Skip the demonstration, go to the portfolio
98.9%banned instantly, in production

I break systems to understand them. 

Then I build the thing that catches me. Kernel cheats, anti-cheat, Lua deobfuscation and web security.

in production, sold privately

An anti-cheat writtenentirely in Lua.

No binary. No driver. No kernel view of the machine. It runs inside the same sandbox as the game it protects, and it still bans almost everyone who tries, the moment they try.

Roblox studios buy it from me privately and run it on their own experiences. There is no product page, no name and no launcher, which is part of why it keeps working: there is nothing public to study, diff or fingerprint.

0.0%

of cheaters banned instantly

Not queued for a ban wave. The decision is made in the same session, usually inside the first minutes of the attempt.

0.0%

false positives, lifetime

Across the entire existence of the service. That number is the reason instant enforcement is safe to ship at all.

0%

Lua, no native component

Nothing to sign, nothing to load, nothing for an attacker to dump. It ships as game code and updates like game code.

Both figures are my own measurements across live deployments, not a third-party benchmark.

No memory, no modules, no driver

A kernel anti-cheat can look at the whole machine. This one sees only what the runtime and the game are willing to say. Every detection has to be built out of legitimate, observable behaviour.

Instant bans invert the risk

Delayed ban waves exist to protect the publisher from its own false positives. Removing the delay only works if the false-positive rate is small enough to defend one player at a time.

The attackers are the customers of the same market

Studios buying it are targeted by the exact tooling I used to write. The rules are shaped by having been on the other end of them for years.

Silence is a feature

No name, no marketing, no public build. Nothing for the people it is aimed at to collect, compare across versions, or trade.

Ten titles. Six anti-cheats.None of them caught me.

Kernel and user mode. Vanguard, BattlEye, EAC, VAC, Warden, Byfron. Ten titles, one pattern. Kernel anti-cheats and behavioural detection built by whole teams, and cheats that lived inside them for 6 to 24 months undetected, several past a year. This is where I learned adversarial engineering, from the side that has to keep winning.

ValorantFortniteCounter-Strike 2Apex LegendsOverwatchTeamfight TacticsGTA V OnlineRoblox

Kernel-level cheats

Written from scratch, against anti-cheats that also live in the kernel.

Building at ring zero removes every convenience and every excuse. There is no library to hide behind, the failure mode is a bugcheck rather than an exception, and the thing hunting you has the same privileges you do. Most of the work is not the capability, it is staying uninteresting while you have it.

Windows internalsDriver modelCode integrity

Windows features as the bypass

Kernel anti-cheat defeated with facilities Windows ships and has to trust.

The strongest bypasses were never exotic. They used documented operating-system behaviour that protection software cannot simply forbid, because the platform itself depends on it. That asymmetry is the most valuable thing I know about defending a machine: your detections cannot outlaw the operating system.

Trusted facilitiesAsymmetryPlatform behaviour

Behavioural camouflage

Surviving models, not just scanners.

Once detection moved server side, signatures stopped mattering and distributions started. Reaction times, overshoot and correction, imperfect tracking, session-to-session variance. Looking human in aggregate is a statistics problem, and it is the same problem in reverse when you are the one scoring players.

StatisticsTelemetryAnomaly scoring

Then the other side

The anti-cheat studios now pay for, built out of everything above.

Years spent making something invisible are exactly what let me build the thing that catches it. The detection rules I ship are the ones I could never get around, written by the person who spent a decade trying.

Detection designEnforcementProduction

Title by title, and what each one taught.

10 targets. Concepts and constraints only, no offsets, signatures or working evasion.

Valorant

The highest bar in the industry, which is exactly why it was worth clearing.

anti-cheat
Riot Vanguard
runs at
kernel-level
period
2021-2024
undetected
12+ months undetected
defence strength
5/5

what it defends with

Vanguard loads a kernel driver at boot, before the game and before most of userland. It polices driver signing, enforces code integrity, watches for unsigned or hollowed modules, and can refuse to start the game at all if the machine looks wrong. Always on, not launch-time.

how i approached it

  1. 01Study the boundary first. A protection that starts at boot has different blind spots than one that starts with the process.
  2. 02Accept the constraints instead of fighting them. Anything resting on unsigned code or patched integrity checks is dead on arrival.
  3. 03Work only with information the game must expose in order to function, and design for a footprint that stays statistically boring rather than merely signature-free.

why it mattered

Vanguard is where you learn that detection is not a list of signatures, it is a model of what a normal machine looks like. Beating a model is a different problem from beating a scanner, and it is the one that matters when you later sit on the defending side.

