// Projects
What’s Been Built
Wheatley
ESP32 RF Surveillance Detection Node
A passive Wi-Fi sniffer housed in a custom Wheatley (Portal 2) shell. Dual-core ESP32: one core hops all 13 channels pulling raw 802.11 frames, the other pushes analyzed metadata to an MQTT broker on a local Pi. It fingerprints devices by OUI, parses SSID probe requests, and estimates proximity from RSSI. A room-level RF camera. If someone's outside your window with a device that talks, it sees them.
// Show Technical Detail
- RF Scanning + Channel Hopping: Core 0 runs a continuous sniffer task rotating through 13 Wi-Fi channels every 250ms, intercepting raw 802.11 frames invisible to standard clients.
- Intelligent Packet Inspection: Promiscuous callback extracts MAC addresses, frame subtypes, and sequence numbers from intercepted frames.
- Device Fingerprinting: First three bytes of each MAC matched against an internal OUI database: identifies manufacturer (Apple, Samsung, Intel, etc.) on sight.
- SSID + Probe Parsing: Dives into packet payload to extract SSID probe requests: mapping which networks nearby devices have previously connected to.
- Signal Analytics: Calculates avg, min, and max RSSI per detected device to estimate physical proximity to the node.
- MQTT Diplomat: Core 1 periodically pauses sniffing to push two JSON streams to the Pi: a Heartbeat (CPU/uptime) and a Data Pulse (top 20 most active nearby devices).
- Thread Safety: Mutex lock prevents race conditions between cores: no crashes when Core 1 is writing while Core 0 is deleting stale entries.
NULL-BEACON
Phantom Device Generator: BT/WiFi MAC Rotation
A credit-card-sized device that broadcasts a rotating set of spoofed Bluetooth and Wi-Fi MAC addresses. Passive trackers in range log dozens of phantom devices instead of your real hardware. Harder to pick one person out of a crowd that was never there.
SIGIL-CRYPT
Post-Quantum Cryptographic Engine: Module-LWE / AES-256-GCM / NIST L5
An offline, browser-native post-quantum encryption engine. Implements Module-LWE (k=4, n=256, q=12289) with NTT acceleration, PBKDF2 at 600,000 rounds, and AES-256-GCM. NIST Level 5. Nothing touches a server, no key leaves the machine, no seed is ever persisted. The public key matrix and error field render live to canvas as the lattice forms, drawn from the actual cryptographic state. A tribute to Luci4. Built for him.
// Show Technical Detail
- Module-LWE Lattice: k=4 module rank over polynomial ring Z_q[x]/(x^256+1). Public key matrix A expanded via HKDF-SHA256 with full domain separation, no splitmix, no shortcuts.
- NTT Acceleration: Number Theoretic Transform over q=12289 using Cooley-Tukey forward and Gentleman-Sande inverse. Same zeta table traversed in both directions.
- PBKDF2 · 600K Rounds: Every typed seed is hardened through 600,000 rounds of PBKDF2-SHA256 before touching any cryptographic primitive. Entropy seeds skip hardening, they're already 256-bit.
- AES-256-GCM: Symmetric layer uses WebCrypto AES-GCM with a 256-bit key derived from the LWE shared secret. Full authenticated encryption with IND-CCA2 implicit rejection.
- Sigil Visualization: Public key matrix and CBD error field rendered live to canvas as the lattice is forged, each coefficient mapped to color via a structured palette. A visual fingerprint of your key.
- Zero Persistence: Seed is never written to localStorage, sessionStorage, or anywhere. Close the tab and the key is gone. Intentional.
Talisman
Passive RF Camera Detector
A passive RF reader that picks up camera emissions and vibrates when one is near. Pocket-sized counter-surveillance check.
Project Fennec
Portable Multi-Tool: RF / Hardware Exploitation
A Flipper Zero competitor at a higher spec, in a darker shell. WD Black design language: matte black, aggressive, minimal. RF, hardware exploitation, NFC, and IR in one handheld. Still theoretical. I'm settling on the right silicon before committing to a chassis.
NullUSB
Authorized Pentesting: HID Attack Platform
An HID attack platform for authorized pentest work. Takes the BadUSB concept further: payload delivery, enumeration, and post-exploitation in one inconspicuous stick. For systems you own or have written authorization to test.
