17.02.2026 aktualisiert

**** ******** ****
verifiziert
Premiumkunde
100 % verfügbar

Senior Software Architect (.NET / Python) – Gen-AI, Cloud & Kernel Security

Seengen, Schweiz
Nur Remote
M.Sc. Computer Science
Seengen, Schweiz
Nur Remote
M.Sc. Computer Science

Profilanlagen

Master Zeugnis.pdf
Maison Arbeitszeugnis.pdf
Honda Zeugnis.pdf
Marius_Anderie_CV.pdf
Marius_Anderie_Portfolio.pdf

Skills

Asp.Net.Net FrameworkAPIsKünstliche IntelligenzPenetration TestingArchitekturMicrosoft AzureC#C++Cloud ComputingContinuous IntegrationCqrsDebuggingDevOpsGitHubPythonWindows Application Programming InterfaceNGINXScrumReverse EngineeringWeb ApplikationenWinDBgBlazorGrafanaMulti-Agent SystemsGenerative AIFastAPIKanbanInteractive DisassemblerCoaching und MentoringCosmos DBVirtuelle AgentenSicherheitsbestimmungenTerraformDockerMicroservices
  • Programmiersprachen & Frameworks
    • C#, .NET 8/6, ASP.NET Core, EF Core, Blazor
    • Python 3 (FastAPI, LangChain, RAGAS)
    • C/C++ 17 für Windows-Kernel-Treiber, Minifilter & Win32-API
       
  • Architektur & Patterns
    Clean/Onion Architecture, Vertical-Slice CQRS, DDD, Micro- & Event-Driven Services, API-Gateway (YARP/Nginx)
     
  • Cloud & DevOps
    Azure (OpenAI, AI Search, Web Apps, Cosmos DB, Terraform IaC, Azure DevOps CI/CD), Docker, GitHub Actions, Grafana monitoring
     
  • AI / ML
    Generative AI, Retrieval-Augmented Generation (RAG), Multi-Agent-Systeme – u. a. Chat-Assistent für 12 000 Anwender, -40 % Tickets
     
  • Security & Low-Level
    Windows-Kernel-Entwicklung, ObRegisterCallbacks, Reverse Engineering (IDA Pro, WinDbg), Vulnerable-Driver Exploits, Pen-Testing
     
  • Projekterfolge (Auswahl)
    • RAG-Support-Bot: 80 % richtige Antworten, Null P1-Incidents
    • Strangler-Migration: -70 % Regression-Bugs, CHF > 3 M Modernisierungsbudget gesichert
    • Track-&-Trace-Microservice: 100 k API-Calls am Go-Live, 100 % Verfügbarkeit
    • Enterprise-Minifilter: 0 Runtime-Tampering-Incidents auf >100 000 Endpoints
       
  • Soft Skills
    Technische Leitung, Mentoring, Stakeholder-Management, agile Delivery (Scrum/Kanban)

Sprachen

DeutschMutterspracheEnglischverhandlungssicher

Projekthistorie

Software Architect · AI/ML Engineer · Lead Software Engineer

Internet und Informationstechnologie

50-250 Mitarbeiter

AI-Powered Multi-Agent Support Assistant — Defense Client (Switzerland)
Piloted an experimental, fast-moving LLM stack—updated every three weeks to stay state-of-the-art.

Team size: 7
Customer: Confidential Defense Client (Switzerland)
Core Stack:
  • Backend: Python 3.11, FastAPI, Azure OpenAI, Azure AI Search
  • Frontend: React, Tailwind
  • Cloud/DevOps: Azure Web Apps, Container Registry, Cosmos DB, Blob Storage, Terraform IaC, Docker, Azure DevOps CI/CD

1. Problem
New recruits must master a feature-rich HR & logistics portal. Sparse, outdated documentation generated many support tickets every month and slowed onboarding.

