Transport-Agnostic Traffic MorphingRust library implementing DAITA-lineage traffic shaping for C2 evasion: constant-size 1440-byte frames that collapse the packet-size histogram, Poisson-distributed cover traffic that flattens beacon timing autocorrelation, and Maybenot-style probabilistic pattern distortion via state machines. Transport agnostic - reshapes sizes, timing, and burst patterns over any existing transport. Led to the Shapeshifting C2 talk at DEF CON 34 Red Team Village.
LLVM IR Obfuscator for RustOpen-source, cargo-native LLVM IR obfuscator for Rust. Intercepts each crate during a normal cargo build via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline (string encryption, basic-block shuffling, indirect branches, mixed Boolean-arithmetic), and recompiles with llc + clang before the real linker runs. Zero changes to rustc or the target project's source code. Led to a talk at DEF CON 34 Malware Village.
Browser Cookie and Credential ExtractionCross-platform Rust tool and library to extract cookies and passwords from major browsers (Chrome, Firefox, Edge, Safari, Brave, Chromium) passively, with no process injection. Bypasses Chrome's AppBound encryption, including the 2-way DPAPI scheme and ChaCha20Poly1305 state-key layer, and covers Gecko's ASN.1 3DES/AES-256 schemes, Chromium on macOS (PBKDF2), and WebKit binary cookie files. Led to talks at DEF CON 33 Red Team Village and BSides Las Vegas 2025.
Windows Local Privilege EscalationWindows Local Privilege Escalation (LPE) that allows an attacker to achieve kernel memory space access from user-land, elevated processes, thus leading to a Admin-To-Kernel LPE vulnerability. Works by manipulating Windows Access Tokens and a specifically crafted input buffer to a IOCTL function.
Rust COFF LoaderCustom implementation of Cobalt Strike's beacon_inline_execute written in Rust. Explores COFF (Common Object File Format) and how it can be dynamically loaded using relocations in the loader's memory. Led to research project and presentation at Ekoparty 2023.
Game Hacking in RustDLL made in Rust as a fun project based on PwnAdventure3. Explores process memory hooking using detour and trampoline hooking, as well as reading structure pointers to achieve what's needed in the game.
CLR Hosting in RustNative Rust implementation of the CLR hosting interfaces, which is the Core Language Runtime used by .NET to load managed binaries in native processes. Allows .NET managed binaries to be loaded in Rust native processes.
Advanced Process InjectionTool made using modern C++ that abuses the Windows API to achieve Remote Process Injection based on DLL files. Circumvents common detections by not using common Windows API calls like LoadLibrary and CreateRemoteThread, instead using advanced techniques such as Dynamic Memory Mapping.
Microsoft Word subDoc InjectionTool made with Go that injects a hidden malicious subdoc field in Microsoft Word documents. Commonly used to steal NTLMv2 hashes by using the SMB protocol. Based on research into Microsoft Office exploitation techniques.
Desktop Automation ToolSoftware for automation and simulation of repetitive human tasks in Desktop environments. Developed with C++ using Windows API features and frameworks for better system integration.
Anti-Cheat BypassSoftware for bypassing security routines implemented in Valve Anti-Cheat (VAC). Techniques based on Remote Process Hook Hijacking, Memory Hacking and DLL Injection abusing the dynamic linking of Windows processes.
C2 Disruption ToolSolution used as a disruptive measure against C2 hosts using the popular NjRat malware. By abusing bugs and lack of secure connection implementation in NjRat, it's possible to launch an amplified Denial-of-Service (DoS) attack at the application layer.