Security Stuff

Recent

Working on a prototype for usig LLMs for automatic exploit generation in EVM:

• quimera: data-driven exploit generation for Ethereum smart contracts using LLMs and Foundry.

Worked on some of the most influential smart contract fuzzers for EVM:

• Led the development of echidna.
• Provided assistance on the medusa development.

Also have some experience with symbolic execution:

• Regularly contribute improvements and fixes to hevm, the symbolic execution engine for the EVM that powers Echidna.
• In the past, added small features and fixed bugs in Manticore.

Recently combined some of these tools (Echidna, hevm and Certora) in a formal verification effort for the ABDK Math 64.64 library.

Old

• Led the development of QuickFuzz
• Created and developed VDiscover.

Fun Stuff

I’m a detective-story geek who created mystery-o-matic.com, a website where you can solve a daily murder mystery in 5 minutes. All the code and website are open-source!

Retro gaming

I’m part of the ScummVM team, volunteering as the main developer for the reimplementation of the following engines/games:

Private engine

Point and click game engine developed by Brooklyn Multimedia for a single game:

• Private Eye (1996)

Hypno engine

Game engine developed by Hypnotix used for point and click and rail shooters:

• Wetlands (1995)
• Marvel Comics Spider-Man: The Sinister Six (1996)
• Soldier Boyz (1997)

Freescape engine

One of the first 3D game engines developed by Incentive Software for a number of games:

• Driller/Space Station Oblivion (1987)
• Dark Side (1988)
• Total Eclipse (1988) / Total Eclipse 2 (1989)
• Castle Master (1990) / Castle Master 2 (1990)
• 3D Construction Kit / Virtual Reality Kit (1991)

Colony engine

One of the first game engines to offer real-time 3D graphics with free movement, created by David Alan Smith and published by Mindscape for a single game:

• The Colony (1988)

EEM engine

Point and click detective game engine developed by Stormfront Studios and published by EA*Kids for two games:

• Eagle Eye Mysteries (1993)
• Eagle Eye Mysteries in London (1994)

SCUMM engine: Rebel Assault games

Reimplementation of the FMV rail shooters developed by LucasArts, as part of the existing SCUMM engine:

• Star Wars: Rebel Assault (1993)
• Star Wars: Rebel Assault II - The Hidden Empire (1995)

Source code reconstruction

Outside of ScummVM, I completed a full source code reconstruction of Bruce Coville’s My Teacher Is an Alien (1997), a point and click adventure developed by 7th Level and Byron Preiss Multimedia. The reconstructed code is bug-for-bug faithful: it produces code identical to the original at the CPU instruction level when compiled with the same tools, verified using binary-comp, a tool I created to compare binaries function by function.

I’m also reconstructing the source of the two Wing Commander games developed by Origin Systems, as shipped in Wing Commander: The Kilrathi Saga (1996). Both projects rebuild the original Win32 executables with the era’s Microsoft Visual C++ toolchain, and both ship a native SDL2 port for Windows, Linux and macOS that runs on either Kilrathi Saga or original DOS game data, with an optional OpenGL renderer that draws space objects at output resolution:

• wc1-re: reconstruction of Wing Commander (1990). All 1,472 identified functions are accounted for.
• wc2-re: reconstruction of Wing Commander II: Vengeance of the Kilrathi (1991), still in progress.