Connecting research questions, experimental methods, and practical engineering.
† Equal contribution
First automated recovery pipeline for AutoCAD’s closed-source compiled formats (FAS4/VLX). A 983-sample benchmark across 23 malware families, family-disjoint evaluation, under 15 ms per file, 95.8% TPR at 2.2% FPR, integrated into Sangfor’s OT security pipeline.
Reverse engineering of the FAS4 binary format — its dual encrypted streams and rolling XOR recovery — and of the VLX VRTLIB-1 container that packages AutoCAD modules. Recovered symbols, APIs, strings, paths, and registry references are lifted into a security-oriented intermediate representation for behavioral analysis and ATT&CK-mapped evidence.
Understanding compiled scripts, execution environments, and the evidence needed for reliable analysis.
Attack-surface mapping, vulnerability discovery, and exploitation — how attack paths are built and whether defenses actually hold in live engagements.
Exploring state ownership, execution boundaries, work units, and the limits of agent collaboration.
Behavior capture, feature engineering, and threat modeling for remote access and encrypted traffic.