Projects

Selected research and engineering work covering endpoint visibility, Windows internals, reverse engineering, malware development, offensive security tooling, and open source contributions.

01 / Featured

Active research Windows kernel research

Lethe

Lethe is a Windows kernel-mode research and red team tool centered on a KTIMER, KDPC, and IO_WORKITEM execution chain. The project investigates kernel-mode execution, process and token structures, driver visibility and loading constraints, endpoint detection surfaces, and the defensive boundaries around kernel-level activity.

Research scope

Project documentation records technical findings alongside limitations and defensive surfaces, including kernel telemetry, direct memory inspection, HVCI, driver blocklists, and protected process constraints. Built with C and the Windows Driver Development Kit.

C Windows WDK Kernel APIs Windows Internals AV/EDR Research DPC KTIMER

Repository ↗ Technical Wiki ↗ BYOVD Notes ↗

02 / Selected work

Active researchSyscall research toolkit

Artemis

A modular C and x86-64 Assembly framework for Windows NT research. Covers system service number resolution, direct and indirect syscall stub generation, and payload encoding components. Designed for controlled research into syscall dispatch mechanics.

C x64 Assembly MASM Windows NT Syscalls

Repository ↗

Research toolkitWindows offensive tooling

Native Adversary Framework

A low-level Windows research collection covering native API usage, PE parsing, process injection techniques, shellcode execution, and assembly-level resolution. Also includes SetupAPI callback redirection research for EDR evasion surface analysis.

C x64 Assembly Win32 NT Native API PE Parsing

Repository ↗ SetupAPI Research ↗

OngoingWindows security knowledge base

WinSec

A consolidated Windows security research and learning archive covering WinAPI internals, native APIs, PE structures, assembly, shellcode, processes and memory, reverse engineering, and endpoint security research.

Windows Win32 NT API PE Structures Assembly

Repository ↗ Pages ↗

Active developmentWindows reconnaissance

SENTINEX

A modular Windows reconnaissance framework written in C for security testing, system enumeration, network discovery, and endpoint visibility research. Designed for operator use in controlled test environments.

C Windows x64 Reconnaissance Enumeration

Repository ↗

Published workExploit development research

Linux ExploitDev

A practical knowledge base for Linux x64 exploit development covering memory layout, assembly concepts, shellcode construction, and the mechanics of classic exploitation techniques. Includes GDB-based analysis workflows.

C x86-64 Linux GDB Exploit Dev

Repository ↗

03 / Upstream

Upstream security research

libslirp · 3 Disclosed CVEs

Vulnerability Research & Upstream Systems Fixes

Looking for open source security engineering and vulnerability disclosures? View the CVE-2026-120830, CVE-2026-120831, and CVE-2026-115449 advisories, official Red Hat acknowledgements, upstream git commits, and code diffs in the dedicated contributions section.

CVE-2026-120830 CVE-2026-120831 CVE-2026-115449 9 Merged Commits libslirp Memory Safety

View Contributions & Commits ↗