Skip to content
Berkan YILDIZ
Blog Lire en français

Berkan YILDIZ

Security researcher & low-level engineer

I take software apart to see how it actually works. Then I write what runs underneath it: UEFI drivers, Windows kernel drivers, VT-⁠x hypervisors.

contact@berkan.fr
LinkedIn GitHub

About

I’m Berkan, a 27-year-old engineer, and everything I know I taught myself. I wrote my first lines of code at 11 and built my first PHP sites around 13. Since then I’ve worked my way down the whole stack: web platforms and databases first, then Windows drivers, firmware and hypervisors.

Where I’m most at home is below the Windows API. EDK2 and the UEFI boot flow: DXE drivers and everything that runs before ExitBootServices hands the machine to Windows. Windows kernel drivers with the WDK and KMDF: IRPs, IOCTL interfaces and the user-mode code that talks to them. Intel VT-⁠x and EPT, Hyper-⁠V internals, memory management, and the hardware identifiers a machine gives away.

Through Swayor I also build whole products on my own — customer dashboards, licensing, payments, APIs, automation — and I run the infrastructure under them myself: Debian servers, DNS, TLS, firewalls, backups, monitoring.

Owning a hard problem alone, from the research and the architecture to shipping and support, is just how I work.

I’m old school.

C, C++, C#, PHP (Laravel), Windows kernel, UEFI, cybersecurity.

Experience

Founder & sole engineer · Swayor

— Present

Paris · Remote · Cybersecurity and software engineering, made in France.

I started Swayor in 2015 and I’m still its only engineer. We audit software, games and Windows systems, write low-level code — UEFI firmware, bootloaders, kernel drivers, hypervisors — and build complete products, from the customer dashboard down to the server it runs on.

  • Security audits
  • Reverse engineering
  • Game security
  • Firmware & kernel drivers
  • Hypervisors
  • Products & infrastructure

Education

Lycée Joliot-Curie · ITEC track

2015 — 2017

Projects

  • EfiKekPkg

    — Present

    UEFI-based Intel VT-⁠x hypervisor

    A hypervisor that starts before Windows does. It loads as an EDK2 DXE driver, turns on VMX, configures the VMCS and launches Windows as a guest in VMX non-root mode. From there it sees execution, memory accesses and CPU events from underneath, without relying on a single Windows API or driver.

    Highlights
    • EPT: dynamic permissions, large-page splitting and violation handling
    • MSR, exception and NMI-window exiting
    • Per-core hypervisor state on every logical processor
    • Hyper-⁠V internals, synthetic MSRs and guest OS identification
    • Firmware-level logging and hardware-assisted debugging
    • C/C++
    • UEFI / EDK2
    • VMX
    • EPT
    • x86-64 assembly

  • HwidSpoofer

    — Present

    Windows hardware identity research & spoofing suite

    A kernel driver, a WPF client, service libraries and a Discord-based orchestration system. It takes control of the identifiers used to fingerprint a machine — disk serials, network adapters, SMBIOS and other values the firmware exposes — from a privileged layer, so Windows presents one consistent alternate hardware profile.

    Highlights
    • Kernel driver talking to user mode over IOCTLs
    • Research into hardware identifiers and fingerprinting surfaces
    • Pre-OS setup through EfiKekPkg
    • WPF client, licensing, Discord automation and deployment pipeline
    • C/C++
    • C#
    • .NET 10
    • WPF
    • WDK

  • Private game servers

    Mobile game reverse engineering

    Where the reverse engineering started. I took Supercell’s games apart — Clash of Clans and Boom Beach, then Clash Royale and Brawl Stars as soon as they launched — worked out their network protocols, and wrote servers the official clients could connect to.

    Highlights
    • Reverse engineering of the game clients and their network protocols
    • Server emulation for Clash of Clans, Boom Beach, Clash Royale and Brawl Stars
    • Clash Royale server, client and proxy, published as open source
    • PUBG lobby backend emulation, also open source
    • Clash of Clans
    • Boom Beach
    • Clash Royale
    • Brawl Stars

Also: BadPing, and a pile of backend, automation and infrastructure tools running in production.

