Hi, I'm Nick. I build security software.

I (also) work on anti-cheat compatibility
with EA's Javelin team.

See my work
helzky@proton.me
01 / work

Selected work.

Windows software and independent security research.

All 14 projects

Open source · C++

Cloakwork

Compile-time encryption and code obfuscation in a single C++20 header. Drop it into an existing build, with no extra tooling.

Explore the source

Security research · 2026

Argus

When a trusted path isn't a trusted process. My investigation into a kernel memory disclosure in Microsoft Defender.

Read the investigation

Open source

  1. 03 SigmaDrift A C++ mouse movement generator built around computational motor-control models. C++ / Security Open source · 2026 Source
  2. 04 wraith-rs A Rust library that makes it safer to work with low-level Windows process features. Rust / Windows / Security Open source
02 / research · 2026

Kinematic features
are all you need.

Can software tell a human hand from generated input? I studied the shape and timing of mouse movements, using 43,216 recorded trials from 29 people.

Explore the research
Movement leaves a signature.Fig. 01
Human, SigmaDrift, and WindMouse movement examples. Paths appear above their speed profiles. The human example has several velocity peaks; SigmaDrift has one dominant peak; WindMouse has irregular bursts.

Paths above, speed profiles below. Original examples from the paper, shown in monochrome.

Open figure

> 99.5% of generated movements detected
at < 0.1% false positives on Balabit and BOUN.

Read the paper Detector source
03 / writing

Notes from the work.

Investigations, experiments, and what I learned along the way.

  1. 01 IMDUI: an immediate-mode C++ UI framework for Windows Anti-cheat can flag ImGui by its Win32 calls, so we wrote our own immediate-mode C++ UI library for Windows from scratch. 9 min
  2. 02 Argus: Kernel memory disclosure through Defender's KSLD process gate How a process path check in Microsoft Defender opened the door to kernel memory. 17 min
  3. 03 Disarming Windows Code Integrity through unprotected .data globals What happens when the globals behind Windows driver signing are left writable. 22 min
All 10 articles
04 / about

It started with games.

Most people online know me as koi.
Here's how I got here.

  1. At twelve

    I started coding with Minecraft mods and small exploits. Games gave me a reason to understand the machine underneath.

  2. Going deeper

    I moved into Java and C++, building and selling game cheats. That work took me into reverse engineering and Windows internals.

  3. After high school

    A cybersecurity firm hired me, and I started putting that experience into security software.

  4. Building products

    I worked on several products there and took on more responsibility, including work close to product management.

  5. 2026 / Now

    I joined EA's Javelin team, where I work on anti-cheat compatibility and related features.

A little more about me

Have something in mind?

A project, a question, or something worth taking apart.

Email me GitHub