About
I'm Andrea Bertorello — d4edalvs on the internet. A security research engineer: I break things at the memory level, and then I go build the thing that stops them.
That order matters. You can't defend a perimeter against a technique you've never run. Most of what gets sold as defensive security is a control someone bought off a slide, deployed by people who have never watched it fail. I'd rather write the exploit first and find out.
What I do
Research.Memory corruption, mostly Linux userland and kernel on x86-64. I pull binaries apart, build the primitive, then keep going until I understand why the mitigation that was supposed to catch it didn't. The interesting part is never the crash. It's the twenty minutes afterwards, when you find out the defense had a gap nobody had written down.
Defense.The other half of the week: perimeter architecture, segmentation, detection that survives contact with a real technique instead of matching a signature for last year's tool. Same problem approached from the far side, and the thing that keeps the research half honest.
Why break things
Split those two apart and you get what the industry has now: attackers who can't explain a mitigation, and defenders who can't explain the bug they're mitigating — both arguing about a control neither can describe. Purple team isn't a workshop where red and blue have lunch together. It's refusing to accept they're different skills.
On this site
Long-form deep dives that carry a technique from the bug to the defense that answers it. Research notes on things I'm still wrong about. The occasional lab you can run yourself, because a technique you haven't executed is a technique you've read about.
Written to be transferable rather than impressive — the explanation I wanted when I was stuck.
Focus areas
Ethics and responsible research
This site is for education, research, and defensive understanding. Exploitation techniques are explained so readers can understand, detect, and prevent them.
Anything hands-on assumes systems you own or are explicitly authorized to test — labs, CTFs, and responsible disclosure. Don't use it against systems you don't have permission to touch.
The views expressed on this site are my own and do not represent my employer.
Get in touch
LinkedIn is where the CV lives, if you want the formal version or to argue about something I wrote. GitHub is where the code is.