Info

That’s all for now. If you'd like to reach me out, you may find me on Discord: it is where I’m most active and where I primarily conduct business.Have a pleasant stay!

Music

• SoundCloud
• Instagram
• Spotify

Frequently Asked Questions

• Professional
• Business
• Personal
• Artificial Intelligence

Professional

• Return

Frequently Asked Questions

• Professional
• Business
• Personal
• Artificial Intelligence

Business

• Return

Frequently Asked Questions

• Professional
• Business
• Personal
• Artificial Intelligence

Personal

• Return

Frequently Asked Questions

• Professional
• Business
• Personal
• Artificial Intelligence

Artificial Intelligence

• Return

Role

❖ Versatility ❖

❖ Management ❖

❖ Areas of Interest ❖

I have ranging experience in the fields specified in the following table:

❖ Tools of the Trade ❖

Some of the tools and software I am familiar with:

❖ Tasks ❖

Some of the roles and tasks I’ve undertaken so far include:

• Return

Qualifications

Portfolio

• Art & Design
• Software D&D
• Game D&D
• Discord D&D
• Articles

Game Development & Design (WIP)

• Security Engineering

Security Engineering

I began game development in 2021 as a modder for a private game server operating in a highly adversarial environment where service disruption and asset theft were persistent threats. These circumstances forced me to adapt quickly and develop pragmatic and often unconventional solutions to maintain security and stability in a hyper-competitive ecosystem.What often felt like an endless hackathon pushed me to study obfuscation and deobfuscation, reverse engineering, cybersecurity, cryptography, and asset protection. I learned that effective security requires understanding how systems can be disrupted and dismantled by thinking like an attacker, so that countermeasures can be designed around realistic models rather than assumptions.I would not describe myself primarily as a security engineer, nor was security a field I initially set out to pursue. However, working on online games meant that security concerns were inseparable from development itself as each update carried the potential to introduce new vulnerabilities, and as a result, security became embedded in my development process rather than treated as a separate discipline, and it is in that context that I discuss it here.The articles below reflect my experience as a game developer working in highly competitive and hostile environments where I often had to assume security responsibilities without formal training in the field, improvising and learning through hands-on work to deal with real security problems.

Field Reports

Buying Time: A Practical View of Asset Security

When it comes to asset protection, it is not about creating an impenetrable system, as such a goal is neither realistic nor achievable, rather about introducing sufficient deterrence to destroy an attacker’s return on investment (ROI), and ultimately their motivation.In one case, the game client relied on AES-256 encryption for asset bundles totaling over 15 GB, which proved safe but excessive for the intended purpose. The client depended on constant runtime decryption of AssetBundles and was built on an older framework (Unity 5.5). Because this pipeline relied on memory-based loading, it required encrypted bytes, decrypted bytes, and the reconstructed AssetBundle to coexist in memory during loading, which led to memory surges and prolonged load times.Loading bundles directly from disk rather than memory was the most efficient approach from a performance standpoint, but it would also have made the assets vulnerable to theft, which was common within the ecosystem since multiple servers shared the same client, making stolen assets trivial to integrate once decrypted.Given these constraints, I investigated both the technical framework and the practical capabilities of competing servers and concluded that cryptographic protection coupled with memory-based loading was imposing a higher cost on users than on attackers. Rather than pursuing encryption, I devised a makeshift strategy to secure the assets in a more optimized way.I removed bundle encryption entirely and instead introduced deliberate structural incompatibility by spoofing Unicode characters in the bone names of rigged wearables and hairstyles, which is something not many would expect. These identifiers were corrected internally at load time through an obfuscated DLL so the assets functioned normally within the intended client. However, when competitors attempted to integrate the unencrypted bundles directly, the mismatched bone names caused the rigs to break without any error code, preventing immediate reuse. Because the spoofed Unicode characters appeared visually identical during inspection, the failure mode was not obvious. This made diagnostics difficult and time consuming as there were many plausible causes for a broken rig. This leveraged Unicode homographs to undermine visual inspection trust, since most asset inspection tools render identifiers at the glyph level and do not expose non-ASCII or confusable code points.Exploiting this visual inspection trust led attackers to conclude that the only remaining option for integration was asset extraction and reconstruction: exporting meshes and textures individually, performing placement, weight painting, recreating blendshapes, and similarly time consuming tasks.Additionally, shaders for Unity 5.5.5p2 could not be decompiled using DevX or UABE, which were the primary tools competitors relied on at the time. However, leaving these shaders in unencrypted bundles would have allowed direct bundle integration and reuse through runtime assignment. For this reason, they were deliberately kept in a separate encrypted bundle, as custom legacy shaders were rare and therefore valuable. This prevented visual fidelity from being replicated outside the intended client and added further deterrence.Together, these measures substantially increased the time, effort, and expertise required to reuse the assets, effectively destroying the attackers’ return on investment within that ecosystem.In the end, this approach involved calculated risk and an asymmetric defense that deliberately targeted attacker tooling assumptions and human inspection habits, and it proved effective. I did not make the system secure in an absolute sense, nor did I consider it a long term protection. Rather, I introduced a targeted low-cost structural incompatibility that raised attacker cost and time investment enough to function as an effective deterrent, while simultaneously improving AssetBundle loading performance for end users in order to preserve project survivability during its growth phase.At times, simple and pragmatic solutions such as these can be sufficient for the task at hand. Security, in this context, is about stalling until a project achieves decisive success and reaches a point where such disruption no longer matters. This is my view of asset security: buying time, and making use of that time to gain a lasting edge.

