside a memory segment no one would check, and told himself “this is just in case.”
Maybe he had been waiting for someone to reach this point all along. Maybe he had been waiting for someone to give him the chance to make a choice — not as Starlink’s chief protocol architect, but as a father, a man who had once believed technology could solve all problems, and at forty-seven had discovered he was wrong.
He walked back to the desk. He didn’t touch thenested entry point’s activation interceptor program. He could stop it — just send a firmware-level disable command to the satellite cluster, and that hidden code segment in the noise characteristic sampler would be overwritten. The entry would be permanently closed. Data Haven would die before it was born.
He didn’t type thatcommand.
He picked up his pen, opened the diary. The nib hovered above the paper for a long time, ink accumulating at the tip into a small droplet, about to fall before he began to write. His handwriting was not its usual restrained self — some letters curved beyond his customary boundaries, like a man who, after long suppression, had finally allowed his hand to write what it truly wanted to write.
They’re knocking at the door.
He paused. The nib left a small ink blot on the paper. He watched the blot slowly seep into the paper fibers, spreading into an irregular dark stain against the paper’s texture.
I don’t know if I should open it.
After writing this sentence, he closed the diary. No date. No signature.
He turned off the study light.
But he also didn’t open the interceptor program.
In the darkness, he sat back down in his chair. The computer screen had already dimmed automatically, but at the edge of the screen he could see the real-time status of that flag — it was still green. Green meant thenested entry point hadn’t been formally activated — only accessed. Lu Yuan and Farhan hadn’t yet made the final move.
What were they waiting for?
In the darkness, Milan suddenly understood: They were waiting for him to make his choice. They had found the door. But they wouldn’t barge in before it was opened — they were waiting for him to push it open himself.
Because if they broke in themselves, it was just an exploit. But if he pushed it open — it was an invitation.
Milan shook his head. In this unlit room’s darkness, shaking his head alone, a complex curve appeared at the corner of his mouth that he himself didn’t notice — not a bitter smile, not self-mockery, more like the complex reaction of a person seeing an unwelcome truth reflected in a mirror, instinctively wanting to look away but unable to resist one more glance.
He took out his phone. Not through the encrypted channel — he used the most ordinary text-message channel, without any protection, and sent a message to a number whose contact he hadn’t saved. The message was only three characters, sent from his personal terminal — not Starlink’s official communication device.
Sent at: 3:47:12 AM.
He wanted the opponent in that Shenzhen underground base to know — that on the other side of the door, there was someone watching them. Someone who hadn’t yet decided whether to open it.
In the shielded room at the base, Lu Yuan’s terminal lit up.
He picked it up. On the screen was a text message from an unknown number, no prefix, no signature, no security code. Just three characters:
「I know.」
Lu Yuan looked at those three characters for a long time.
Farhan leaned over from behind and saw them too. He didn’t ask who sent them — he didn’t need to.
“He knows we found it,” Farhan said.
“Yes.”
“He didn’t stop it.”
“Yes.”
Farhan was silent. The cooling fans in the base hummed continuously, a low-frequency droneapproaching white noise. From some distant server rack, the faint clicking of hard drives reading and writing, like the breathing of something growing inside.
“What is he thinking?” Farhan asked. The question wasn’t directed at anyone, like a man talking to himself.
Lu Yuan put the terminal back on the table. The three characters on the screen had already dimmed, but their shapes were still burned into his retina — and he knew they would also be burned into Farhan’s.
“He’s thinking about how to answer his daughter,” Lu Yuan said.
Farhan looked at him. Lu Yuan didn’t explain.
But Farhan slowly nodded — not because he understood, but because he chose to trust Lu Yuan’s judgment. In this world where all signals were monitored, all data analyzed, all paths billed, he chose to trust one father’s understanding of another.
“How long until Zijing’s medical authorization expires —” Farhan glanced at the countdown on the wall, ”— about fifty-three hours.”
Lu Yuan nodded.
“That’s enough.”
He lowered his head, looking again at thenested entry point’s activation condition on the screen — that string of hex noise characteristic templates. He didn’t need to analyze it anymore. He already knew it was real. Now only one question remained: when they sent the activation signal, would Milan press that interceptor button, or would he let the door open itself?
He remembered the letter Mia wrote to her mother.
“Tell Father I’m fine. I don’t hate him. I just can’t forgive him.”
He remembered the last thing Milan had said on that call — “I’ve been waiting for your call.”
Lu Yuan pushed those things down into the depths of his consciousness and looked back at the screen. Thenested entry point’s activation program was already loaded into SkyWalker’s transmission queue. His finger hovered above the enter key, just one keystroke away.
But he didn’t press it.
He was waiting for Milan to answer himself. Waiting for that forty-seven-year-old Serb to decide — whether he would be Starlink’s chief protocol architect, or a father whose daughter still wrote him letters.
This choice, Lu Yuan couldn’t make for him.
“Wait first,” Lu Yuan said.
Farhan looked at him, not asking what they were waiting for. He just said: “Are you sure?”
“I’m sure. He’ll make his choice before the window closes.”
Lu Yuan stood up from the desk and walked toward the folding cot in the corner. His daughter was sleeping deeply, breathing evenly, one hand resting on the edge of the blanket, fingers slightly curled. He crouched beside the cot and gently took that hand. Her small hand seemed unrealistically small in his palm — five slender fingers, skin as soft as thin silk, faint blue veins visible through the back of her hand.
His daughter.
A child he didn’t want to become like Milan’s daughter.
He would walk into Data Haven when that door opened. Not for freedom, not for the internet, not to overthrow anything. For this little girl holding his finger — so she would never need to write in a letter: “I don’t hate you, I just can’t forgive you.”
The sky outside the window was shifting from deep blue to gray-blue. Shenzhen’s dawn was approaching.
Farhan sat before the screen, eyes open. His gaze rested on that unread text message — “I know” — and that unpressed enter key.
These three characters were like a taut string, connecting the dawn of Belgrade and Shenzhen, connecting anested entry point not yet activated, connecting two fathers across an entire continent, facing each other.
The line was not yet open.
But the line was already in their hands.
