I build, analyze, and break systems across the entire execution stack — from userland memory spaces and kernel/hypervisor internals (Ring 0 / Ring -1) down to PCIe/FPGA hardware interfaces, and upward into autonomous, agentic offensive intelligence.
Co-founder of PurpleAILAB and architect behind Decepticon — an autonomous multi-agent red team system executing full-spectrum cyber kill chains.
"If you understand how the machine thinks, you control the machine."
| Layer / Domain | Focus & Techniques | Weaponry & Tooling |
|---|---|---|
| Ring -1 / Hypervisors | VT-x virtualization, EPT/NPT hook stealth, VMCS manipulation, VMEXIT interception | C, x86_64 ASM, Ophion, HyperDbg |
| Ring 0 / Windows Kernel | Driver architecture, manual mapping, BYOVD exploitation, DKOM, callback removal, Unicorn emulation | C++, Kevlar, WinDbg, KD |
| Hardware & DMA | Direct Memory Access, custom FPGA gateware, PCIe TLP generation, physical memory introspection | Verilog, C, Python, PCILeechGen, dma-ai-toolkit |
| Reverse Engineering | Static & dynamic binary triage, protocol deconstruction, packing/VM deobfuscation, agentic RE | IDA Pro, Ghidra, x64dbg, Frida, AiDA-Fork, decepticon-ghidra-mcp |
| Game Security & Internals | Memory manipulation, VMT/IAT hooks, SDK dumpers, anti-cheat analysis (EAC / BE / Vanguard) | C++, Rust, unknowncheats-mcp, MinHook, Dumper-7 |
| Autonomous Offensive AI | Multi-agent swarms, MCP servers, A2A coordination, 0-day hunting pipelines, context compression | Python, TypeScript, Go, Decepticon, Vigilo, omniwire |
| Systems & Developer Tooling | Bun SEA bytecode patching, zero-intervention MCP lifecycles, native TUIs, Dynamic HUD overlays | Go, Zig, Rust, unleash, vibe-island, mcp-ctl |
| Repository | Description | Tech |
|---|---|---|
| PurpleAILAB / Decepticon | Autonomous Red Team Agent — end-to-end kill chains, RoE/OPPLAN execution, 98% XBOW validation | Python AI Agents Red Team |
| PurpleAILAB / Vigilo | AI security agent for Web3 & smart contracts — bug bounties, audit contests, and exploit research | TypeScript Web3 Audit |
| NetVar1337 / decepticon-ghidra-mcp | Full-featured Ghidra MCP server (P-code, BSim, Version Tracking, emulation) for agentic 0-day workflows | Java Ghidra MCP |
| NetVar1337 / omniwire | Agent swarm mesh infrastructure — 88+ MCP tools, A2A protocol, mesh VPN, CDP browser automation | TypeScript MCP VPN |
| Repository | Description | Tech |
|---|---|---|
| NetVar1337 / Kevlar | x64 Windows kernel-driver emulation and behavioral analysis harness powered by Unicorn Engine | C++ Unicorn Kernel |
| NetVar1337 / Ophion | Stealth-focused Intel VT-x Hypervisor implementation (EPT hooking, VMCS shadow pages) | C Assembly VT-x |
| NetVar1337 / unleash | Bun SEA bytecode patcher & zero-refusal runtime harness — 113 binary patches, interactive TUI | Go Bytecode TUI |
| NetVar1337 / AiDA-Fork | AI assistant plugin for IDA Pro 9.0+ accelerating complex C++ game & engine reverse engineering | C++ IDA Pro AI |
| NetVar1337 / codex-patcher-cc | Codex CLI Mach-O & Rust binary patcher and automated configuration orchestrator | Python Mach-O Patching |
| Repository | Description | Tech |
|---|---|---|
| NetVar1337 / unknowncheats-mcp | Fast UnknownCheats & Elitepvpers MCP server with automated Cloudflare bypass | Rust MCP Cloudflare |
| NetVar1337 / dma-ai-toolkit | AI-assisted PCILeech & Direct Memory Access (DMA) hardware attack research toolkit | Python DMA PCILeech |
| NetVar1337 / PCILeechGen / pcileech-fpga | DMA firmware generator & custom FPGA modules for physical memory exploitation | Go Verilog FPGA |
| Repository | Description | Tech |
|---|---|---|
| NetVar1337 / vibe-island | Native Dynamic Island HUD for AI coding agents (macOS, Windows, Hyprland/Sway/GNOME/KDE) | Rust Desktop HUD |
| NetVar1337 / mcp-ctl | Zero-intervention MCP server lifecycle manager and process supervisor | Zig CLI MCP |
| NetVar1337 / claude-for-firefox | Claude browser extension for Firefox with sidebar chat and workflow automation | JavaScript WebExtension |
| NetVar1337 / flipctld / flipper-profile | C menu-UI engine and Btrfs/OverlayFS snapshot profile manager for embedded Linux / Flipper One | C Python Embedded |
|
|
|
|
|
|
|
|
- 🛡️ Kernel & Hypervisor Research: Stealth Intel VT-x virtualization, EPT hook masking, and Unicorn-based Windows driver execution harnesses.
- 🎯 Autonomous Offensive Swarms: Multi-agent coordination, subagent reasoning topologies, and 0-day vulnerability research automation @ PurpleAILAB.
- ⚡ Game Security & Anti-Cheat: Kernel stack-walk evasion, memory integrity research, and DMA hardware-level attack mitigation analysis.
- 📦 Token & Context Optimization: High-efficiency CLI shims, MCP tooling ecosystems, and low-latency system-level developer utilities.
/* Stay sharp. Stay low-level. */
while (true) {
if (understand_the_machine()) {
control_the_machine();
}
}