A great deal has been said about how to compromise various pieces of SCADA equipment. It seems every day someone is posting a new vulnerability. Very little has been published answering the question ""You are given full control of a process. Now what?"". Most of the answers to that question are specific to the target. Making a refinery go bad is very different than making a power grid fail. That being said there are a number of topics than can be discussed. One of them is code miniaturization for spoofing. The main computers involved in a controlling a process are general purpose machines. Modern forensics are very good at extracting and analyzing rootkits on general-purpose computers. Embedded systems and specialty chips are starting to look appealing, but living on a something like a network card comes with severe limitations. The traditional spoof is to record data and play it back later. Alternately an attacker can generate a model to estimate the values shown to the upstream equipment. In the first case, the attacker doesn't have enough storage. In the second the attacker doesn't have enough processing power. This presentation will cover algorithms and tricks to miniaturize spoofing code down to the size that it can be resident on a small embedded CPU. For example, not all parts of the process are equally sensitive to spoofing error. A well controlled flow needs very little logic so CPU cycles can be reassigned to a part of the process that requires a more fidelity. The presentation will cover some techniques where an attacker may create a set of scalars that are believable both during the learning phase and the execution phase of an attack and that can be deployed without perfect knowledge of the process.