00000000 7f 6c 61 6e 64 68 62 01 00 00 00 00 00 00 00 00 |.landhb.........| 00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>......H@.....|

Blog Posts:

• March 24, 2019, 1:27 a.m. - Test Driven Development - Synacore VM
• Dec. 17, 2018, 6:45 p.m. - LKM Development Concepts & Considerations
• April 7, 2018, 9:31 p.m. - SPA with Netfilter Kernel Modules
• May 14, 2017, 10:13 a.m. - A Basic Windows DKOM Rootkit

Other Pages:

• Oct. 2020 - Chip8 Interpreter in Rust with a WebAssembly Frontend

Side Projects:

• DrawBridge
  Layer 4 Single Packet Authentication Linux kernel module utilizing Netfilter hooks and kernel supported Berkeley Packet Filters (BPF)


• nixmodule
  Simple qemu wrapper to automatically test out-of-tree linux kernel modules against multiple kernel versions.


• HideProcess
  A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager


• synacor-vm
  Virtual Machine implementation, for the toy Synacor achitecture


• portal
  A Secure file transfer utility & library. The library utilizes SPAKE2 for key negotiation over an insecure channel, and ChaCha20Poly1305 Authenticated Encryption to encrypt the file with the derived shared symmetric key. This enables two peers to transfer a file over any channel without needing to trust the intermediary relay.


• MemScan-1.0
  Scan and edit memory using WinAPI functions such as ReadProcessMemory and WriteProcessMemory


• rchip8
  A Chip8 interpreter with a WebAssembly front-end, written in Rust.


• OpenMPI
  Various parallel programming programs written in C++ using the OpenMPI library.