2. Solution Overview
I designed and led delivery of a micro-service, retrieval-augmented generation (RAG) chat assistant with the following components:
  • Chat Service: Generates answers via GPT-4o and vector search (FastAPI, Azure OpenAI)
  • Ingestion Service: Parses, chunks, and embeds content on each release (Azure AI Search, langchain)
  • Evaluation Service: Performs LLM-based quality checks on every pull request (RAGAS, pytest)
  • Web UI: Responsive chat and feedback panel (React, Tailwind)
  • Security: Private VNets and sealed storage; passed Swiss MoD pentest and audit
3. Impact
  • Reduced first-level support tickets by 40%
  • Improved correct answer rate from 40% to 80%
  • Frequent rollouts to 12,000 users every 3 weeks with zero P1 incidents since Q1 2024
4. My Contributions
  • Architected the end-to-end system
  • Built the chat, ingestion, and evaluation framework
  • Mentored junior engineers on RAG
  • Measured success metrics
5. Key Challenges & Mitigations
  • Sparse & outdated docs: Curated 30 high-impact UI walkthroughs → +40 percentage points accuracy uplift
  • Measuring answer quality: Introduced RAGAS suite in CI → PR feedback in under 5 minutes
  • Rapid LLM evolution: Used feature-toggle and strategy-pattern architecture → enabled zero-downtime upgrade from one-shot LLM + RAG to multi-agent “Lazy Graph RAG”

Founder · Full-Stack Engineer · DevOps

Community-Driven Humor Forum Platform — gelachtwird.net (Personal Project)
Bootstrapped a 100k-view/day, micro-service forum platform and evolved it into a revenue-positive product playground.

Team size: 1 (plus 5 volunteer moderators)
Audience: 300 active users, over 100,000 page-views per day
Core Stack:
  • Backend: Python 3.11, FastAPI, .NET 8 Blazor, MySQL
  • Frontend: XenForo, Angular, Tailwind
  • Cloud/DevOps: Self-hosted VPS, Docker, Nginx, Grafana, GitHub Actions CI/CD

1. Problem
Off-the-shelf forum software (XenForo) offered limited extensibility and no modern DevOps pipeline. I needed a flexible playground to experiment with micro-services, automate operations, and keep users engaged with minimal resources.

2. Solution Overview
I re-architected the forum into a containerised micro-service platform behind an Nginx reverse proxy. Key components include:
  • Python API Gateway: Intercepts all traffic, rewrites HTML (Strangler-Fig pattern), strips IPs for privacy (Docker, FastAPI)
  • Gallery Service: Enables ratings, blocks double votes via IP hashing (Python, SQLite)
  • Gold Posts: Lets users “gild” posts with PayPal, Stripe, or crypto (.NET Blazor, REST)
  • Frontpage: Ranks top posts by day/week/month/year (.NET API, Angular)
  • Backup: Nightly database and asset snapshots to off-site storage (.NET Worker, Cron)
  • Statistics: Real-time dashboards for top threads, user ignores, etc. (Grafana, MySQL)
Security & Privacy: IP removal at gateway, HTTPS-only access, and daily encrypted off-site backups.

3. Impact
  • Scaled from 0 to 100,000+ daily clicks with 99.9% uptime on a single VPS
  • +25% increase in active posters after launching gallery and gilding features
  • AdSense and sponsorships now fully cover hosting and generate modest profit
  • Community trust increased thanks to transparent privacy measures and zero data breaches
4. My Contributions
  • Invented the HTML gateway rewrite strategy
  • Containerised XenForo using a custom Dockerfile
  • Implemented every micro-service end-to-end
  • Set up CI/CD, monitoring, and automated backup pipelines
  • Moderated the community and led seasonal events like April Fools
5. Key Challenges & Mitigations
  • XenForo hard to customise: Solved via Strangler-Fig HTML proxy → unlimited UI control without modifying core
  • Preventing vote fraud: Used IP-hashed tokens and server-side rate limits → abuse dropped below 0.1%
  • Scaling on a single server: Optimised Docker and Nginx config → sustained 100k req/day at <150ms p95 latency
  • Privacy on a budget: Gateway strips IPs and anonymises logs → passed external GDPR review

Software Architect · Full-Stack & Systems Developer · DevOps

End-to-End WoW Bot Automation Framework — Personal R&D (Personal Project)
Self-directed, multi-year exploration of large-scale game automation, micro-services, and distributed systems.

