Security researcher · Full-stack engineer
Binary analysis, API cracking, and vulnerability research — alongside four years building production full-stack systems and AI products. Based in Karachi.
I reverse-engineer software — cracking binaries, mapping APIs, and exploiting trust boundaries that developers assume are safe. Alongside that I build full-stack systems, AI products, and developer tools.
I analyse compiled binaries with IDA Pro, Ghidra, and Hopper to understand control flow, locate critical routines (license checks, IAP validation, auth gates), and patch them at the byte level. Recent work: bypassed App Store IAP validation across four Resident Evil titles on macOS.
I intercept, decrypt, and replicate the private API contracts of web and mobile apps. Cracked DeepSeek Chat and Gemini's client-side encryption so their frontends are fully scriptable via curl and Python. Also mapped FoodPanda's private REST API to build a real-time deal scanner.
I find and exploit vulnerabilities in real-world targets — RCE in Linux-exposed services, IDOR in web APIs, XSS via unsanitised parameter injection in SPAs. I built NextScope, an open-source CLI that automates frontend API surface discovery and vulnerability enumeration.
Four years building production systems — Django/FastAPI backends, Next.js/SvelteKit frontends, PostgreSQL, Redis, Celery, AWS, WebSockets. Currently running Wizardry Labs, building AI-enabled data pipelines and restaurant intelligence platforms.
Security research, tools, and engineering work
Fully cracked in-app purchases and DLC across RE4 Remake, RE2, RE3, and RE7 on macOS App Store editions. Used IDA Pro to map binary control flow, located IAP validation routines in ARM64 assembly, then applied surgical binary patches with Python 3 to redirect purchase-verification branches — unlocking all paid content without network calls.
Reverse-engineered the client-side encryption and signing logic used by DeepSeek Chat and Gemini's web frontend to authenticate API calls. Decrypted the message-encoding scheme, reconstructed session-token derivation, and exposed both chat APIs as fully functional local CLI/curl interfaces — bypassing rate-limits enforced only on the mobile/web UI layer.
Open-source CLI tool that crawls Next.js and other frontend applications, extracts all client-exposed API endpoints, identifies IDOR candidates, unauthenticated routes, and information leakage. Useful for bug-bounty recon on SPA targets.
Mapped the full FoodPanda Pakistan REST API surface from mobile traffic. Built a private CLI tool that polls live deal endpoints, queries the full restaurant and menu catalogue by price range and cuisine, and delivers personalised deal alerts in real time — well below what the official app exposes.
Discovered and exploited RCE vulnerabilities in Linux-exposed services. Conducted frontend security audits on open-source and commercial projects, finding unvalidated redirects, broken object-level authorisation, and reflected XSS via API parameter injection.
Investigated runtime compatibility layers, shader translation, and GPU command-buffer differences to bring Bloodborne to native Apple Silicon. Benchmarked M1 Pro performance, documented binary load behaviour, and published findings for the community.
The stack I actually use
In-depth articles
Resident Evil · macOS
A patched launcher that bypasses the IAP validation routines in RE4 Remake, RE2, RE3, and RE7 on the macOS App Store — unlocking every piece of paid DLC, all costumes, and all weapon packs. Access is granted manually to donors.
Open to security research collaborations, consulting, full-stack contracts, and remote engineering roles. Based in Karachi — available worldwide.