Arsenal

Tools I build to find out what defenses can see, and tools that help defenders see more. Built and run in authorized labs.

Every repository

On the bench

Pick a station. Each one runs a live screen of what the tool does.

All repositories

DynLoader

C++ · Windows · loader research

Modular Windows loader for EDR-evasion research. Indirect syscalls (Hell's Gate / Tartarus Gate style variants with multi-stage SSN resolution), manual PE parsing and section mapping, PEB walking, API hashing with dynamic resolution, and fileless HTTP delivery with optional AES. Core logic is modularized for research reuse.

Open dossier
GitHub
Indirect syscalls

Full manifest

DynLoaderC++ · Windows · loader researchModular Windows loader for EDR-evasion research. Indirect syscalls (Hell's Gate / Tartarus Gate style variants with multi-stage SSN resolution), manual PE parsing and section mapping, PEB walking, API hashing with dynamic resolution, and fileless HTTP delivery with optional AES. Core logic is modularized for research reuse.Indirect syscallsDossier
PlanqX EDRWindows · EDR · in developmentOpen-source Windows Endpoint Detection and Response exploring real-time system and network telemetry: API hooking, ELAM, ETW integration, and defensive instrumentation. Ongoing research build.In developmentDossier
Atlas CSPMCloud posture · multi-cloudCloud Security Posture Management tooling — configuration inventory, drift, and misconfiguration surfacing across cloud environments.Multi-cloudDossier
Command Privilege Management for PowerShellWindows · authentication layerAdditional authentication and privilege-control layer for PowerShell and Command Prompt sessions on Windows endpoints.Windows auth layerDossier
Recon & vulnerability toolingPowerShell · PythonAssorted information-gathering scripts, a lightweight vulnerability scanner, and small utilities used across authorized lab and purple-team work.Lab and purple teamDossier