Team size: 1
Customer: Personal / Proof-of-Concept
Core Stack:
  • Bot Core: C#, .NET 8, ZeroMQ/NetMQ, OpenCV, Lua
  • Backend: Python 3.11, FastAPI, Redis
  • Tooling & Ops: Docker, DevContainers, GitHub Actions, Terraform (home-lab)

1. Problem
Manual character levelling and gold farming in MMORPGs is repetitive, time-consuming, and error-prone. I set out to prove that a fully autonomous, extensible framework could orchestrate thousands of in-game actions in real time while remaining maintainable and safe to operate.

2. Solution Overview
I engineered a four-service, event-driven architecture composed of:
  • WoW Agent: Real-time game control and sensor fusion, dynamically generates Lua addons and executes ~100 commands and ~400 sensors (C#, .NET 8, Win32 APIs, OpenCV, Lua)
  • TreeNetRunner: Game-agnostic behaviour-tree runner that streams conditions/actions to any agent (ZeroMQ/NetMQ, BehaviourTree XML via Groot2)
  • Bot Server: Manages central state, routing, AH inventory, gold balance, route generation (Python, FastAPI, Redis, Docker)
  • eBay Server: Fully automated pipeline for listing and fulfilling gold sales (Python, FastAPI, eBay REST API)
Messaging: ZeroMQ enables low-latency remote execution across Windows, Linux, and macOS hosts.

3. Impact
  • Autonomy: Levels characters to cap and runs gold-farming routes with over 99% uptime since 2019
  • Scale: Executes hundreds of concurrent behaviour trees and has processed 100+ auction transactions end-to-end with no manual intervention
  • Maintainability: Clean architecture allows new behaviours to be added in minutes; over 50,000 lines of code maintained with low cognitive load
4. My Contributions
  • Designed the entire architecture
  • Implemented all four services
  • Built CI/CD pipelines and containerisation
  • Authored 100+ command modules and 400+ sensor modules
  • Tuned image-recognition models
  • Optimised ZeroMQ for sub-10 ms round-trip latency
5. Key Challenges & Mitigations
  • Real-time control with low latency: Used ZeroMQ pub/sub with local caching → achieved steady 5–10 ms command latency
  • Complex behaviour authoring: Integrated Groot2 visual BT editor and import pipeline → built over 300 reusable behaviour trees
  • Cross-platform decoupling: Separated agent and runner with a language-agnostic protocol → framework runs on any OS
  • Operational safety and stability: Deployed in sandboxed VMs with rate-limiting and watchdog timers → 0 bans since 2019

AI/ML Engineer · AI Tooling Developer · Software Architect

Confidential Defense Client (Switzerland)

Code Intelligence & MCP Server for Legacy Enterprise App — Defense Client (Switzerland)

Built static-analysis tools and an MCP server that gave AI coding agents full codebase understanding — cutting task completion time by 4.7x on a 500k+ LOC legacy system.


Stack: TypeScript · ts-morph · Node.js · C# · .NET · Roslyn · SQL Server · Python · MCP SDK · rapidfuzz · Docker


Problem: MILO5 enterprise portal (HR, finance, logistics) — 500k+ LOC Angular + .NET monolith, 12,000 users. AI agents spent most time navigating files rather than solving problems.


Solution: Three tools via MCP: (1) Frontend — traces UI clicks through Angular templates, NgRx, API proxies (ts-morph), (2) Backend — controllers, services, auth, DB schema via Roslyn (C#/.NET), (3) MCP Server — 6 tools over MCP protocol (Python).


