Reverse engineer and security researcher. I spend most of my time taking binaries apart to understand how they actually work: unpacking, deobfuscation, protocol and format reversing, and vulnerability research on native code.
- Reverse engineering of native and obfuscated binaries (PE/ELF, packers, VM-based protections)
- Malware analysis and unpacking
- Binary exploitation and vulnerability research
- Windows internals
- Tooling for reverse engineering workflows (scripts, plugins, automation)
I treat CTFs and personal research as a lab: most public work here is proof-of-concept code, analysis notes, and tools built to solve a specific reversing problem, not production software.
Write-ups and analysis notes go to nhaajtt.github.io (RSS available). My CV is at nhaajt.com, everything I build is on lab.nhaajt.com, and the Discord bots are at bots.nhaajt.com.
- orrery - looks up a GitHub profile and draws its public repositories as planets, plus the Action behind the SVG above.
- canary-bypass - recovering a stack canary byte by byte from a crash and no-crash oracle.
- fuzzing-lab - a fuzzing harness for cJSON, with a finding reported as DaveGamble/cJSON#1093.
- exploit-labs - self-contained stack overflow, ret2libc and SQL injection labs, each with its own target and exploit.
- re-tools - small command-line tools: ELF and PE header dumps, entropy scanning, XOR brute-forcing.
- re-ai-assist - connects a running Ghidra session to a language model for binary triage.
- ai-redteam - a red-team harness testing a self-authored assistant against prompt injection and jailbreaks.
- ctf-writeups - CTF write-ups with a template and a self-updating index.
Drawn daily by Orrery, a small GitHub Action I wrote. Each planet is a public repository. There is also a live version where you can look up any username and compare two profiles.