Kernel boundariesCode integrityBehavioural modelling

Private research, described at the level of concepts and constraints. No source, offsets, signatures, driver internals or working evasion steps are published here. The value was the capability and the discipline, not the payload.

MoonSec v1, v2 and v3,unwrapped by hand.

Lua's most-used commercial obfuscator, every generation of it, taken apart manually into readable code with an explanation of what each stage was hiding.

MoonSec compiles your script into a custom virtual machine: constants encrypted, instructions shuffled into an opaque dispatch loop, control flow rebuilt so nothing maps back to the source. v3 hardened all of it and added anti-tamper. There was no tool for the last one, so it was done by reading the interpreter until the interpreter explained itself.

  1. Unwrap the loader

    Strip the outer packer to reach the bytecode blob and the VM that consumes it.

  2. Recover the instruction set

    Watch the dispatch loop long enough to name every opcode by what it does to the stack.

  3. Decrypt the constant pool

    Strings and numbers are keyed per build, so the pool comes back only once the VM's own decoder is understood.

  4. Rebuild control flow

    Turn the flattened dispatch back into loops and branches, then into Lua a person can read and reason about.

protected input
local v0=("\120\112\99\97\108\108"):sub(1,6)
local v1={[0]=0x4C,0x75,0x61,0x51,0x00,0x01,0x04}
local v2=function(a,b) return(a+b)%256 end
local v3,v4=1,{}
while true do
  local op=v1[v3]
  if op==nil then break end
  if op==0x4C then v4[#v4+1]=v2(op,v3)
  elseif op==0x75 then v3=v3+1
  elseif op==0x61 then v4[#v4]=v4[#v4] ~ 0x37
  else v3=v3+1 end
  v3=v3+1
end
return (loadstring or load)(string.char(unpack(v4)))()
recovered output

waiting. every opcode above becomes one statement here.

Illustrative sketch written for this page, in the shape of what the protection produces. Real client work is not published, and neither is a deobfuscator.

Show me your stack and Iwill tell you where it breaks.

Most vulnerabilities are implied by the technology choices before anyone writes a line. A request crosses the same boundaries in every application, and the same boundary keeps being the one nobody owns.

PHP with a hand-rolled router

Local file inclusion and path traversal

Hand-rolled routing means paths get built from user input somewhere, and the include is usually one function away from that string.

Server-rendered templates, no escaping helper

Stored and reflected XSS

If escaping is a habit rather than a default, every new template is a new chance to forget.

Reverse proxy plus its own redirect handler

Open redirect and CRLF injection

Two layers each think the other validated the URL. Headers are string concatenation on at least one of them.

ORM plus a few raw queries for reports

SQL injection in the reporting path

The safe path is the framework's. The raw queries are always the ones written under deadline for an internal dashboard.

JWT in localStorage, no rotation

Token theft with a long tail

Any script on the page can read it, nothing can revoke it, and the expiry was set for convenience.

Client-side role checks on an admin route

Broken access control

The route gate is in the bundle the visitor downloaded. The API is what actually decides, and it often does not.

Authorised testing only. The scanner below automates the boring half of this so the thinking half gets the time.

Obfuscation is a pipeline,not a trick.

Shroud. Correctness-first source transformation.

Obfuscation is a pipeline of semantics-preserving passes, and the hard part is not breaking the program. Shroud renames only what it can prove is safe — locals, never globals, object properties or exported names — using a real AST for Python and hand-written parsers for JavaScript and Lua, then runs the original and transformed programs and compares their output.

