Max Thomas

Firmware Engineering, Security Engineering, Edge Computing, XR. Looking for work!

Email: mtinc2@gmail.com
GitHub: github.com/shinyquagsire23
Technical Blog: douevenknow.us
LinkedIn: linkedin.com/in/max-thomas-sq/

If you need someone who doesn't settle for a surface-level understanding of computers, I'm your guy.
Especially interested in firmware engineering, security engineering, and hardware design, but also have experience in machine learning deployment/edge computation as well as XR rendering and optimization.
I've written drivers for everything from WiFi chips to USB controllers. I love everything ARM.

My greatest hits include:

Bringing ALVR to visionOS
Breaking secure boot on 7 years of LG phones (that's right, I found vulns in boot logo parsing before it was cool)
Getting ACE on my monitor scaler by reverse engineering the ISA (without a compiler).
I wrote a hypervisor from scratch for the Nintendo Switch in Rust
I fundamentally broke Wii U's secure boot (and encryption) with bouncing from a pushbutton (and then replicated it with a $5 open-source modchip).
Decompiling Jedi Knight: Dark Forces II and porting it to macOS and Linux.
A handful of 3DS exploits
A lot of other stuff tbh, check out my Github.

Blog Posts

Apple Vision Pro has the same effective resolution as Quest 3…Sometimes?
de_Fuse the One True Pwn (Bypassing secure boot on the Wii U)
Tying It All Together - Pwning To Own on LG phones (LG LAF sig check bypass, also another S-EL3 vuln lol)
🔋 📱❄️🥾🔓, an EL1/EL3 coldboot vulnerability affecting 7 years of LG Android devices
Nintendo Switch Kernel Patching and Emulation - Achieving Maximum Modification Flexibility with Minimal Replacement
Nintendo and Executables, Emulation and Piracy, an analysis of Nintendo's executable formats, signature verification, and how they interweave in Nintendo's anti-piracy approach
Picking apart the Joy-Con: Heap Leaks, Bluetooth and Command Structures
Picking apart the Joy-Con: Pro Controllers, Extended HID and uinput Drivers
Picking apart the Joy-Con: Charging Joy-Con Grip and HID
Picking apart the Joy-Con: Wired Protocol and Firmware Dumping
Throwback: K9Lhax by Bruteforce (breaking New 3DS secure boot and encryption)
Making Controllers for VR from the Ground Up (my high school capstone)

Projects

Stuff that didn't make it to the Greatest Hits list,

libusbd, a device-mode counterpart to libusb for macOS and Linux, with Rust bindings and async.
SaltyNX, a code injection framework for the Nintendo Switch
dsiwifi, my AR6012/AR6013 driver for the DSi and 3DS.
minute_minute, an SPL and boot1 replacement for the Wii U.
stroopwafel, a code patching and plugin framework for the Wii U IO processor.
vive_ultimate_tracker_re, where I almost got 6DoF tracking out of the VIVE SLAM trackers before they released beta PCVR support.
My monado Quest Link driver, which I made as a test to port OpenXR to macOS.
A lot of other stuff, check out my GitHub