HomeGamesUpdatesPricingMethodology
Steam News1 August 20269d ago

Demo Update - v0.11.2

Features Recovery shell for a deleted root filesystem - if you (or a script) rm -r your own machine's / directory, the terminal now drops into a bare recovery> prompt instead of leaving you in a broken, half-working sta

In this update2

Full notes

Full Blackdoor update

Read the full published notes in a cleaner layout. The original post stays linked below.

What changed

5 fixes1 addition3 changes1 removal
  • Server
  • Security
  • Gameplay
  • Fixes
changedFeaturesThe same recovery gate now applies to remote servers - deleting a target's own / (yours or a stray script's doing) now shows the same recovery> prompt instead of silently leaving the box in a confusing broken state. forkbomb remains the way out, same as before, just properly signposted now.
changedFeaturesgrab_hash() now also returns security, and hash_string() takes an optional third security argument - the "Crack Source" SDK's local hash-matching technique (hash_string() + hash_distance() against a hash from grab_hash()) only ever worked against a zero-security demo account before this. It now works against real targets, the way the SDK's own documentation always claimed it did.
addedFeaturesNew bitwise operators: &, |, ^, ~, <<, >> - and / or / xor / not / left-shift / right-shift on numbers. Precedence matches Python: comparison binds loosest, then |, ^, &, then shifts, then + / -.
changedFeaturescd - - jumps back to whichever directory you were in before your last cd, and prints the path, same as a real shell. Tracked separately for your own machine and whatever server you're connected to.
fixedBug FixesAbandoning a mission with objectives already completed, then re-accepting it, could show everything as done while the mission itself could never actually complete - objective completion flags weren't reset on abandon, so the game skipped re-verifying them against the freshly-reloaded server. Now reset properly.
fixedBug Fixesrange() with extreme bounds (values near Int64's limits) could bypass its own safety cap entirely - the size check computed on ints, which silently overflow and wrap at that scale, so an oversized request could slip through and try to allocate a multi-quintillion-element list in one shot, hanging or crashing the game instead of erroring cleanly. Fixed at the root: the check now happens in float space before anything is cast back down to int.

Blackdoor changes

changedThe same recovery gate now applies to remote servers - deleting a target's own / (yours or a stray script's doing) now shows the same recovery> prompt instead of silently leaving the box in a confusing broken state. forkbomb remains the way out, same as before, just properly signposted now.
changedgrab_hash() now also returns security, and hash_string() takes an optional third security argument - the "Crack Source" SDK's local hash-matching technique (hash_string() + hash_distance() against a hash from grab_hash()) only ever worked against a zero-security demo account before this. It now works against real targets, the way the SDK's own documentation always claimed it did.
addedNew bitwise operators: &, |, ^, ~, <<, >> - and / or / xor / not / left-shift / right-shift on numbers. Precedence matches Python: comparison binds loosest, then |, ^, &, then shifts, then + / -.
changedcd - - jumps back to whichever directory you were in before your last cd, and prints the path, same as a real shell. Tracked separately for your own machine and whatever server you're connected to.
fixedAbandoning a mission with objectives already completed, then re-accepting it, could show everything as done while the mission itself could never actually complete - objective completion flags weren't reset on abandon, so the game skipped re-verifying them against the freshly-reloaded server. Now reset properly.

Features

  • Recovery shell for a deleted root filesystem - if you (or a script) rm -r your own machine's / directory, the terminal now drops into a bare recovery> prompt instead of leaving you in a broken, half-working state forever. Only basic navigation works until you run restore, which reinstalls fresh from the recovery partition - wipes every local script, wordlist, and download back to factory defaults, permanently. Asks for confirmation first.

  • The same recovery gate now applies to remote servers - deleting a target's own / (yours or a stray script's doing) now shows the same recovery> prompt instead of silently leaving the box in a confusing broken state. forkbomb remains the way out, same as before, just properly signposted now.

  • grab_hash() now also returns security, and hash_string() takes an optional third security argument - the "Crack Source" SDK's local hash-matching technique (hash_string() + hash_distance() against a hash from grab_hash()) only ever worked against a zero-security demo account before this. It now works against real targets, the way the SDK's own documentation always claimed it did.

  • Wildcards in rm, ls, mv, and cp - rm -r ~/downloads/*.db, ls *.txt, cp *.log backup/ and friends all work now. mv/cp with a pattern matching more than one file require the destination to already be a directory, same as a re l shell.

  • New bitwise operators

    &, |, ^, ~, <<, >> - and / or / xor / not / left-shift / right-shift on numbers.

    Precedence matches Python

    comparison binds loosest, then |, ^, &, then shifts, then + / -.

  • grep -r - recursive search across an entire directory tree, not just a single named file. Uses real grep's pattern-first argument order for this form.

  • find -name - real filename search, finally its own command instead of a bare alias for grep. Supports * wildcards.

  • cd - - jumps back to whichever directory you were in before your last cd, and prints the path, same as a real shell. Tracked separately for your own machine and whatever server you're connected to.

  • echo - prints back whatever you give it, quotes optional.

Bug Fixes

  • Abandoning a mission with objectives already completed, then re-accepting it, could show everything as done while the mission itself could never actually complete - objective completion flags weren't reset on abandon, so the game skipped re-verifying them against the freshly-reloaded server. Now reset properly.

  • range() with extreme bounds (values near Int64's limits) could bypass its own safety cap entirely - the size check computed on ints, which silently overflow and wrap at that scale, so an oversized request could slip through and try to allocate a multi-quintillion-element list in one shot, hanging or crashing the game instead of erroring cleanly. Fixed at the root: the check now happens in float space before anything is cast back down to int.

  • rm -r / only ever deleted the / bookkeeping entry itself, not its actual contents - a path-prefix bug meant "deleting root" barely touched anything. Recursive deletes on the root directory now actually remove everything underneath it, on both your own machine and remote servers.

  • rm -rf (and other combined/reordered flags like -fr) weren't recognized at all - only an exact -r was handled, so -rf / was parsed as a literal filename and failed with "No such file". Flags are now parsed token by token, so -r, -f, -rf, -fr, -r -f, etc. all work.

  • kill -9 silently killed nothing - the whole argument was parsed as one integer, and "-9 5".to_int() stops at the space and returns -9, so it looked for (and never found) process -9 while the real pid went untouched. Signal flags are now stripped and ignored - there's only one way to end a process here, not real signal semantics.

  • Static

Source

Steam News / 1 August 2026

Open original post

Changelog.gg summarizes and formats this update. How we read updates.