  • Scope-aware identifier renaming via real parsers: Python AST, hand-written JavaScript and Lua parsers
  • String encoding with a base64 or XOR-with-embedded-key cipher, byte-exact for Unicode
  • Numeric-literal obfuscation, plus opaque-predicate dead code for Python
  • Deterministic seeded builds and behavioural verification (run original vs transformed, compare stdout and exit code)
  • CLI (build / inspect / verify / benchmark) and an interactive terminal UI
PythonJavaScriptLua
View on GitHub
sourceprotected
const knowledgeBase = {
  hello: "Hi there! How can I help you today?",
  bye: "Goodbye! Have a great day!",
  help: "You can say hello, bye, or ask me anything.",
  default: "Sorry, I don't understand that yet.",
};

function chatbotResponse(input) {
  input = input.toLowerCase().trim();
  for (const key in knowledgeBase) {
    if (input.includes(key)) {
      return knowledgeBase[key];
    }
  }
  return knowledgeBase.default;
}
var Nc21D0=["2DsADvBJ3Pga+ssBC+nkSP5yaVrwScLtG6PsG1y96E3xKx8=","1z1PHvpVy7wbkuIYGenmCfcgRRvsDMr8Qvs=","yT1VWvtNwL1Iu/pOFKzrRf9+ABjhSYK9VKijDw+ip0T1ckEU4VjG9FW9rQ==","wz1SCOEAjtQbvuwAW72nXP42RQjrWM/zX/r3Bh29p1D1Jg4="];var Nc21D0K=[144,82,32,122,152,44,174,157,59,218,131,110,124,201,135,41];function PJWGSF(i){var s=atob(Nc21D0[i]);var u=new Uint8Array(s.length);for(var k=0;k<s.length;k++){u[k]=s.charCodeAt(k)^Nc21D0K[k%Nc21D0K.length];}return new TextDecoder().decode(u);}
const knowledgeBase = {
  hello: PJWGSF(0),
  bye: PJWGSF(1),
  help: PJWGSF(2),
  default: PJWGSF(3),
};

function chatbotResponse(eO7eURvRhO) {
  eO7eURvRhO = eO7eURvRhO.toLowerCase().trim();
  for (const ZsHX03Z in knowledgeBase) {
    if (eO7eURvRhO.includes(ZsHX03Z)) {
      return knowledgeBase[ZsHX03Z];
    }
  }
  return knowledgeBase.default;
}
⇄
identifier renamingstring encryptionnumeric obfuscationcomment stripping

Drag to reveal the transformed output. Both sides come from the repository's own JavaScript example.

Tools and research, in the open.

Everything here is public on GitHub. The private work is the work that pays, so it stays described rather than shipped.

tool

Zyph

A compact web-security scanner that probes targets for the common vulnerability classes (LFI, open redirect, SQL injection, XSS and CRLF) with multi-threaded scanning and HTML reports.

2025↗
research

WiFi Deauth Research

Authorised wireless research into 802.11 deauthentication. Demonstrates why unprotected management frames on poorly-secured networks are a design weakness, and why Protected Management Frames exist.

2026↗
tool

STYN

A private website-analysis utility: it extracts hidden URLs, inspects security headers and SSL details, detects open ports, and fingerprints web technologies.

2025↗
experiment

StynSort

A Pygame visualiser for custom-designed sorting algorithms, rendering datasets of up to 100,000 elements sampled into 10,000 bars in real time.

2025↗
lab

maq4

An educational simulation of file-encryption malware behaviour, designed to run only inside an isolated lab on non-sensitive sample files. For awareness and defensive learning, never deployment.

2022↗
lab

What your browsertells every website.

The opening of this site is the case study. Three tiers of exposure, each with a completely different consent model, and only one of them ever asks you anything.

The full method is written up on the privacy page.

The intro's readout: IP address, area, provider, browser details and exact coordinates over a dark 3D map.
before consent

network metadata

Your connection gives up a coarse location and the network routing your traffic. Nothing is asked of you, because making the request is what reveals it.

on page load

browser metadata

Viewport, platform, thread count, GPU string, language, timezone. Everything a normal page reads from standard Web APIs. No fingerprint is computed here.

after consent

exact coordinates

Metres, not kilometres, and only after you grant the browser's geolocation permission. Held in memory, never sent anywhere, deleted when you ask.

Nineteen. Five of those years spent taking things apart. 

