CODE WITH CURIOSITY.PERSONAL SPACE / 2026

Build what intrigues,
trace how it works.

Between native apps, system internals, and security research,
turning curiosity into code and leaving the traces here.

INTENTION’s GitHub avatar
Hi, I’m INTENTION Also known as kano
INTERACTIVE OBJECT001 / KANO
Your browser does not support Canvas.
SCROLL TO EXPLOREOPEN SOURCE. OPEN MIND.
01 / SELECTED WORKAndroid, desktop apps, and low-level experiments.

Turning ideas into artifacts.

All repositories

Thoughts that slowly took shape here.

01 / ANDROID AUDIOActively Developed
NATIVE. PERSONAL.
NeriPlayer

Your music, always under your control.

Local-firstImmersive lyricsSelf-hosted sync
ResonanceSynth study

Local-first, multi-source audio player supporting NetEase Cloud Music, Bilibili, YouTube Music, and preview self-hosted servers—bringing playback, word-by-word lyrics, local library management, and self-hosted sync into a refined native experience.

androidequalizerexoplayerglsljetpack-composekaraoke-lyricslisten-togethermedia3musicnative-appsplayerprivacy-focusedself-hostedshadersusb-exclusivewebdavwebsocket
Kotlin · Jetpack Compose · Media3 · GLSL / AGSL · C++ / USB · WebSocket · WebDAV
02 / SYSTEMS RESEARCHResearch in Progress
RING −1 / VT-x
Beneath the surface

Exploring Intel VT-x late-launch virtualization, VM-exit handling, and multi-core lifecycles on Windows x64.

C++17MASMIntel VT-xVMCSVM-exitEPT modelsWindows x64
C++17 · MASM · Intel VT-x · VMCS · VM-exit · EPT models · Windows x64

An Xposed extension for QQNT that works with Protobuf protocols, runtime hooks, and cross-version adaptation to reshape native client workflows.

XposedQQNTProtobufDexKitHook runtimeJava / Kotlin
Xposed · QQNT · Protobuf · DexKit · Hook runtime · Java / Kotlin
04 / CROSS-PLATFORMPreview Release
macOS / WIN / LINUX

A cross-platform desktop music player built with Tauri 2, Vue 3, and Rust—bringing multi-source playback, local libraries, synced lyrics, and DSP effects to Windows, macOS, and Linux.

Tauri 2Vue 3RustcpalsymphoniaWebGLProtobuf
Tauri 2 · Vue 3 · Rust · cpal · symphonia · WebGL · Protobuf

An archived Xposed framework for WeChat combining DexKit bytecode search, annotation-based hooks, and Compose UI to streamline daily interactions.

XposedKotlinDexKitMemoryDexLoaderMMKVCompose
Xposed · Kotlin · DexKit · MemoryDexLoader · MMKV · Compose

A Python, Tkinter, and Pillow desktop tool that parses .mol files, renders molecular structures over coordinate grids, and turns chiral carbon identification into an interactive quiz.

PythonTkinterPillow
Python · Tkinter · Pillow

An Android CAPTCHA prototype that renders organic molecules from .mol data, turning chiral carbon recognition into a visual verification challenge.

AndroidMolecular graphics
Android · Molecular graphics
Code, issues, and updates live on GitHub.SHOWING 07 / 07
02 / BENEATH THE SURFACESECURITY & REVERSE ENGINEERING

Beneath the surface.

reverse-docs

Notes on analysis, reproduction conditions, and open questions.

Mostly focused on ARM64 native binaries, login protocols, and the Windows kernel. I combine static disassembly, breakpoints, and runtime logs, keeping intermediate states for verification. Below are two redacted public write-ups.

01

Native & Runtime

ARM64, IDA, Frida, and hardware breakpoint sampling; tracing state transitions backward from where results are written.

02

Protocols & Data Flow

Login pipelines, key exchange, binary structures, and credential layouts; putting raw data back into context.

