Replacing a Python BitTorrent daemon with a Rust one, where the wire protocol is extracted from the original instead of transcribed by hand, and a container gate refuses anything that drifts.
Building a userland-hiding eBPF implant with aya, then flipping sides to hunt it from the kernel. Red and blue in one write-up.
No binary, just one packet capture. Reversing a custom beacon protocol from raw hex down to plaintext commands, with a decoder in Rust.
From scratch: instrumentation, a coverage feedback loop, a mutation engine, and the crash triage that turns a segfault into a one-line root cause.
Cache-timing leakage, millions of samples, and enough statistics to pull key bytes out of a table-based AES implementation across the wire.