Impact:

• 4.7x speedup: benchmarks in 3 min vs. 14 min without MCP

• Bug fixes dropped from ~2 min to 20–30s

• Full-stack features from 6 min to 2 min

• Enriched 715 chatbot actions with business logic in 1.5 hours

• Replicable approach for making any legacy codebase AI-ready


Contributions: Full architecture design; built TS frontend analyzer, C# backend analyzer, Python MCP server; designed 5-task benchmark; measured before/after results.


Challenges: Angular+NgRx trace → custom TraceBuilder; auth extraction → Roslyn semantic analysis; safe DB access → read-only SQL enforcement; fuzzy endpoint lookup → rapidfuzz matching.

AI/ML Engineer · AI Tooling Developer

Confidential Defense Client (Switzerland)

Automated UI-Action Generation for RAG Chatbot — Defense Client (Switzerland)

Invented a novel UI-tree capture pipeline that generated 715 reliable chatbot actions in one month — where months of manual effort had produced only 3.


Stack: JavaScript Bookmarklet · Node.js · Python 3.10 · FastAPI · Azure OpenAI · Docker · JSONL · Multilingual (DE/FR/IT)


Problem: The RAG chatbot needed structured action data for every workflow in an HR & logistics portal. The team had spent months and only created 3 actions manually.


Solution: Conceived and built a two-stage pipeline: Web-UI-Tree-Builder (bookmarklet captures UI clicks into action tree), Tree Host Server (JSONL persistence), Action Generation (AI summaries & keywords), Localization (automated DE/FR/IT translation).


Impact:

• 715 structured actions — up from 3 manual actions

• Delivered in one month vs. planned year-long timeline

• Customer "excited and surprised" by coverage and quality

• Directly improved chatbot answer accuracy

• Received a salary raise in recognition


Contributions: Conceived the approach (no prior art found); developed all components from scratch; clicked through full web app UI in one week; championed idea against skeptical project leads.


Challenges: No existing tools → custom toolchain; skeptical leadership → prototype spoke for itself; CSP blocking → browser extension; multilingual → automated LLM translation pipeline.

Tech Lead · Software Architect · Lead Software Engineer

Internet und Informationstechnologie

50-250 Mitarbeiter

Monolith-to-Modern Strangler Migration — Defense Client Web Suite
Stabilized an 8-year-old .NET + Angular monolith and won approval for a multi-million-CHF modernization roadmap.
  • Team size: 15
  • Customer: Confidential Defense Client (Switzerland)
  • Core Stack:
    • Backend: C# / .NET 6, EF Core, Vertical-Slice CQRS, API Gateway (YARP)
    • Frontend: Angular 16, TypeScript
    • Cloud/DevOps: Docker, Nginx Reverse Proxy, Azure DevOps Pipelines, Nuke Build, Terraform IaC
1. Problem
The web suite manages finance, HR, warehousing and logistics for the defense organization. After eight years and multiple vendor hand-overs, the codebase had decayed into a spaghetti monolith:
  • frequent production bugs revealed only after deployment
  • lead-time for changes measured in weeks, driving up cost
  • developers avoided the project, causing high turnover
  • E2E test job exceeded 60 min, delaying releases
2. Solution Overview
I performed an end-to-end architecture assessment, identified root causes, and led the client through four strategic options—ultimately selecting a Strangler-Fig migration via API Gateway:
  • Track: Containerisation
    • Purpose: Package entire legacy app for predictable rollout
    • Key Tech / Notes: Docker -> customer DC
  • Track: Gateway / Proxy
    • Purpose: Route requests to legacy or new services
    • Key Tech / Notes: YARP, Nginx
  • Track: Vertical-Slice Backend
    • Purpose: Rebuild modules behind clean boundaries
    • Key Tech / Notes: .NET 6, MediatR
  • Track: CI/CD & Tests
    • Purpose: Speed up feedback loops
    • Key Tech / Notes: Nuke, Azure Pipelines, +20 min test cut
Security: Runs inside restricted defense networks; reverse-proxy hardened (CIS Level 1) and pentest cleared.
3. Impact
  • Client funded CHF > 3 M roadmap based on my architecture dossier
  • Regression defects -70 % per release after proxy cut-over (Q4 2024)
  • Test pipeline reduced from 60 -> 40 min (-33 %) via Nuke-based re-write
  • Developer satisfaction survey rose from 2.1 / 5 to 4.0 / 5 within three quarters
4. My Contributions
Diagnosed root-cause architecture flaws; authored 10-page strategy paper & roadmap; implemented containerisation, gateway PoC and vertical-slice template; rewrote CI pipeline in Nuke; mentored 8 engineers on modern .NET patterns.
5. Key Challenges & Mitigations
  • Challenge: Tight coupling of DB & business logic
    • Mitigation & Result: Strangler proxy -> new bounded contexts w/ vertical slices — decoupled deployments
  • Challenge: Failing "Onion" layers
    • Mitigation & Result: Re-established Application layer, moved 42 mixed repositories out of Infrastructure
  • Challenge: Slow test suite
    • Mitigation & Result: Parallelised fixtures + in-memory DB => -20 min runtime
  • Challenge: Low dev morale & churn
    • Mitigation & Result: Introduced roadmap, guild sessions, code radar — turnover halted

