// Projects

What’s Been Built

Wheatley

ESP32 RF Surveillance Detection Node

//BLUE

A passive Wi-Fi sniffer housed in a custom Wheatley (Portal 2) shell. Dual-core ESP32: one core hops all 13 channels pulling raw 802.11 frames, the other pushes analyzed metadata to an MQTT broker on a local Pi. It fingerprints devices by OUI, parses SSID probe requests, and estimates proximity from RSSI. A room-level RF camera. If someone's outside your window with a device that talks, it sees them.

CompleteESP32C++MQTT802.11RF
// Show Technical Detail
  • RF Scanning + Channel Hopping: Core 0 runs a continuous sniffer task rotating through 13 Wi-Fi channels every 250ms, intercepting raw 802.11 frames invisible to standard clients.
  • Intelligent Packet Inspection: Promiscuous callback extracts MAC addresses, frame subtypes, and sequence numbers from intercepted frames.
  • Device Fingerprinting: First three bytes of each MAC matched against an internal OUI database: identifies manufacturer (Apple, Samsung, Intel, etc.) on sight.
  • SSID + Probe Parsing: Dives into packet payload to extract SSID probe requests: mapping which networks nearby devices have previously connected to.
  • Signal Analytics: Calculates avg, min, and max RSSI per detected device to estimate physical proximity to the node.
  • MQTT Diplomat: Core 1 periodically pauses sniffing to push two JSON streams to the Pi: a Heartbeat (CPU/uptime) and a Data Pulse (top 20 most active nearby devices).
  • Thread Safety: Mutex lock prevents race conditions between cores: no crashes when Core 1 is writing while Core 0 is deleting stale entries.
GitHubSanitizing for release

NULL-BEACON

Phantom Device Generator: BT/WiFi MAC Rotation

//BLUE

A credit-card-sized device that broadcasts a rotating set of spoofed Bluetooth and Wi-Fi MAC addresses. Passive trackers in range log dozens of phantom devices instead of your real hardware. Harder to pick one person out of a crowd that was never there.

InactiveHardwareESP32BLE802.11C++

SIGIL-CRYPT

Post-Quantum Cryptographic Engine: Module-LWE / AES-256-GCM / NIST L5

//BLUE

An offline, browser-native post-quantum encryption engine. Implements Module-LWE (k=4, n=256, q=12289) with NTT acceleration, PBKDF2 at 600,000 rounds, and AES-256-GCM. NIST Level 5. Nothing touches a server, no key leaves the machine, no seed is ever persisted. The public key matrix and error field render live to canvas as the lattice forms, drawn from the actual cryptographic state. A tribute to Luci4. Built for him.

CompletePQCModule-LWEAES-256-GCMNTTPBKDF2JavaScriptTribute#RIPLuci4
// Show Technical Detail
  • Module-LWE Lattice: k=4 module rank over polynomial ring Z_q[x]/(x^256+1). Public key matrix A expanded via HKDF-SHA256 with full domain separation, no splitmix, no shortcuts.
  • NTT Acceleration: Number Theoretic Transform over q=12289 using Cooley-Tukey forward and Gentleman-Sande inverse. Same zeta table traversed in both directions.
  • PBKDF2 · 600K Rounds: Every typed seed is hardened through 600,000 rounds of PBKDF2-SHA256 before touching any cryptographic primitive. Entropy seeds skip hardening, they're already 256-bit.
  • AES-256-GCM: Symmetric layer uses WebCrypto AES-GCM with a 256-bit key derived from the LWE shared secret. Full authenticated encryption with IND-CCA2 implicit rejection.
  • Sigil Visualization: Public key matrix and CBD error field rendered live to canvas as the lattice is forged, each coefficient mapped to color via a structured palette. A visual fingerprint of your key.
  • Zero Persistence: Seed is never written to localStorage, sessionStorage, or anywhere. Close the tab and the key is gone. Intentional.

Talisman

Passive RF Camera Detector

//BLUE

A passive RF reader that picks up camera emissions and vibrates when one is near. Pocket-sized counter-surveillance check.

UnconfirmedRFHardware

Project Fennec

Portable Multi-Tool: RF / Hardware Exploitation

//RED

A Flipper Zero competitor at a higher spec, in a darker shell. WD Black design language: matte black, aggressive, minimal. RF, hardware exploitation, NFC, and IR in one handheld. Still theoretical. I'm settling on the right silicon before committing to a chassis.

TheoreticalHardwareRFEmbeddedC++

NullUSB

Authorized Pentesting: HID Attack Platform

//RED

An HID attack platform for authorized pentest work. Takes the BadUSB concept further: payload delivery, enumeration, and post-exploitation in one inconspicuous stick. For systems you own or have written authorization to test.

InactiveHardwareHIDPentestingC++

Cerberus

Wireless Pentesting Platform: Cyberpunk 2077: Phantom Liberty

//RED

A wireless security research tool on ESP32, themed after Cerberus from Cyberpunk 2077: Phantom Liberty. For self-study in offensive wireless: 802.11 recon, network enumeration, active pentesting. Driven from a black terminal web UI styled as a Cerberus command console, with NeoPixel and buzzer feedback per mode and MQTT for remote command and status. Currently offline while I sanitize it for public release.