From user mode down to the firmware.

Most security work stops at the OS. Mine keeps going, through every privilege level, down to the code that runs before Windows even boots.

  1. Ring 3

    User mode

    Apps and games: reverse engineering, protection analysis, security audits.

    HwidSpoofer’s WPF client and Discord orchestration

  2. Ring 0

    Kernel mode

    Windows internals: kernel drivers, IOCTL interfaces and the kernel’s attack surface.

    HwidSpoofer’s kernel driver and its IOCTL interface

  3. Ring −1

    Hypervisor

    Hardware virtualization: Intel VT-⁠x, VM introspection, memory virtualization with EPT.

    EfiKekPkg’s VT-⁠x hypervisor: VMCS, EPT

  4. Ring −2

    Firmware

    UEFI and the boot chain: DXE drivers, bootloaders, everything that runs before the OS.

    EfiKekPkg’s UEFI DXE driver (EDK2)

HwidSpoofer’s driver builds on EfiKekPkg, which the firmware loads before Windows, so part of the trust boundary moves earlier in the boot chain.

Open source

Libraries and tools I’ve put on GitHub, from Windows kernel development to game server emulation.

  • ClashRoyale C# 83 stars on GitHub

    Server, client and proxy for Clash Royale.

  • Driver.NET C# 71 stars on GitHub

    Load kernel drivers and talk to them from .NET. Small and flexible.

  • EasyNT C++ 34 stars on GitHub

    A wrapper around the Windows kernel API: simpler functions, plus extensions for enterprise drivers.

  • Microsoft.PdbDownloader C# 25 stars on GitHub

    Drop a Windows executable on it and it fetches the matching PDB from Microsoft.

  • LoggerNT C++ 21 stars on GitHub

    Logging for Windows NT kernel drivers.

  • PlayerUnknown.Servers C# 17 stars on GitHub

    PUBG lobby backend emulation with hostname redirection, built for the 2017–2018 version of the game.

All repositories on GitHub

Writing

What I dig up reversing Hyper-⁠V, Windows internals and UEFI firmware, written up with the disassembly and code to prove it.

All writeups on the blog

Skills

I break things to understand them — and build things that are hard to break.

Audit & research

  • Security audits

    Source and binary review of apps and services, with findings you can actually act on.

  • Game security

    Game clients, network protocols, anti-cheat and anti-tamper. I’ve been reversing games since 2016.

  • Windows internals

    Drivers, services and the attack surface Windows exposes.

  • Reverse engineering

    Binaries, protocols and protections taken apart. Source code optional.

Low-level engineering

  • UEFI firmware & bootloaders

    EDK2 DXE drivers and pre-OS code that runs before Windows does.

  • Kernel drivers

    Windows kernel drivers on the WDK and KMDF, plus the user-mode code that talks to them.

  • Hypervisors

    Intel VT-⁠x: VMX, VMCS, EPT, MSR and exception exiting.

  • Products & infrastructure

    Complete products — dashboards, licensing, payments, APIs — and the Debian servers they run on.

Toolbox

Languages
  • C
  • C++
  • C#
  • x86-64 assembly
  • PHP
Low level
  • WDK
  • KMDF
  • UEFI / EDK2
  • Intel VT-x
  • EPT
  • Hyper-V
Backend & apps
  • Laravel
  • .NET
  • WPF
  • MariaDB / MySQL
  • Visual Studio
Infrastructure
  • Debian
  • Proxmox
  • Networking
  • DNS
  • TLS
  • Firewalls

Let’s talk.

I take freelance work on Windows internals, kernel drivers, reverse engineering, UEFI and firmware, hypervisors, backends and infrastructure. If it’s technically hard, send it my way.

contact@berkan.fr
LinkedIn GitHub swayor.fr