Solution Architect · Full-Stack Developer · DevOps

Internet und Informationstechnologie

50-250 Mitarbeiter

Employee-Data Word Plugin Integration — Retail Client (Switzerland) Secure, full-stack data bridge for Officeatwork — designed, built & deployed solo in four weeks.
Duration: 4-week build (2023), enhancements 2023–2025 | Team: 1 Stack:
  1. Backend: C#, .NET 6, ASP.NET Web API, LDAP
  2. Frontend: Angular, Tailwind
  3. DevOps: Azure Web Apps, VNet, MongoDB, Terraform, Docker, CI/CD
1. Problem The HR Word-template plugin required live employee data. The read-only LDAP couldn't support per-user overrides, causing manual workarounds.
2. Solution End-to-end integration with override workflow:
  1. Employee API: Exposes LDAP data + overrides to Officeatwork
  2. Override UI: Authorised users edit fields (Angular, Azure AD)
  3. Sync Service: Tracks LDAP changes, expires stale overrides
  4. IaC: One-click deployments (Terraform, Docker)
  5. Security: Private VNet, Azure AD auth, RBAC
3. Impact
  1. MVP in 4 weeks, acceptance tests passed first attempt
  2. Dynamic templates for 8,000+ employees, no manual copy-paste
  3. >90% test coverage via TDD, zero production rollbacks
  4. Retained for paid enhancements over 3 years
4. Contributions
  1. Architected and built full solution (backend, frontend, IaC)
  2. Introduced TDD (>90% coverage)
  3. Mediated with Officeatwork on plugin issues
  4. Led stakeholder workshops and demos
5. Challenges
  1. Read-only LDAP: Snapshotting + MongoDB overlay → non-invasive writes
  2. Stale overrides: Nightly diff → auto-invalidation
  3. Solo 4-week delivery: TDD + CI/CD → bug-free first release
  4. Vendor bugs: Direct coordination → patches within 48h

Software Engineer · Backend Lead

Techgroup AG

Internet und Informationstechnologie

5000-10.000 Mitarbeiter

Track & Trace Platform “TNT” — Planzer (Logistics, Switzerland)
Engineered a high-throughput microservice in .NET & Onion Architecture—went live with zero downtime handling 100,000+ API calls on day 1.

