Systems Programmer & Kernel Engineer with 10+ years of experience specializing in OS Internals, Windows/Linux Kernel Driver Development, Hypervisor Architectures (x86_64 virtualization), and Low-Level Security / Reverse Engineering.

Focus areas include Second-Level Address Translation (EPT/NPT) memory introspection, custom VMM development, driver-level memory manipulation, and analyzing complex anti-cheat/EDR internal architecture.

  +----------------------------------------------------------------------+
  |                   KERNEL & SYSTEMS ARCHITECTURE                      |
  +----------------------------------------------------------------------+
  |  Windows Kernel     :: WDF / KMDF / WDM, I/O Subsystem, EPROCESS/PTE   |
  |  Linux Kernel       :: LKMs, Netfilter, eBPF, Virtual Memory (mm_struct)|
  |  Virtualization     :: Intel VT-x / AMD-V, EPT/NPT Hooking, Hyper-V VMM|
  |  Reverse Eng.       :: IDA Pro, Ghidra, x64dbg, Windbg Kernel Debugging|
  |  Languages          :: C11, C++20, x86_64 MASM/NASM, Rust (no_std)     |
  +----------------------------------------------------------------------+

• Kernel Development: Native Windows Kernel Drivers (KMDF/WDM) & Linux Kernel Modules (LKMs). Deep understanding of IRQLs, IRP handling, physical/virtual memory management (PTEs, Page Fault handling, CR3 manipulation), and internal OS dispatching.
• Hypervisor Introspection (VMM): Low-level virtualization leveraging Intel VT-x and AMD-V extensions. Implementation of shadow page tables, EPT/NPT execution-only page manipulation, VMCB/VMCS context management, and Hyper-V attachment detours.
• Reverse Engineering: Advanced dynamic & static analysis of kernel drivers, obfuscated binaries, and protection subsystems. Custom IDAPython scripts, symbol reconstruction, and WinDbg kernel-mode triage.
• Memory Introspection & Security: Physical/Virtual address space translation, kernel-level stealth hooks, DKOM (Direct Kernel Object Manipulation), and anti-cheat / EDR telemetry analysis.

• Languages: C (C99/C11), C++ (C++17/C++20), Assembly (x86_64 MASM/NASM), Rust (no_std kernel environment), Python (Tooling/IDA scripts), PowerShell
• Platforms & APIs: Windows Driver Kit (WDK), Win32 API, Native API (Nt/Zw), Linux Kernel API, UEFI EDK-II, USB Host Shield 2.0
• Debugging & Tools: WinDbg (Kernel/User), IDA Pro, Ghidra, x64dbg, QEMU/KVM, VMware Workstation, Sysinternals Suite, Process Hacker / System Informer
• Build Systems: Visual Studio MSBuild, CMake, Make, vcpkg, NASM, Arduino IDE

• tpm-mmio-hv — Low-level Intel VT-x EPT framework for trapping, emulating, and dynamically modifying TPM 2.0 MMIO register transactions (CRB/TIS) and TPM_CC_READ_PUBLIC responses.
• uefi-tcg-measured-boot-replay — Bare-metal UEFI architecture demonstrating TPM 2.0 Measured Boot state reconstruction and synthetic TCG2 protocol event log replay under active Secure Boot (CRB MMIO register driver, Setup NVRAM TCG spec version manipulation, and zero-trace attestation spoofing).
• secureboot-state-emulation — Multi-surface UEFI Secure Boot state emulation framework in Windows kernel (Synchronizing registry state, KUSER_SHARED_DATA alias, SystemSecureBootInformation class 145 kernel global, and MDL-backed NtQuerySystemEnvironmentValueEx table hooks).
• nvidia-overlay-shared-mapping — Direct3D 11 in-memory texture composition and IPC injection library utilizing NVIDIA in-game overlay shared-memory sections (Reverse-engineered slot protocol, token cryptanalysis, and out-of-process Dear ImGui rendering).
• easyanticheat-kernel-driver-re — Technical reverse engineering breakdown of EasyAntiCheat kernel driver internals (Import obfuscation decryption, stack unwinding verification, TPM 2.0 hardware attestation, and minifilter I/O monitoring).
• ModuleSpoof — Proof-of-concept C++ library for spoofing in-memory DLL locations by trapping Win32 module resolution APIs and redirecting execution to manually mapped memory, paired with a honeypot trap guard.
• arduino-usb-hid-passthrough — Embedded C++ firmware for Arduino & MAX3421E USB Host Shield 2.0 implementing USB HID mouse passthrough and CDC serial movement control.