03

Kernel & System Boundaries

Windows WDM / WSK, process and module structures; Android USB kernel crash forensics and xHCI / QMI lifecycles; extending into VT-x and VM-exit.

THE BLACK BOX28 BYTES
Every byte
has a story.
OFFSET 0x0046 → 01000110 · F
Freedom, written in bytes.
NATIVE / RUNTIME01

Behind 28 bytes,
more than a single pass.

Unpacking a 28-Byte Dynamic Short Signature

Tracing backward from the output sink through material preparation, state machines, and framing layers, documenting false hotspots, clock hooks, and state comparisons.

Native · ARM64 · Runtime tracingRead the write-up ↗
Full write-ups are in reverse-docs.OBSERVE → QUESTION → UNDERSTAND
03 / NOTES & ESSAYSOn engineering, and thoughts along the way.

Building, and writing.

All articles

Turning problems encountered in projects and reflections beyond code into essays.

04 / A little about meINTENTION / kano

About.

DEVELOPER. EXPLORER. HUMAN.

I'm INTENTION, also known as kano.
I work on client development, client-side security, and reverse engineering.

When building software, I care as much about interface details as code structure. Lyric animations, scroll transitions, and tactile feedback should feel natural; module boundaries, state management, and error handling should stay clean so projects remain maintainable over time.

In Android reverse engineering, I pair static analysis with runtime debugging to map out call chains, protocols, and data flows. Findings are documented alongside reproduction steps to preserve how each issue was pinned down.

I started out writing Xposed modules, which brought my earliest readers and users. Lately I've shifted my focus toward open source, maintaining projects like NeriPlayer and turning past experience into code that others can use, read, and build upon.

Public projects and research notes are on GitHub. Feel free to open an issue for project bugs, or reach out on Telegram to chat.

05 / KERNEL · REVERSE ENGINEERING · NATIVE

Tools at hand, paths taken.

From kernel to interface, following the call chain.

Kernel internals, reverse engineering, and native development are different facets of the same path—from memory and I/O in drivers to protocols, audio, and interfaces in apps.

01Built for Daily Use

Android / Native Audio

KotlinJetpack ComposeCoroutines / FlowMedia3ExoPlayerRoomJNIUSB exclusiveAudio effectsLocal mediaDownload / cacheANR diagnostics

Crafting native audio experiences with Kotlin, Compose, and coroutines across a main app and 14 custom libraries. Media3 orchestrates multi-source queues and failover, while local scanning, playlists, offline downloads, and transient caches stay cleanly separated.

Balancing lyric animations, exclusive USB audio, cache boundaries, and crash diagnostics for reliable everyday listening.

02Binaries & Runtime

Reverse Engineering / Native

ARM64x86-64IDAFridaangrKSU · HW breakpointsZydisPEVEHMASMSIMD / YMMPointer recoveryControl-flow analysisPython traces

On ARM64, combining IDA disassembly, hardware breakpoint sampling, Frida logs, and angr deflattening to trace state machines backward from output sinks. On x64, pairing Zydis, VEH, and MASM to correlate instruction flows with live register states.

Aligning static control flow, runtime memory snapshots, and reproducible samples along a single chain of evidence.

03{{stack.usb-kernel.label}}

Linux / Android Kernel

Linux KernelAndroid USB HostC++JNIUSBFSioctlIsochronous URBxHCIQMIsnd_usb_audio_qmiWorkqueueKernel panicContext lifetime

{{stack.usb-kernel.body}}

{{stack.usb-kernel.note}}

04Processor State

Hypervisor / Intel VT-x

C++17MASMIntel VT-xLate launchVMXONVMCSVM-exitNested VMX modelsEPT policy modelsTSC / QPCWHP capability probeCMake / Ninja

In KNHV, investigating Intel VT-x late-launch, VMCS configuration, and VM-exit dispatching on Windows x64—covering hardware capability checks, multi-core teardown, and software contract models for nested VMX, EPT policies, and timing.