Team size: 5
Customer: Planzer AG (Switzerland)
Core Stack:
  • Backend: C#, .NET 6, ASP.NET Core, MediatR, EF Core
  • Frontend: Angular 15, RxJS
  • Cloud/DevOps: Azure App Service, Terraform IaC (geo-redundant), Azure SQL, Container Registry, Azure Pipelines CI/CD

1. Problem
Planzer processes tens of thousands of orders daily. Customers and depot staff need real-time shipment status, but the legacy Track & Trace system was slow, fragile, and difficult to extend.

2. Solution Overview
I helped design and build TNT, a microservice-based system delivering real-time Track & Trace APIs and a responsive web UI.
Key components included:
  • TNT API: Idempotent read/write endpoints for order status (ASP.NET Core, Onion Architecture, MediatR, EF Core)
  • Email Service: Event-driven shipment notifications (Azure Service Bus, FluentEmail)
  • Web App: Angular SPA for internal and external users (Angular, Tailwind)
  • Infrastructure: Four isolated environments (dev, test, acceptance, production) using Terraform and Azure DevOps
Security & Reliability: Geo-redundant SQL and blob storage, automated CI integration tests, feature-toggle cut-over from legacy system to TNT

3. Impact
  • 100,000+ API calls handled on launch day with 0 P1 incidents
  • Legacy system decommissioned within 24 hours via feature toggle
  • Maintained 100% availability during migration, with no customer-visible bugs
  • 85% test coverage, including integration tests for critical flows
4. My Contributions
  • Implemented core business logic and idempotent APIs
  • Authored integration-test suite and EF Core migrations
  • Designed email notification module
  • Drove team-wide adoption of Onion Architecture
  • Presented sprint demos to stakeholders with a focus on clarity and business value
5. Key Challenges & Mitigations
  • High order volume spike at go-live: Load-tested the system and optimized DB indices and caching → handled 2× expected TPS
  • Zero-downtime cut-over: Used feature toggles and blue/green deployment → enabled instant switch with rollback safety
  • Ensuring idempotency: Implemented correlation keys and MediatR pipeline validation → dropped duplicate requests to 0%
  • Team ramp-up on Onion Architecture: Conducted pair-coding and knowledge-sharing sessions → faster pull requests and consistent codebase

C/C++ System Programmer · Windows Kernel Developer

Conpal GmbH

Internet und Informationstechnologie

10-50 Mitarbeiter

Enterprise File-Encryption Minifilter Driver — LANCrypt (Windows)
Maintained & hardened a production‐grade kernel driver that transparently encrypts every file touch-point for Fortune 500 and government clients.

Team size: 3
Customer: Multiple Enterprise & Government Clients (banks, airlines, military)
Core Stack:
  • Kernel-mode: C++17, Windows Filter Manager (minifilter), Win32 API
  • User-tools: WinDbg, crash-dump analysis, MFC GUI
  • DevOps: Visual Studio, Git, Jenkins CI/CD


1. Problem
Customers needed "encrypt-everything" protection on Windows endpoints. Legacy code left executables exposed to runtime tampering, and support teams were overwhelmed by frequent kernel-mode crashes.

2. Solution Overview
I evolved the product into a hardened, self-protecting encryption platform with:
  • Minifilter: Hooks all file create/read/write/move events (FltMgr, C++17)
  • Crypto Engine: On-the-fly AES-256 encryption and decryption (Windows CNG)
  • Self-Protection: Blocks debugger attach and live patching (ObRegisterCallbacks API)
  • Diagnostics: Automatically captures crash dumps with symbols for fast triage (WinDbg, KD extension scripts)
How it works: Files are encrypted at rest. When they leave the machine (email, copy, upload), the driver decrypts them transparently—preserving usability while ensuring strong endpoint security.

