about
the person behind the handle
Security engineer at CRED by day, kernel gremlin by night. Day job is cloud security across AWS, DLP, Kubernetes, the kind of work that sounds boring until something breaks in prod at 2am and suddenly everyone's very interested.
24, based in Bengaluru. I play guitar terribly, cricket less terribly, and have a PS5 that sees more Netflix than games at this point. Perpetually planning a trip I haven't booked yet.
This site is where I write things down before I forget them. If it ended up here, it either broke something or took long enough to figure out that it deserved a post.
writing
things i've written down
How a VM Actually Boots in 125 Milliseconds
The full chain from x86's broken virtualization model to a Linux VM booting in 125ms: VT-x, KVM, QEMU, VirtIO, MicroVMs, Firecracker, and UFFD explained.
eBPF Security Programming: Beyond Hello World
Complete guide to eBPF security programming with C and libbpf. Compare BCC vs libbpf vs bpftrace
Using pip to Run Malicious Commands
Discover how attackers exploit pip to run malicious commands during Python package installation. Learn techniques for prevention, detection, and secure package management.
Nogitsune: building an eBPF rootkit from scratch
Full internals of how Nogitsune hides processes using eBPF tail calls and map tricks. What worked, what the verifier rejected, and what I learned doing it wrong first.
research
active & past projects
active
Nogitsune
eBPF-based process hiding and kernel evasion rootkit. Explores kprobe hooking, map-based PID filtering, and verifier bypass techniques.
eBPF
Go
Linux kernel
CO-RE/BTF
published
Firecracker Runtime Fingerprinting
Reverse engineered a production sandbox binary — extracted protobuf schemas from a Go binary, surveyed /proc and /sys emulation quirks, confirmed Firecracker runtime via dmesg artifacts. Responsible disclosure filed.
Go
reverse engineering
protobuf
Firecracker
gVisor