
PrecIR
Open-source hardware and software toolkit for reverse-engineering and communicating with infrared-based electronic shelf labels. Includes custom…

Open-source hardware and software toolkit for reverse-engineering and communicating with infrared-based electronic shelf labels. Includes custom…

Interface for interacting with PlayStation 5 EMC and EFC

Build repo from Universal Wifi pineapple hardware cloner

Exploit and tooling for Amlogic-based Sonos devices: dumps OTP/eFUSE via an EL3 exploit, extracts LUKS decryption keys, and fetches/decrypts OTA…

Exploit writeups I've authored

Reverse-engineered Logi Options+ agent IPC protocol. Switch Logitech multi-host devices programmatically via Unix socket (macOS) or named pipe…

Automatically find and execute fault injection attacks

Tool for reconstructing SPI flash images via logic analyzer captures

MSI Modern 15H AI C1MGT-096IT Linux thermal management - Reverse engineered EC control with fan profiles and battery threshold


Simple Process Dumper using DMA over a PCIe FPGA device

CVE-2024-44815

CVE-2025-50777: Root Access and Plaintext Credential Exposure in AZIOT Smart CCTV

Remote video eavesdropping using a software-defined radio platform

Portable NFC/RFID security tool for emulating and cloning contactless smartcards, reading tags, sniffing RF traffic, and recovering Mifare access…

Latency x-ray for undocumented hardware