Cold open
I break iton purposethen explain why
Systems software by day, offensive security on contract. I live in crash dumps, disassembly, and traffic that does not add up. If your system does something it swears it cannot, that is my favorite kind of ticket.
Most people see a crash. I see a map.
Origin story
I build the thing, then I hunt for how it breaks.
Narration
I do not chase the happy path. I want the crash dump, the malformed packet, the branch nobody tested, the one box where everything falls over. That is where the truth lives.
The loop
- 1 / Catch the failure
- 2 / Shrink the repro
- 3 / Trace the boundary
- 4 / Write the fix path
How I actually work
My day moves between systems code, desktop engineering, reverse engineering, and offensive work. No mysticism. I look at what is really happening, cut it down to a case that fires every time, then write the fix notes I would want handed to me.
House rules
Recurring panels
The situations I keep getting pulled into.
Crash reading
Walk backward from the symptom — state, inputs, memory, timing, the branch that turned ugly. Out: a path that fires every time.
Source says it cannot. The crash says it did.
Exploit proof
Scary wording, or does it actually move under pressure? Out: real impact, hard limits, fix priority.
Binary reading
Disassembly, traces, debugger state — for when source is missing, stale, or lying. Out: control-flow notes.
Desktop weirdness
UI state, native calls, latency, and user flow all blaming each other. Out: behavior that holds still.
Traffic smell
Read the wire and the protocol assumptions when the bug only shows up between two systems. Out: trust-boundary notes.
Fix notes
Turn messy evidence into the smallest useful next step — patch, repro, ticket. Out: work someone can pick up cold.
Case files
Not a tidy timeline. Recurring case files.
The crash that only happened on one machine
CRASH.Desktop app died for exactly one user. Clean on every test box.
Pulled the dump: access violation past a user-mode boundary, only under a specific locale + timing window.
Reduced it to a race in init order. Wrote the repro + the one-line fix path.
One user. One box. Clean everywhere else.
The auth check that was technically there
BYPASS.Endpoint had an auth check. On paper, locked.
Replayed a packet, flipped one branch after the check — server happily answered.
Proved impact end to end before it became a ticket. Fix priority: now.
The check ran. It just didn't matter.
Field log
Systems Software Engineer
Beyondsoft Singapore
Offensive Security Engineer
Confidential
Independent Penetration Tester
Web + network
Game Security Research
Client integrity / RE
Loadout
What I reach for when the easy answer runs out.
Reverse engineering
Where I live when source is missing.
Build
Editors
Operating systems
Last panel
Send me the ugly version.
Broken builds. Behavior that makes no sense. A finding that needs a second pair of eyes. A binary that refuses to explain itself.
Drop the message here