π Field Notes

Recovered from the subject's workspace. What he builds, what he takes apart, and what he writes down.

Tools

• LogNode open source
  Turns unstructured logs into queryable structured events. A local or routed LLM writes the regexes; every one is validated before it's trusted. Clusters campaigns, verifies crawlers, and tags threat-actor TTPs across a whole fleet.
• Wuh open source
  Windows Update Helper — drives Windows Update straight through the wuapi COM library from the command line. List, download, install security updates, no GUI. .NET 8.

Findings & Research

• DEF CON 34 badge RE github
  Firmware reverse-engineering of the DEF CON 34 badge — the gene-exchange protocol, forgery, and signing analysis. Authorized; build artifacts public.
• ChirpHound github
  A Meshtastic (LoRa · SF7/BW500) receiver and packet detector for the HackRF + PortaPack Mayhem — pulling the mesh out of the air.
• Flocku github
  Offline awareness of Flock ALPR (automated licence-plate reader) cameras on a Heltec Wireless Tracker — know when you're being read.
• tisploit github
  A collection of timing-attack exploits — fickle by nature, and a study in how much a clock leaks.
• Fleet scanner intelligence live
  Continuous crawler verification and threat-actor TTP tagging across ~90 machines' logs, via LogNode — real bots vs. impostors, clustered into named campaigns.
• Samsung Tizen TV — telemetry audit write-up on request
  What a modern smart TV dials home, mapped from the device outward.

Papers

• Notes & older write-ups on request
  Deeper notes live in a private research notebook (log-driven threat detection, WireGuard mesh, SDR/RF). Some older articles on Medium — ask and I'll point you to the relevant one.