In ProgressESP32C++802.11MQTTPentestingNeoPixelWeb UI
GitHubSanitizing for release

NullStrix

Unified Offensive CLI / Continuous Vulnerability Discovery

//RED

Every NullSec offensive tool folded into one CLI. Point it at a URL and it goes down the rabbit holes for you, surfacing every weakness it can reach and listing what it finds.

In ProgressCLIReconVulnerability Discovery

NullNightjar

Classified: Details Pending

//RED

Not yet public. Check back.

Classified

NullPhantom

Classified: Details Pending

//RED

Not yet public. Check back.

Classified

NullRaven

Classified: Details Pending

//RED

Not yet public. Check back.

Classified

Project Odradek

Death Stranding Weather Lamp: ESP32 / Solenoid / 255 RGB LEDs

//SILVER

A working recreation of the Odradek scanner from Death Stranding, running as a weather warning system. Gives 30-minute rain alerts through solenoid-actuated flaps, 255 addressable RGB LEDs, motor-synced movement, and piezo audio tuned to the in-game sound. Dual-core ESP32 runs networking and animation at once. Web UI in the Bridges aesthetic: live system monitoring, OTA updates, multi-location weather, custom alarms, touch gestures for mode switching. Roughly €230–300 to build.

CompleteESP32C++WS2812BSolenoidOpen-Meteo APIWeb UIOTAHardware

Inertia Creeps

Blackwall Audio Visualizer: WebAudio API / Canvas / Spectral Renderer

//COBALT

Real-time audio visualizer with a Blackwall aesthetic. Pipes system audio or mic input through WebAudio, maps the FFT across 210 spectral columns, and renders it pixel-buffer-first into Canvas 2D with floor particles, bloom, and glitch. No frameworks. Runs at 60fps on low-end hardware.

CompleteJavaScriptWebAudio APICanvas 2DFFTReal-Time

NullCut

Local Background Remover

//COBALT

Local background remover. No cloud API, no upload, nothing leaves the machine. Strips backgrounds client-side.

UnconfirmedLocal-FirstImage Processing

RELIC

Cyberpunk 2077-Inspired Memory Drive

//COBALT

A Cyberpunk 2077 build. A memory drive housing a person's identity, modeled on the game's relic/biochip lore. Hardware project.

UnconfirmedHardwareCyberpunk

NullNexus

Homelab Compute Node: Display + Voice Intelligence

//CARBON

A homelab node in two layers. An ESP32 LED panel shows live cluster health: light blue when every node is up, red the moment one drops. A small local LLM sits on top as the server's semi-conscious mind, fed live cluster data so I can ask what's happening across the stack. The original 3D-printed and laser-cut rack is offline; the work now runs on an HP Z440 (22-core/44-thread Xeon) with a Raspberry Pi 4. Still working out how to feed it deep telemetry without opening a security hole.

PausedESP32XeonRaspberry Pi 4LLMLEDProxmox3D PrintLaser Cut

NullOS

Custom Linux Distribution

//GRAPHITE

A Linux distribution from scratch. Kali's security toolset, Ubuntu's daily drivability, and a tuned set of performance tweaks like ZRAM and memory management, in one system you'd actually run. I've cycled through several bases looking for the foundation: Debian 13 with KDE Plasma, CachyOS, NixOS. Alpha now. Kernel-level hardening and deeper privacy work come next.

AlphaLinuxDebian 13CachyOSNixOSKDE PlasmaBashZRAM

WAPPIE CORE

Client Site — Fashion Brand

//FOUNDRY

Client site for WAPPIE CORE, a fashion brand that pushes limits.

Client ProjectNext.jsClient Site

MASA

Client Site — Skate Brand E-Commerce

//FOUNDRY

E-commerce site for MASA, a localized skate brand based in the Netherlands.

Client ProjectE-CommerceClient Site

NullSec-Site

This Site

//FOUNDRY

This site. Next.js, with a live series taxonomy, a proximity-blurred hero, and an ambient network graph running under all of it.

ActiveNext.jsTailwindReact

A.A.I.M

Advanced Artificial Intelligence Memory

//FERRIX

A memory architecture for LLMs. It compresses old conversations into small memory packets that hold the essence, not the bulk. When a topic comes back, it reaches into the relevant log and reconstructs the detail on demand. Conversational continuity without bloating the context window or keeping sensitive data in raw form.

ResearchAIPythonLLMNLP

BT-7274

AI Agent Core

//FERRIX

An AI agent core on the NullNexus architecture, wearing BT-7274's interface and personality, from Titanfall.

UnconfirmedAILLMAgent

ArS-Null

Self-Propagating Worm Research / Paired //BLUE Counter

//BLACKWALL

Self-propagating worm research. Layered //BLUE counter: FIM with tamper-evident baseline, behavioral persistence monitoring, network deception detection, process/memory anomaly detection, hash-chained audit log.

AUTHORIZED — IN SCOPE//BLACKWALL//BLUEwormoffensive research

[REDACTED]

Classified: Details Pending

Not yet public. Check back.

WIP
More tools, scripts, and experiments on github.com/Madis-O ↗