Hi, I'm
Chris Stahly
I hack shit(and listen to space trash)
Reverse engineer and application security specialist with 20+ years breaking, protecting, and understanding software. OSCP certified. Purdue CS.
Live
What the antennas hear right now
Two receiver sites - a backyard mast in Indiana and a weatherproof box on the Florida Gulf coast - feeding software-defined radios around the clock. Pick a feed.
Aircraft, two stations, one map
Two ADS-B receivers. One in a in , one in . Both decode 1090 MHz Mode S off dump1090. Every marker is a position one of them is hearing right now, colored by which one caught it. Arrowheads point along the track.
▲ Destin 0·▲ Indiana 0·0 aircraft live
Play
Two word games, right here
Both run in the page. Regexword has a new daily; Wordrack puts you against Lex on a 5x5.
Regexword
Every row and column is a pattern. Fill the grid so all of them match at once. The real ones are crossword grids, black squares and all.
or a small one, right here · 0 of 16 filled
^[DFH][MOR][BEF][MNP]$^[ACI]+$^.[KLNO][ACD][PR]$^(.)[VXY]\1[BEFH]$^(CH|FI)(VF|SH)$^O[IK]L[YZ]$^[EH][AB]CH$^[PQ]I[PQ]E$Tap a square and type. A clue goes green when its line matches, red when it cannot.
The full gridsBuilds
Radios, reverse engineering, home automation, a word game. Source is linked where the repo is public.
Police and fire scanner
One radio follows both county trunked systems, transcribes every transmission, and groups them into incidents on a map.
- SDR
- OP25
- Whisper
Scanner for CarPlay
The native client for the scanner: the same incident map and live audio, on the dashboard screen.
- Swift
- CarPlay
Weather satellite capture
Predicts the pass, records it, decodes it, judges whether it came out, and publishes the good ones. It runs unattended.
- RTL-SDR
- LRPT
- Python
ORBCOMM fixes
These satellites broadcast their own GPS position. This is where they said they were.
- RTL-SDR
- 137 MHz
Aircraft, two stations
One receiver in Indiana, one in a weatherproof box on a Florida roof, on the same map.
- ADS-B
- 1090 MHz
Ships off the Gulf
A discone on the Florida coast hearing every vessel in VHF range, both AIS channels at once.
- AIS
- VHF
Quest 1 to postmarketOS
Putting Linux on a locked VR headset, then writing a stereo renderer, lens correction and head tracking from nothing.
- Reverse Engineering
- ARM64
- Linux
Wordrack
A crossword tile game with a computer opponent. No accounts, no install. Send someone the link.
- Game
- Node
Home mood engine
Lighting that follows the day. A color rotation runs continuously, and what is happening in the house bends it.
- Home Assistant
- Python
Warren
A wake-word speaker on a board I generated from a script, and a listener that groups the day's speech into conversations.
- ESP32-S3
- Whisper
- KiCad
Fathom
A Metal treemap of a whole volume that reconciles what it can see against what the system claims is used.
- Swift
- Metal
- macOS
Wardriving rig
A Pi that logs every Wi-Fi network and Bluetooth device it hears with a position, starts and stops on geography, and writes up each drive.
- Kismet
- BLE
- GPS
Latch
An iPhone panel for the house on the Camera Control button, which opens from the lock screen.
- Swift
- iOS
- ExtensionKit
About
A bit about me
I take software apart to see how it works, then either break it or make it harder to break. Mostly at the binary level.
Twenty years of it: binary analysis, crypto architecture, anti-tamper, anti-cheat, threat modeling, and running security engineering at the director level. The useful part of the job is usually working out what is actually at risk, which is rarely what anyone expected.
- ▸Reverse Engineering
- ▸Cryptography
- ▸Application Security
- ▸Threat Modeling
- ▸Binary Analysis
- ▸Anti-Tamper
- ▸Penetration Testing
- ▸OSCP
Work
Selected work
Mobile Application Protection
Anti-tamper and anti-reverse-engineering for banking, health and gaming apps. Binary instrumentation, runtime integrity checks, crypto obfuscation. It shipped on hundreds of millions of devices.
- Binary Analysis
- Anti-Tamper
- Cryptography
- iOS/Android
Medical Device Security Program
Built the security engineering program at a regulated medical device maker, starting from nothing: threat modeling, vulnerability assessment, code review, and a pen-test framework that reported numbers the executives could act on.
- Threat Modeling
- Penetration Testing
- Risk Assessment
- SDLC
Game Anti-Cheat & DRM
Anti-cheat and DRM for desktop and mobile games. Each protection plan was built from that game's own threat data: anti-debugging, license enforcement, integrity checks, and hiding the assets worth stealing.
- Anti-Cheat
- DRM
- Reverse Engineering
- Gaming