Projects

A secure sandboxing platform for autonomous coding agents — per-session KVM VMs with default-deny networking and credential-swap egress — built in five and a half weeks almost entirely by the agents it is designed to contain.

Extracted a shared C++17/WebGPU runtime from one decompiled game and re-linked it into a second from a different console, so reverse-engineered code runs natively on x86_64 and in a browser.

Byte-exact decompilation of a symbol-less Xbox 360 binary: 44,226 of 69,301 functions matched in ten weeks by fleets of Claude Code agents — 78.9% of the game and engine code.

Drove a swarm of AI agents to a 92% byte-exact decompilation of a debug-info-less Xbox 360 game, then rebuilt its engine on WebGPU to catch the bugs a perfect match score cannot.

Taught the NSA's decompiler to understand the Xbox 360's proprietary SIMD instructions and MSVC PowerPC code, fixed three upstream analyzer bugs (PR filed to NSA), and made its function-matching engines tractable at 65,000-function scale.

Drove a stalled community decompilation to ~99% of its game-and-engine target scope with a governed fleet of AI agents — and got the 2010 Wii game playing in a browser.

A project-agnostic engine that searches for byte-exact source reconstructions of retail binaries, grown in seven weeks into a distributed compute farm and a pre-registered ML research program.

A clean-room Rust port of the MSVC PowerPC code generator, proven byte-identical to the original DLL by a differential harness and 200-290x faster per object.

Cross-emulator dynamic tracing that replays real gameplay state against decompiled code — and an audit that found 96.7% of its own test pool had zero bug-finding power

Forked the decompilation community's standard diff tool to emit machine-readable root-cause diagnoses — 21 pattern detectors and fixability verdicts that let AI agents work a 47,000-function match queue autonomously.

Extended the open-source Xbox 360 emulator with a headless Vulkan/Linux mode so game decompilations can be validated automatically — booting a rebuilt title to stable gameplay at 175 fps.

Added same-instrument multiplayer to a 16-year-old rhythm game in a 12-day sprint — root-caused on real Xbox 360 hardware and shipped as a legally clean 1.0.0 release.

Hardened a Rust decompilation toolkit to carve retail Xbox 360 executables into linkable COFF objects, including a from-scratch control-flow-analysis rewrite promoted with zero non-trivial diffs against a real production target.

A from-scratch, native-Linux writer and validator for Xbox 360 XEX2 containers that reproduces a closed loader format byte-for-byte and replaces months of trial-and-error reboots with an offline validator.

A pure-Go daemon and reverse proxy that keeps a fleet of AI coding agents fueled by hot-swapping OAuth credentials and load-balancing sessions across subscription quota windows.

A source-oracle-free firmware analysis workbench that byte-verifies its own vulnerability findings — and disproves the ones that do not hold up.

Founded and ran a VC-backed open-source security company (YC S19), shipping LunaTrace — a free software-composition-analysis tool that flags new CVEs in pull requests before they reach production.

Coined the name "Log4Shell" for the December 2021 log4j zero-day, wrote the early advisory and mitigation guide the industry leaned on, and shipped an open-source scanner to detect and patch vulnerable JARs.

Deobfuscated a 71-class J++-era game client into ~50k lines of readable Java, then proved it, the original JAR, and a from-scratch Go renderer draw byte-identical frames.

Co-founded and led engineering on a YC-backed visual IDE that let developers assemble code "blocks" like Lego and one-click-deploy them to AWS Lambda — the company that later pivoted into LunaSec.

A long-running solo passion project — a browser-based space game in the tradition of the classic exploration-and-trading titles — that has survived a full rewrite from a C# desktop app into a modern web app.