Notas de campo · Índice18 entradasRSS ↗
Mergulhos profundos nas decisões técnicas por trás do meu trabalho.
Sistemas de engine, pipelines de segurança, síntese de áudio, análises de game design, investigações de incidentes. Alguns posts técnicos são detalhados o bastante para eu reconstruir o projeto a partir deles — e é essa a ideia!
Notas de campo · Índice
- 18SegurançaNº 18Segurança4 min
Onde uma atualização ruim é barrada: integridade de atualizações para dispositivos offline e regulados
Um dispositivo sem internet ainda precisa receber atualizações, e cada uma é uma chance de rodar código que ninguém aprovou. Seis formas de uma atualização dar errado, uma em que ela dá certo, e a estação do caminho que barra cada falha. Um padrão genérico, não a implementação de nenhum fornecedor.4 min - 17SegurançaNº 17Segurança12 min
A frota que não existe: um app na Play Store, um CNPJ de 3 semanas e o Ponzi dos robotáxis mirando o Brasil
O Taxinexo vende a brasileiros uma cota de uma frota de táxis autônomos que roda sozinha por Nova York e paga 90% ao mês. A frota é uma folha de sprites, as corridas são um cron job, e a empresa por trás é uma varejista de eletrônicos com 3 semanas de vida num escritório virtual na Avenida Paulista. As evidências, a aritmética e a linha do tempo do colapso. Constatações e raciocínio, não um guia de derrubada.12 min - 16Sistemas de engineNº 16Sistemas de engine22 minEN
How direct drive force feedback actually works
Direct drive does not add feel. It removes the mechanical filters that gear and belt reduction stages impose. A trace of one number, from the tire model to torque at the rim.22 minEN - 15SegurançaNº 15Segurança18 minEN
Capabilities over signatures: the design behind a .blend inspector, and the provenance layer that sidesteps the fight
The technical companion to The weight of a hyphen. Two questions you can ask of a file that runs itself, what will it do and who made it, decompose into a detection problem you can only draw and a provenance problem you can win. The capability model that keeps a static inspector from drowning in false positives, the four-move evasion arms race and the four answers, and the signing math that makes a pirated copy fail by arithmetic. Architecture and decisions, not source.18 minEN - 14SegurançaNº 14Segurança16 minEN
The weight of a hyphen: a lookalike domain, a self-running file, and the inspector I built to catch it
A friend's Blender community was bleeding Discord accounts, and one of his domains had started serving malware. The domain was never his, the attack rode a single missing hyphen, and the real leak was a thousand endpoints. The investigation, the file format that runs itself, and the tool I built so Blender stops asking you to trust blind. Narrative and decisions, not a playbook.16 minEN - 13SegurançaNº 13Segurança31 minEN
Calibration as infrastructure: building a detonation lab
Six stages, four tensions, and the engineering decisions that determine whether a detonation lab earns its keep. How specimens enter, deploy, detonate, are observed, are analysed, and are archived, with notes on the tradeoffs that recur at every stage and the boring parts that compound over years. Architecture and decisions, not code. Engineering register, not academic.31 minEN - 12HardwareNº 12Hardware20 minEN
The thermal wall: how phones and handhelds spend the same watt-budget two different ways
Mobile silicon stopped being transistor-limited and became heat-limited. This is a deep dive on what actually moves the heat (graphite, vapor chambers, fans) and the software that decides who gets throttled first, read across two device classes that answer the same thermal equation in opposite directions.20 minEN - 11SegurançaNº 11Segurança41 minEN
Below the burn line: the architecture of operator infrastructure
Three tiers, four attribution surfaces, and the analyst posture they are all calibrated against. Why operator infrastructure decomposes into long-haul, redirector, and staging tiers, what discipline each tier requires across DNS, TLS, behavioural, and financial surfaces, and how the operator's own workstation becomes the single point of correlation that none of the tier discipline addresses. Architecture and decisions, not configuration. Methodology, not playbook.41 minEN - 10ComposiçãoNº 10Composição10 minEN