Ms. Dysphoria

31.12.2025

Defense Proportional to Threat: Pragmatic DDoS Mitigation for Resource-Constrained Systems

The first time I was approached by a self-described cybersecurity engineer was during an active DDoS attack on a game server I had been contracted to support. The offer of protection arrived almost immediately after the disruption began. Combined with the fact that the contactor was effectively anonymous and unwilling to disclose any base of operations or verifiable portfolio, this raised reasonable suspicion that the situation followed one of the oldest tricks in the book: quietly introducing a problem and then offering a paid solution.Service disruption through DDoS attacks is sometimes employed by individuals without legitimate cybersecurity credentials, who rely on the appearance of authority to engage in disguised extortion. It is also common in highly competitive environments, largely because it is easy to execute and requires minimal resources relative to the impact it can produce. When paired with aggressive advertising, such attacks can be leveraged by competitors as a means of growth by pressuring users into migration, particularly in social games where the player base represents the platform’s most valuable asset, effectively functioning as a form of asset theft in a business sense.At the scale most game servers operate, the majority of DDoS incidents are carried out using readily available tools and services by individuals lacking in-depth expertise. These attacks often rely on a single attack vector rather than a coordinated multi-layer strategy, and for this reason, most incidents at this scale don't require complex or enterprise-grade solutions to mitigate effectively.After testing numerous service providers, I observed that low-tier offerings frequently failed to provide sufficient filtering or effective anti-DDoS protection. Some mid-tier providers offered more capable defenses, such as custom traffic filtering algorithms or challenge-based systems like captchas to mitigate botnet traffic. However, when operating under strict budget constraints, relying on third-party protection can become a process of frustrating trial and error.As a result, rather than relying solely on external mitigation providers, I proceeded to design ways for low-cost, in-house protection mechanisms tailored to the attack patterns most commonly encountered in this environment, which I'll be outlining without going into deep technical detail. Those interested may contact me for details.At the scale of small to mid-sized game servers, the majority of disruptive traffic tends to originate from automated tools or commodity botnets that are effective at generating volume but lack the ability to accurately emulate full client behavior at the application layer. While proxy-based attacks are more capable, they would require custom tooling and knowledge of the client-server interaction model to be effective.To exploit this distinction, the system defaulted to a deny-by-default posture: the game service itself was not directly reachable. Clients were first required to pass through a controlled admission phase on a separate endpoint, where a verification exchange was performed using authenticated client data and multiple contextual identifiers. Only after successful validation was temporary access to the game port granted, while invalid or malformed requests triggered rate limiting or temporary blacklisting at the authentication layer.The client-side logic responsible for generating this verification data was hardened through encryption and obfuscation, raising the cost of replication and making automation difficult. While a sufficiently motivated adversary could reproduce the behavior with custom tooling after reverse engineering the client behavior, this approach proved highly effective against the prevalent attack methods observed in practice, without requiring enterprise-grade infrastructure or solutions.In practice, this model functions as an application-layer admission control system. By increasing the strictness and complexity of client authentication and validation, it significantly reduces exposure to low-effort automated attacks without materially impacting legitimate users.The approach is extensible and can incorporate intermediary systems to offload verification and absorb abusive traffic. Cloud-based identity and edge services, such as managed authentication layers or WAF-backed entry points provided by platforms like AWS or Azure, can be introduced during the admission phase rather than in front of the game service itself.In constrained environments, this model can also be adapted to platforms not originally designed for traffic gating. Discord-based admission flows, implemented via bots, introduce additional friction but can function as a viable alternative where service disruption is frequent and attacker sophistication remains limited. In this context, Discord acts as an abuse sink and a human-proof-of-work mechanism for authentication.While these additional authentication steps may inconvenience some users, the trade-off is often preferable to sustained service instability or complete downtime. In this context, a deny-by-default posture combined with explicit whitelisting prioritizes service availability and operational stability over frictionless access.Ultimately, when attacker sophistication is limited and resources are constrained, pragmatic in-house filtering strategies can outperform generalized outsourced defenses. At this scale, stability is often achieved not by going for expensive solutions, but by creatively implementing gating mechanisms and repurposing available tools to reduce exposure and enforce controlled admission. Defense, in this context, is less about perfection and more about denying attackers the convenience they rely on.

Ms. Dysphoria

03.01.2025

• Return

Portfolio

• Art & Design
• Software D&D
• Game D&D
• Discord D&D
• Articles

Art & Design

• Return

Portfolio

• Art & Design
• Software D&D
• Game D&D
• Discord D&D
• Articles

Software Development & Design

• Return

Portfolio

• Art & Design
• Software D&D
• Game D&D
• Discord D&D
• Articles

Discord Development & Design

• Return

Portfolio

• Art & Design
• Software D&D
• Game D&D
• Discord D&D
• Articles

Articles