3. Impact
  • Deployed on 100,000+ endpoints across finance, aviation, and defense
  • Zero successful runtime tampering incidents since hardening release
  • Passed independent black-box audit just 3 weeks after deploying self-protection
  • Reduced average crash-dump resolution time by 60% via automation and symbolized triage
4. My Contributions
  • Re-architected critical driver modules
  • Implemented kernel-level self-protection using ObRegisterCallbacks
  • Refactored legacy C into modern C++17
  • Analyzed 50+ customer crash dumps to assembly-level root causes
  • Mentored junior developers in Windows internals and debugging
5. Key Challenges & Mitigations
  • Executables could be debugged and patched live: Added kernel object callbacks → blocked tampering, passed audit
  • Legacy, brittle C codebase: Incremental refactor to C++17 + added unit tests → 20% fewer regression bugs
  • Crash-dump triage was slow: Developed WinDbg scripts and symbol server → diagnostics under 15 minutes per case

Security Researcher · C++ Developer · Reverse-Engineer

MemWars — Game-Security Pen-Testing Framework (Master Thesis)
Built a Windows-kernel-aware exploitation lab that pressure-tests commercial anti-cheat engines and reveals zero-day bypasses.

Team size: 1
Institution: Philipps-Universität Marburg
Core Stack:
  • Engine: C++17, C, Objective-C, Lua 5.3 (scripting)
  • Windows Internals: WinAPI, Capcom vulnerable driver, LSASS RPC, Direct3D 11
  • Tooling/DevOps: Visual Studio, CMake, WinDbg, IDA Pro, GoogleTest, GitHub Actions

1. Problem
Game publishers rely on client-side anti-cheat to keep competitive matches fair, yet modern cheats operate from the Windows kernel and routinely bypass protections. Developers lacked a repeatable way to assess how easily their games could be compromised.

2. Solution Overview
I developed MemWars, a four-layer, modular penetration-testing framework that automates both user-mode and kernel-mode game-hacking techniques:
  • Core: Win privilege helpers and process discovery (WinAPI)
  • Attack Methods: 7 basic and 4 advanced exploit modules including DLL/Driver loaders and shellcode
  • Pen-Test Routines: Measure success and log evidence (GoogleTest, JSON reports)
  • Lua Interface: Scriptable orchestration and fuzzing via Lua 5.3
Implemented attack catalogue:
DLL/socket/IAT hooks, thread hijack, D3D11 overlay, LSASS abuse, hidden kernel DLL injection, manual-mapped driver, and more.

3. Impact
  • Evaluated four mainstream anti-cheat suites (VAC, EAC, BattlEye, Warden) across 9 AAA titles
  • Kernel-mode exploits bypassed 100% of protections; user-mode exploits mostly blocked
  • Discovered a persistent manual-mapped driver bypass undetected by VAC after six weeks of live use
  • Open-sourced MemWars on GitHub: 200+ commits, 48 stars
4. My Contributions
  • Designed the framework architecture
  • Implemented all exploits and defensive hooks
  • Built a Lua-based DSL for scripting tests
  • Wrote the automated evaluation system
  • Authored the full 90-page thesis
5. Key Challenges & Mitigations
  • Microsoft driver-signing barrier: Used Capcom CVE driver to load unsigned kernel payloads
  • Preventing in-game crashes: Added dynamic sandboxing and timeout watchdogs to each Lua routine
  • Maintaining stealth: Used shared-memory communication to avoid IOCTL traces
GitHub repository: https://github.com/moccajoghurt/MemWars

Windows Kernel Developer · Reverse Engineer · Security Researcher

Kernel-Level Mouse-Input Bypass Driver — Gaming Client (Remote via Upwork)
Reverse-engineered the Windows kernel input stack to build an undetectable driver, eliminating anti-cheat bans for a commercial CS:GO aimbot.

Team size: 1
Customer: Confidential Gaming Client (Upwork)
Core Stack: C/C++, Windows Driver Kit (WDK), IDA Pro, WinDbg, Capcom Vulnerable-Driver Loader
1. Problem
The client’s commercial CS:GO aimbot simulated mouse movement using the user-mode mouse_event API—an approach flagged by modern anti-cheat systems, causing high ban rates and significant revenue loss.

