Luke Baker

Software Engineer & Reverse Engineer

.summary0x00401000

I build tamper-resistant JavaScript VMs and device fingerprinting systems at bet365. Most of my work is client-side: obfuscation, anti-tamper, runtime integrity checks in the browser. What keeps me interested is the back and forth between offence and defence. I build protections during the day, then reverse-engineer anti-bot vendors in my own time to see how they hold up. Understanding how attackers think, what they optimise for, and where they give up is how I build things that are harder to break.

.experience0x00402000

bet365

Nov 2025 — Present

Security Software Developer — Martech & PAMRemote, UK

>Write custom JavaScript virtual machines for client-side security: bytecode interpreters, dispatch-loop architectures, encoded opcodes. I also know how to attack these (symbolic tracing, handler recovery), which shapes how I build them
>Device fingerprinting across canvas, WebGL, TLS, and behavioural signals, fused into per-session risk scores for bot detection
>Anti-tamper and runtime integrity checks that catch instrumentation, debuggers, and code modification while the page is running
>TLS fingerprinting (JA3/JA4, HTTP/2 frame analysis, header ordering) to pick out automated traffic at the transport layer
>Code obfuscation: control-flow flattening (designed to resist dominator-based detection), MBA expressions, string encryption, dead-code injection

xrefJavaScriptTypeScriptVM DesignMBACFFBrowser SecurityTLSFingerprinting

Stale Software

2021 — Present

Director & Security Engineer

>Security research into anti-bot systems and client-side protection, figuring out what works and what breaks
>Reverse-engineer obfuscated JavaScript VMs (handler extraction, bytecode reconstruction, concolic tracing) and protected Go binaries in Ghidra (one target had 12,000+ garbled strings). Evaluate anti-tamper modules against automated attacks like program synthesis and dominator analysis
>Write browserless HTTP clients in Go that match real browser behaviour at the TLS, header, and fingerprint level
>Run self-hosted infrastructure on Proxmox/Docker with Traefik, CrowdSec, Authelia, Elastic EDR, and YARA-based autoruns monitoring

xrefGoPythonGhidraFridaDockerReverse Engineering

Cornucopias

2024 — 2025

Senior Software Engineer

>Backend for a Web3 multiplayer game: game logic, player data pipelines, and real-time event systems
>Built the anti-cheat and multiplayer security layer. Server-authoritative validation, network packet integrity checks, client-side tamper detection
>Web security and storage across PostgreSQL and DynamoDB, tuned for concurrent game-state reads

xrefC++C#TypeScriptPostgreSQLDynamoDBAnti-CheatNetwork Security

CNFT.IO

2020 — 2021

Cofounder & Lead Software Engineer

>Cofounded the first NFT marketplace on Cardano. Went from nothing to thousands of daily users within a few months of launch
>Owned backend architecture (TypeScript, MongoDB) and managed the engineering team through the migration to on-chain smart contracts

xrefTypeScriptMongoDBSmart ContractsCardano

.capabilities0x00403000

.security

JS VM design · dispatch-loop obfuscation · control-flow flattening · MBA encoding · anti-tamper · runtime integrity · device fingerprinting · anti-debugging

.reverse_eng

Ghidra · Frida · JS deobfuscation · VM devirtualisation · handler extraction · bytecode reconstruction · symbolic execution · binary analysis · TLS interception

.languages

JavaScript/TypeScript · Go · Python · C++ · Rust · C#

.web

WebAssembly · WebGL · WebSockets · Web Workers · Web Components · browser internals

.infra

Docker · Linux · Traefik · Proxmox · Cloudflare · Cloudflare Workers · Elastic · Kibana · PostgreSQL · MongoDB · Redis · Git · CI/CD · Jira

.education0x00404000

BSc Computer Science & Cyber Security (1.5 years)University of the West of England

Dean's List — exemplary performance across all modules taken

A-Levels: Maths, Physics, Computer ScienceKing Edward's School, Bath

.research0x00405000

Akamai BMP Mobile SDK Technical Analysis

github.com/itsmestale/akamai-bmp

>Reverse-engineered Akamai Bot Manager Premier v4.0.4 from a production Android app: 54KB of obfuscated JS, the native encryption library in Ghidra, and 20,991 decompiled Java classes
>Mapped a polymorphic switch-dispatch bytecode VM with 150 case handlers and a self-integrity system where modifying a single byte silently corrupts all internal state
>Identified three deliberately misnamed fingerprint algorithms through differential testing (CSS system colours, dual canvas renders, Java String.hashCode)

xrefFridaGhidraJS VMFingerprintingAkamaiAndroid