About | Blackrose

Simon Lucky

Security Researcher

I am an offensive security engineer and vulnerability researcher who thrives in quiet, deep-focus spaces. As an introvert, I’ve always preferred observing complex systems from the background before taking them apart. My work centers on low-level systems security, RTOS, and embedded firmware down to the hypervisor layer, driven by a simple objective: attack the stack. Whether I’m building custom tooling to stress-test platform services or dissecting threat actor malware to reverse engineer their TTPs, I find genuine satisfaction in methodical puzzles, such as tracing a vulnerability from a high-level driver down to a kernel race condition, or exploiting a bootloader logic bug to break a secure boot chain. Lately, I’ve been treating hypervisors like digital escape rooms, reverse engineering emulated hardware like QEMU’s virtual network cards to hunt for memory corruption and probe guest-to-host management layers. That fascination with isolation boundaries naturally extends into mobile platform internals across Android and iOS kernel security, where I analyze raw firmware and IPSW binaries, trace XNU and Linux kernel primitives, write native hooks to audit kernel memory maps, and analyze ARM64 hardware-enforced mitigations like PAC and PPL. That same pattern-seeking lens carries over into my offline life through travel, reverse engineering how different cultures build their societies, one street, one meal, and one photograph at a time. Navigating unfamiliar cities, mapping out transport networks, and observing real-world architectural flows feeds the exact same curiosity I bring to my research playground. There, I experiment with post-quantum cryptography, confidential computing, and hardware enclaves like Intel SGX. I treat decentralized networks like distributed operating systems, hunt for sandbox escapes in eBPF runtimes, and construct custom hardware pipelines on FPGAs using HDLs (Verilog/VHDL) to understand the full compute stack down to physical silicon. When I step away from disassemblers, debuggers, and logic analyzers, I unwind by streaming games on Twitch, a low-key outlet where I swap low-level reversing for interactive play, casual commentary, and connecting with tech communities on my own terms. Ultimately, whether I’m navigating a new country, streaming a playthrough, or auditing an OS state machine, it’s all driven by the same impulse: an endless curiosity about how complex structures, both digital and physical, are built and broken. This site serves as a personal log of my learning journey, independent research, offensive tooling, and reverse engineering projects. Everything shared here is my own work and has no connection to my professional affiliations.

Cyber Arsenal Read Journal

Languages and tools I use :

I approach security from a polyglot perspective, working across a range of languages spanning systems development, scripting, and hardware design. This range is fundamental to how I analyze complex attack surfaces, allowing me to not only find flaws but fundamentally understand their root causes from the application layer down to physical silicon. Python serves as my go-to for rapid prototyping of exploits and offensive tooling, while C and Rust provide the granular control needed to dissect memory corruption and build resilient platform utilities. I treat C++ strictly as a target for reverse engineering rather than a development language, analyzing its compilation abstractions during binary analysis. Fluency in Assembly is non-negotiable for my low-level reversing work, which I complement using JavaScript for dynamic binary instrumentation, custom runtime hooking, and analysis toolchains via Frida, alongside custom pipelines to parse and unpack raw firmware blocks. For hardware-level assessment, I use HDLs (Verilog/VHDL) to probe custom structures on FPGAs. To push past traditional analysis, I leverage the Lean proof assistant to formally verify cryptographic implementations, model attack surfaces, and mathematically prove protocol security properties, a focus I am actively expanding into the functional paradigm with Haskell to explore pure, strongly typed state machines. When it comes to automation and post-exploitation, I prefer keeping things lean and fast. I use Go to spin up high-performance backend utilities, Lua for quick embedded scripting, and Bash to navigate environment internals smoothly. More importantly, I drop down to raw POSIX system calls whenever possible, talking directly to target kernels to keep my footprint strictly in memory and off the disk. Ultimately, this background ensures that no matter what paradigm a target environment is built on, I can adapt, dissect it, and break it.

Highlights :

See some of my blog post hightlights below :

Leaving .NET Behind at the Crime Scene: Implementing EDR evasion, DPAPI decryption, and macOS Keychain access in Rust.

5 months, 3 weeks5 min read8 comments

Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate …

Building a Security Development Lifecycle (SDL) for Embedded Systems: Lessons from the Trenches

5 months, 3 weeks5 min read8 comments

From Userland to Hypervisor: A Journey Through the Full Stack of Security Research

5 months, 3 weeks5 min read8 comments

FPGA-based PCIe memory scraper with Rust C2.

5 months, 3 weeks5 min read8 comments

Disclaimer :

The knowledge, methods, and tools we share on this blog are provided for one core purpose: to educate, to support research, and to help security professionals build stronger, more resilient defenses. Our entire goal is to strengthen cybersecurity by explaining how attacks work, so you can learn to stop them. It is an absolute condition of your time here that you understand this information must only be used within ethical and legal boundaries. You are only allowed to use anything you learn on computing systems and networks that you personally own, or for which you have direct, explicit, written permission from the legal owner. Any form of unauthorized access or testing is strictly forbidden. It is illegal almost everywhere and can lead to severe real-world consequences like criminal charges, heavy fines, and career damage. All content is provided "as-is," and we cannot be held liable for any damages that result from its misuse or misapplication. You, the reader, bear full and complete responsibility for your own actions and their outcomes: legal, financial, and ethical. By using this blog, you explicitly agree to follow all applicable laws and to use this knowledge responsibly. Your guiding principle must be this: if you have any doubt at all about the legality of an action, do not proceed. The rule is simple, always get explicit, written permission first. We believe in a cybersecurity culture built on integrity and a sense of ethical duty. This knowledge is a powerful tool; please wield it wisely. Let your curiosity be guided by a strong moral compass. Stay ethical, stay legal, and stay curious.