Systems Engineer  ·  Farmer

ABHIVIR
CHAUDHARY

Building systems software that operates at the edge —
C2 frameworks, forensic tooling, local AI infrastructure.
Everything in Rust.▋

Location India
Focus Systems · Security · Red Teaming
Stack Rust · C · Zig
0 tools ~0 lines of Rust 0 bypassed EDRs
About

Build precise.
Operate silent.

>I build low-level systems software — primarily C2 frameworks, forensic tooling, and local AI infrastructure. My constraint is simplicity: every component should do exactly one thing, and do it without leaving traces it doesn't intend to leave.

>Everything I ship is written in Rust. Not as ideology, but because the properties matter — memory safety without a runtime, predictable performance, a type system that makes the wrong states unrepresentable. Rust stdlib only on implant-side code where possible. No unnecessary dependencies.

>When I'm not building C2 infrastructure, I'm thinking about user-facing tooling for local AI — how to build an interface that doesn't get in the way, that works offline, that respects the fact that your conversations are yours.

>Vesper, Rook, Reperio, and Halter are the four active projects. Each is designed to be self-contained, properly documented, and usable without reading a wiki.

Software that operates at the edge demands precision over cleverness. Every byte of a payload is intentional. Every recovered file is verified. Every local inference stays local. The tools I build are built to be trusted.

Projects

Selected work

06 systems
01 · WINDOWS 10/11 · OFFENSIVE 1

Vesper

Per-build payload forge for Windows.

Every generated implant speaks a different wire dialect, carries different embedded constants, and produces a different binary hash — no shared path, header, key, or framing between builds.

Windows 10/11 Rust (stdlib-only implant) AES-GCM
  • Per-build dialect derivation + AES-GCM crypto
  • In-memory PE loader, no disk writes
  • Rust stdlib-only implant — no external deps
RustC2WindowsPE LoaderAES-GCMHTTP

source private contact for demo ↗

architecture
Vesper architecture
full page ↗

Two builds of the same implant, side by side. Every observable — key, framing, HTTP path, binary hash — differs per build; the C2 server is the only component they share, and the wire carries no repeating byte string.
Rook architecture
full page ↗

Three independent Diffie-Hellman pairs in sequence: ephemeral and static public keys out of the implant, an ephemeral public key back from the server. All three contributions are folded into one HKDF pass.
Currently
building
activity feed ──────────────
Building
Rook — macOS/Linux C2 framework. Triple-DH handshake, persistent pty sessions, Ratatui operator TUI. Fresh binary every build via Zig cross-compile.
WIP
Learning
Going deep on offensive security — Windows internals, evasion primitives, memory forensics, network protocol analysis.
Active
Exploring
Custom C2 architecture patterns — malleable comms profiles, encrypted staging chains, operator OPSEC at the infrastructure level.
Deep
Writing
04 notes
Nov 2026
Why I Built My Own C2
Every publicly known C2 framework carries a problem it can never fully escape: its payload signatures are already in AV and EDR databases before you even compile. Defenders don't need to reverse your implant — they've seen it before. The only way to change that equation is to build something they haven't. Vesper exists because off-the-shelf tooling has a known shape, and a known shape gets caught. When you control the wire protocol, the binary layout, and the crypto from the ground up, you don't have a signature — you have noise.
C2 AV Evasion EDR Rust
↗
Oct 2026
What Deleted Files Actually Leave Behind
Deletion is a lie the filesystem tells you. On NTFS, the MFT record stays. On APFS, the inode lingers. On ext4, the block pointers sit untouched until something else needs the space. Reperio doesn't guess — it reads the raw structures directly, reconstructs the original path, and verifies every recovered byte. If a file comes back damaged, you know exactly how damaged. No false recoveries, no silent corruption.
Forensics NTFS APFS Rust
↗
Oct 2026
The Case for a macOS and Linux Implant
Most C2 tooling is built for Windows. macOS and Linux get treated as afterthoughts — a port, a wrapper, something that mostly works. Rook starts from the other direction. The implant is native to both platforms, compiled fresh per-build via Zig cross-compile so the binary hash changes every time. The handshake is triple-DH. Sessions are AES-256-GCM from first byte. Developers, security engineers, and infrastructure teams run macOS and Linux. If your implant can't operate there cleanly, you're missing the most interesting targets.
C2 macOS Linux Rust
↗
Sep 2026
Your AI Client Shouldn't Know Who You Are
Most LLM frontends require an account. Your conversations live on someone else's server. Your API keys pass through layers you don't control. Halter flips that model entirely — no account, no cloud sync, no telemetry. It connects your phone directly to a local or self-hosted backend. Your API keys never leave your device. Your conversation history is a SQLite file you own. The inference happens where you decide it happens, and nobody else is in the room.
Privacy Local AI iOS Rust
↗
The best tool is the one that leaves no trace of itself — only the work it was built to do.
Abhivir Chaudhary
Connect

Find me
on the wire.

I'm mostly building in public, but Vesper and Rook stay closed — they are small enough to be lifted wholesale and sharp enough to be misused. Ask me for a walkthrough. Issues, PRs and questions on the rest are welcome, and if you want to talk systems, security or Rust, find me on Twitter.

GitHub · abhivirchaudhary Source Twitter · @abhivirchaudhry Social