A signal teardown of "The World That Bears My Name"
The technical companion to the composition writeup. Same track, opposite lens: what the rendered audio measures, why a beat tracker reads the meter wrong, how the dynamics are engineered across four minutes, and the one master decision the numbers say I got wrong. The why lives in the other post; this is the how.10 minEN - 9ComposiçãoNº 9Composição14 minEN
The World That Bears My Name: writing the voice of the one who burned the world
Ashlight's main theme is sung from inside the error the whole game is about not repeating. This is what the song means, why the melody climbs while everything beneath it falls, and how an arrangement learns to confess.14 minEN - 8SegurançaNº 8Segurança34 minEN
Building the inverse: the design decisions behind a three-layer dropper
The same architecture from the other direction. Why a layered .NET dropper has three layers and not two or four, what each layer is solving for, and which defender assumptions the design quietly presupposes. A composite reference design drawn from the artefact dissected in Three layers deep and adjacent commodity infostealer campaigns through 2024 and 2025. Architecture and decisions, not source. Companion to the reverse-engineering writeup.34 minEN - 7SegurançaNº 7Segurança21 minEN
Three layers deep: reverse-engineering a .NET RAT dropper
Three layers down into a 1.1 MB junk-padded batch script: from cmd.exe macro obfuscation through a PowerShell shellcode loader to a Donut-packed implant living inside explorer.exe. The dropper hides its payload steganographically in 3,500 lines of comments, renames powershell.exe to evade name-based detection, and uses a 7-byte memory marker for cross-reboot idempotence. Companion to the incident writeup.21 minEN - 6SegurançaNº 6Segurança14 minEN
The cutest trap on the internet: weaponizing Google's child-safety system as a kill switch
A fake Minecraft launcher infected my friend α's machine on a Tuesday evening. By morning, an operator had used the stolen access to upload triggering content to α's Google account, log out, and let the platform's own automated child-safety detector erase the witness. The malware is the carrier; the kill switch is the story. The technical reverse-engineering lives in the companion post.14 minEN - 5FullstackNº 5Fullstack8 minEN
Picking RTDB for the auction hot path: three reasons and three regrets
Project Sato's hot path needs sub-100ms latency, atomic bid ordering, and listener cost that doesn't blow up under load. RTDB delivers two of three; Firestore delivers none. Here's why I split them, and what the split costs.8 minEN - 4Sistemas de engineNº 4Sistemas de engine10 minEN
Audio as a gameplay pillar: why Ashlight runs on FMOD instead of Unity's AudioSource
Ashlight's audio isn't decoration, it's a core gameplay pillar that has to deliver frame-aligned legendary telegraphs, an AI hearing system that reads player footsteps, and a Lucidity scheduler that fires phantom cues without ever lying to the player during real combat. Here's the middleware decision, the 10-RTPC contract that binds Unity to FMOD, and why the most interesting audio code in the game lives outside our codebase.10 minEN - 3Sistemas de engineNº 3Sistemas de engine6 minEN
Building a real-time Saturn ephemeris in React Three Fiber
How I rebuilt a Wallpaper Engine's Saturn simulation as the hero element of a portfolio site: Keplerian propagator for the moons, procedural ring shader, and ~5000 ring particles.6 minEN - 2Sistemas de engineNº 2Sistemas de engine8 minEN
Ashlight: building a horror engine layer on top of Unity
The systems work behind Ashlight: a custom render feature stack, dynamic dread budget, and the editor tooling that made it possible to ship without burning the team out.8 minEN - 1Play · CríticaNº 1Play · Crítica17 minEN
Minecraft, 5.2 / 10: separating the product from the phenomenon
Reviewing Minecraft in 2026 as a commercial product instead of a cultural phenomenon, held against the genre specialists that overtook it (Terraria, Factorio, Valheim, Dwarf Fortress) and against Mojang's own resources. The honest score is well below consensus, and the gap between best and important is the most interesting thing about it.17 minEN