Cerberus
Wireless Pentesting Platform: Cyberpunk 2077: Phantom Liberty
A wireless security research tool on ESP32, themed after Cerberus from Cyberpunk 2077: Phantom Liberty. For self-study in offensive wireless: 802.11 recon, network enumeration, active pentesting. Driven from a black terminal web UI styled as a Cerberus command console, with NeoPixel and buzzer feedback per mode and MQTT for remote command and status. Currently offline while I sanitize it for public release.
NullStrix
Unified Offensive CLI / Continuous Vulnerability Discovery
Every NullSec offensive tool folded into one CLI. Point it at a URL and it goes down the rabbit holes for you, surfacing every weakness it can reach and listing what it finds.
NullNightjar
Classified: Details Pending
Not yet public. Check back.
NullPhantom
Classified: Details Pending
Not yet public. Check back.
NullRaven
Classified: Details Pending
Not yet public. Check back.
Project Odradek
Death Stranding Weather Lamp: ESP32 / Solenoid / 255 RGB LEDs
A working recreation of the Odradek scanner from Death Stranding, running as a weather warning system. Gives 30-minute rain alerts through solenoid-actuated flaps, 255 addressable RGB LEDs, motor-synced movement, and piezo audio tuned to the in-game sound. Dual-core ESP32 runs networking and animation at once. Web UI in the Bridges aesthetic: live system monitoring, OTA updates, multi-location weather, custom alarms, touch gestures for mode switching. Roughly €230–300 to build.
Inertia Creeps
Blackwall Audio Visualizer: WebAudio API / Canvas / Spectral Renderer
Real-time audio visualizer with a Blackwall aesthetic. Pipes system audio or mic input through WebAudio, maps the FFT across 210 spectral columns, and renders it pixel-buffer-first into Canvas 2D with floor particles, bloom, and glitch. No frameworks. Runs at 60fps on low-end hardware.
NullCut
Local Background Remover
Local background remover. No cloud API, no upload, nothing leaves the machine. Strips backgrounds client-side.
RELIC
Cyberpunk 2077-Inspired Memory Drive
A Cyberpunk 2077 build. A memory drive housing a person's identity, modeled on the game's relic/biochip lore. Hardware project.
NullNexus
Homelab Compute Node: Display + Voice Intelligence
A homelab node in two layers. An ESP32 LED panel shows live cluster health: light blue when every node is up, red the moment one drops. A small local LLM sits on top as the server's semi-conscious mind, fed live cluster data so I can ask what's happening across the stack. The original 3D-printed and laser-cut rack is offline; the work now runs on an HP Z440 (22-core/44-thread Xeon) with a Raspberry Pi 4. Still working out how to feed it deep telemetry without opening a security hole.
NullOS
Custom Linux Distribution
A Linux distribution from scratch. Kali's security toolset, Ubuntu's daily drivability, and a tuned set of performance tweaks like ZRAM and memory management, in one system you'd actually run. I've cycled through several bases looking for the foundation: Debian 13 with KDE Plasma, CachyOS, NixOS. Alpha now. Kernel-level hardening and deeper privacy work come next.
WAPPIE CORE
Client Site — Fashion Brand
Client site for WAPPIE CORE, a fashion brand that pushes limits.
MASA
Client Site — Skate Brand E-Commerce
E-commerce site for MASA, a localized skate brand based in the Netherlands.
NullSec-Site
This Site
This site. Next.js, with a live series taxonomy, a proximity-blurred hero, and an ambient network graph running under all of it.
A.A.I.M
Advanced Artificial Intelligence Memory
A memory architecture for LLMs. It compresses old conversations into small memory packets that hold the essence, not the bulk. When a topic comes back, it reaches into the relevant log and reconstructs the detail on demand. Conversational continuity without bloating the context window or keeping sensitive data in raw form.
BT-7274
AI Agent Core
An AI agent core on the NullNexus architecture, wearing BT-7274's interface and personality, from Titanfall.
ArS-Null
Self-Propagating Worm Research / Paired //BLUE Counter
Self-propagating worm research. Layered //BLUE counter: FIM with tamper-evident baseline, behavioral persistence monitoring, network deception detection, process/memory anomaly detection, hash-chained audit log.
[REDACTED]
Classified: Details Pending
Not yet public. Check back.