I started at fourteen because I was losing. Every skill on this page is downstream of that one afternoon, including the ones I now get paid for.

0
years old
0
years deep in it
0
titles broken
0
defensive products built
  1. 14

    I was losing, and I wanted to stop losing

    That is the whole origin story. The part that kept me was not winning, it was realising a game is just software, and software can be read. Once you have read one, you cannot go back to treating any of them as magic.

    CuriosityFirst reads
    Era 1 of 8
  2. Minecraft

    The first system big enough to have real seams

    Minecraft was where I learned that a live game leaks. Unpatched flaws in the game's own code gave up information the server never intended to send, including where other players were standing. Server plugins, written quickly and then trusted completely, could be talked into handing over administrative control. Economies could be made to produce value that was never earned.

    Zero-daysProtocol leaksPlugin trust
    Era 2 of 8
  3. Names

    A zero-day was currency

    There was a market for rare usernames, and a working bug was worth more in it than money was. That is where I earned a name of my own in that scene, before I was old enough to drive. It also taught me the uncomfortable half of security: a flaw has a price, and someone is always paying it.

    ReputationIncentives
    Era 3 of 8
  4. Software

    Games stopped being the point

    The interesting object was never the game, it was the binary. Reverse engineering became the actual hobby: disassembly, memory, protocol, protection. Games were simply the most instrumented targets available to a teenager with time.

    Reverse engineeringBinariesProtocols
    Era 4 of 8
  5. Kernel

    Then the hard targets

    Vanguard, BattlEye, EAC, VAC, Warden, Byfron. Kernel drivers, code integrity, behavioural models, and cheats of my own that lived inside them for months at a time. This is the decade of work the rest of this site details, and the reason the detection I write now is any good.

    KernelAnti-cheat internalsBehavioural evasion
    Era 5 of 8
  6. Web

    Websites, and the easy-win problem

    Web targets were next, and they were easy. Too easy to stay interesting, which is exactly when it stopped being a technical question and became a choice about what to do with the ability.

    Web securityAccess control
    Era 6 of 8
  7. Turn

    I did not want to cause harm, I wanted the other job

    So I switched sides and stayed there. Everything since has been defensive: anti-cheat for FiveM, then the Lua anti-cheat Roblox studios now buy, a forensics tool that can tell whether a cheat has ever run on a machine, and web-security software that finds the class of flaw I used to look for.

    DefenceDetectionTooling
    Era 7 of 8
  8. Now

    Building, and widening on purpose

    Kernel-level development, detection engineering, machine learning, and the whole front of the stack: software, frontend, interface and motion design. The offensive years gave me the instinct. The rest is deliberate practice at everything needed to ship the defensive side properly.

    Kernel devMLFrontendMotion design
    Era 8 of 8

What the offensive years turned into.

Roblox anti-cheat

in production, paid

Written entirely in Lua, sold privately to studios, banning almost everyone who tries in the same session. The section at the top of this page is about this one.

FiveM anti-cheat

shipped

The first thing I built for the defending side. Hundreds of servers make the same handful of trust mistakes, so the rules encode the mistakes rather than chasing individual cheats.

Cheat forensics for Windows

own tool

A checker that inspects a machine and reports whether a cheat has been run or injected into any game on it, not just whichever game is open. Built for the moment when someone says they were never cheating.

Web security software

open and private builds

Scanners and checks for the vulnerability classes I used to walk through. Authorised targets only, which is the entire difference between this and the earlier chapters.

The early chapters are teenage work against systems that have long since been fixed, described at the level of what was learned. No targets, no techniques and no tooling from that period are published here, and everything since the turn is authorised work.

I have always liked systemsmore after seeing them break.

Nineteen, with five of those years spent inside other people’s software. The offensive half is documented on this page because it is where the instinct came from, not because it is the part I sell.

The work now is anti-cheat and detection engineering, kernel-level development, machine learning, and the whole front of the stack: software, frontend, interface and motion design. Breadth on purpose, because shipping the defensive side properly needs all of it.

Have somethingdifficult?

Anti-cheat for a game with a real cheating problem, a stack you want read before someone else reads it, or something protected that needs understanding.

[email protected]copied