2. Solution Overview
I delivered a stealth kernel-mode driver and loader that injects mouse input below anti-cheat detection thresholds:
  • Driver Loader: Manually maps an unsigned driver outside the standard Windows driver chain (Capcom exploit, patchless NtLoadDriver bypass)
  • Kernel Driver: Synthesizes mouse movement using an undocumented win32k routine (WDK, C/C++)
  • User-Mode API: Lightweight C interface for integration with the existing aimbot (DLL export)
Evasion strategy: Manual mapping avoids any signed-driver traces. The loader wipes evidence of the Capcom vulnerable-driver exploit to evade anti-cheat forensic scans.

3. Impact
  • Ban rate dropped from over 15% to 0% across 2,000+ users over a 3-month period
  • Client's recurring subscription revenue stabilized and customer churn reversed
4. My Contributions
  • Reverse-engineered win32k and HID internals
  • Discovered undocumented mouse-input routine
  • Implemented full driver, loader, and user-mode integration API
  • Documented integration steps for the client’s dev team
5. Key Challenges & Mitigations
  • No documented kernel API for mouse injection: Located hidden win32k function → precise, low-latency injection
  • Anti-cheat scans signed-driver chain: Used manual driver mapping → bypassed driver list inspection
  • Residual traces from exploit loader: Cleared Capcom driver artifacts post-load → avoided anti-cheat correlation

Solo Developer · Graphics Programmer · Research Assistant

Raycasting Engine & SLAM Simulation Sandbox — Personal / Research Project
Coded a full ray-casting 3D engine from scratch in 4 weeks to generate synthetic worlds for robotics SLAM research.

Team size: 1 (mentored by two PhD supervisors)
Context: Frankfurt University of Applied Sciences — Robotics Lab
Core Stack:
  • Engine: C99, SDL 1.2, Custom Math Library
  • Tooling: GCC, gdb, Make
  • Extras: Qt-based Level Editor, Shooter Demo

1. Problem
The robotics group required varied and controllable 3D environments to benchmark Simultaneous Localization and Mapping (SLAM) algorithms. Existing simulators were closed-source, resource-heavy, or unsuitable for ray-sensor evaluation.

2. Solution Overview
I developed a minimal, real-time raycasting engine (inspired by Wolfenstein 3D) that outputs ground-truth camera poses for SLAM evaluation.
Key components included:
  • Renderer: 60 FPS column-wise raycaster with textured walls and sprites (DDA traversal, fixed-point math)
  • Physics: Grid-based collision and movement (2D vector math)
  • SLAM API: Step-through playback with pose export via CSV and UDP (C socket API)
  • Level Editor: Drag-and-drop interface for map creation (Qt Widgets, JSON)
3. Impact
  • Generated 100+ synthetic mazes, accelerating SLAM prototyping by ~3× compared to real-world captures
  • Adopted in two MSc theses and cited in an internal research note
  • Personally gained deep knowledge in linear algebra, trigonometry, and performance optimization
4. My Contributions
  • Designed the full architecture
  • Implemented every subsystem from scratch
  • Built tools including a map editor and shooter-style demo
  • Integrated ground-truth data export into the research pipeline
  • Documented mathematical foundations and API usage for other researchers
5. Key Challenges & Mitigations
  • Real-time speed on old hardware: Used fixed-point math and cache-optimized DDA → consistent 60 FPS
  • Accurate camera pose export: Decoupled rendering loop from camera state → frame-accurate ground-truth logs
  • User-friendly map creation: Built visual map editor with JSON output → new scenes ready in under 5 minutes

Zertifikate

Azure AI Engineer Associate

Microsoft

2025


Kontaktanfrage

Einloggen & anfragen.

Das Kontaktformular ist nur für eingeloggte Nutzer verfügbar.

RegistrierenAnmelden