rootpls
Brent Wadleigh, 0xROOTPLS. Red team logistics, offensive software development, defensive software development, evasion, mitigation, bug bounty hunting and exploit development.
- C
- C++
- C#/.NET
- Rust
- Python
- NASM
About
I work at the layer where the documentation stops helping. Process internals, binary formats, allocators, the parts of the operating system you have to decompile to understand. Most of what I ship is small, complex, and single-purpose. Some larger projects are under my belt as well.
Red team by instinct, blue team by obligation. Optimization and evasion get most of my attention. Every project I publish is backed by numbers or a test.
Areas of practice
Where I've spent the time and shipped the tools.
- AI systems
- LLMs and generative work; classical ML: random forests, CNNs, KNNs, gradient boosting.
- Evasion
- Endpoint EDR and OS-level.
- Optimization
- Obscure mathematics that outperform textbook practice.
- Architecture
- Client-server design, secure application development, secure network communications.
- Reverse eng.
- Ghidra, IDA, ILSpy, angr.
- Low level
- Assembly and shellcode, in-memory work.
- Defense
- Mitigation research; anti-cheat, static and ML-driven.
Currently taking a limited amount of freelance contract work around tooling, internals research and systems design.
Selected work
-
A heavily modified fork of TheWover and Odzhan's Donut shellcode generator.
Every EDR knows Donut. What if we change the definition?
-
A Win64 call-stack spoofing technique that hides the consumer module from a thread's reconstructed call tree without modifying any DLL memory.
Every other spoofer wins the call tree and loses the page-hash. That trade is the whole reason to write Cuckoo.
-
An x64 PIC payload that resolves kernel32 through ntdll's LdrpModuleBaseAddressIndex red-black tree.
The PEB walk is the first path an EDR sees. This research reads the loader's own tree instead.
-
A modern post-exploitation framework built OPSEC-first, not as a checklist appended after the demo runs.
What happens when the C2 server is offensively… defensive?
Contact
- Brent Wadleigh
- [email protected]
- github.com/0xROOTPLS
-
public key
Fingerprint 1CC4 039E 26D4 A1FE F81C 085D 65DF 0E3A 589A D18A