Pairing host-side contract verification with live kernel debugging on isolated target hardware.

05Hosts & Extensions

Runtime / Xposed

Kotlin / JavaXposedLibXposedDexKitKSPJNIMMKVClassLoaderMemoryDexLoaderHookItemKotlin DSLProtobufVersion adaptation

ONO parses QQNT Protobuf payloads and resolves runtime signatures for cross-version extensions. WeKit unifies host settings injection, hybrid classloading, DexKit bytecode queries, KSP annotation processing, and Compose UI into a modular hook framework.

Mapping out large commercial client runtimes to keep extension lifecycles clean across host updates.

06Drivers & Memory

Windows Kernel / WDM

CWDMWindows KernelWDKNTIFSWSKIRPKEVENTKernel TCPPEPROCESSPEB / LDRMmCopyVirtualMemoryNonPagedPoolNxSEH

Crossing from user mode into the Windows kernel: MemoryAccessWDM manages TCP sessions via WSK and chains asynchronous I/O through IRP completion routines, implementing process lookup, address validation, cross-process memory access, and PEB/LDR module traversal.

Focused on kernel object reference counting, exception path cleanup, and clean resource teardown on driver unload.

07Cross-Platform Audio

Desktop / Rust Audio

RustTauri 2Vue 3TypeScriptIPCcpalsymphoniaFFmpegTokioreqwestloftyprostsouvlakiAMLL

The desktop preview pairs a Vue 3 and TypeScript interface with a Rust audio core over Tauri 2 IPC. Its backend combines Symphonia and FFmpeg decoding with cpal output, built-in DSP effects, synced lyrics, and native OS media sessions.

Currently in desktop preview, bridging local audio pipelines with native system media controls across Windows, macOS, and Linux.

08Sync & State

Data / Protocols

ProtobufZSTDV4 manifestsGZIPBase64GitHub APIWebDAVThree-way mergeWebSocketCloudflare WorkersDurable ObjectsClock driftReconnect / recovery

Targeting user-controlled GitHub and WebDAV remotes, the GitHub V4 sync protocol combines Protobuf record streams, ZSTD content chunking, and root manifests. Listen Together uses WebSockets and Durable Objects to coordinate room queues, clock skew, and reconnects.

Handling chunk merges, deletion tombstones, and clock drift compensation to keep distributed states consistent.

09Visuals & Data

Graphics / Visualization

GLSL / AGSLRuntimeShaderWebGLAudio-reactive shadersCover colorsLRC / YRC / TTMLPhysXTriangle mesh cookingPillowCanvasUnreal Engine 5.8C++ gameplay

Driving real-time GLSL/AGSL fluid shaders from audio levels and cover palettes while syncing word-by-word lyrics along the playback timeline. Past work also spans 2D molecular grid rendering, x64 PhysX triangle mesh cooking, and an Unreal Engine 5/C++ gameplay source experiment.

Connecting underlying data streams and spatial geometry directly to real-time visual feedback.

10From Experiments to Engineering

Tooling / Engineering

PythonC / C++Kotlin / JavaRustShellGradleCMakeGitHub ActionsTkinterMOL parsingTrace aggregationContract testsCrash logs

Using Python to aggregate hardware breakpoint traces and parse molecular files, orchestrating cross-platform builds with Gradle, CMake, and CI, and writing automated tests in an UE 5.8/C++ source project—treating input validation and diagnostic logging as core implementation.

Relying on automated builds, boundary tests, and structured logs to sustain long-term iteration.

01

Craft in the details

Motion, typography, and feedback all shape the experience.

02

Claims backed by proof

Observe, reproduce, then decide what to trust.

03

Built to last

Beyond getting it working lies stability and maintenance.

06 / Contact meLET'S TALK

Write in, or say hello.

Email or Telegram works best. Tell me what you have in mind or what you'd like to build.

Quick navigation