András Gémes

Summary

Security researcher with 8 years of experience. Hands-on experience in mobile application security, reverse engineering, malware analysis and vulnerability research. Certified in Sec+, CASP+/SecX, CEH and others. LLVM compiler engineering (code obfuscation) and embedded systems background. Open to roles in security research.

Work experience

Mobile Security Analyst @ SGS Brightsight - Delft, Netherlands June 2026 – Present

• Analyzing mobile payment applications for vulnerabilities (cryptography, runtime protection, data protection, etc.)
• Evaluating mobile payment applications against the PCI MPoC standard
• Reverse engineering app binaries (Ghidra, Frida) to identify logic flaws and develop PoC exploits

Security Researcher @ HighTec EDV-Systeme GmbH - Budapest, Hungary Feb 2023 – June 2026

• Evaluated the security impact of reported LLVM vulnerabilities as a member of the LLVM security group
• Analyzed Windows, Linux and Android malware, writing detection rules and config extractors (Ghidra, Python)
• Implemented custom LLVM-based C++ code obfuscation pass plugins based on malware research

Application Security Engineer @ Knorr-Bremse R&D Center - Budapest, Hungary May 2018 – Jan 2023

• Implemented static (Clang-Tidy) and dynamic (Valgrind) application security testing across embedded C codebases
• Used AFL++ fuzzing and code review to discover embedded systems memory corruption vulnerabilities and build PoC exploits
• Built iOS and Android apps for real-time vehicle data visualization

Technical skills

Reverse engineering (static): DiE, Ghidra, IDA, ILSpy, dnSpy, Binwalk, Apktool, jadx, otool, ipsw

Reverse engineering (dynamic): x64dbg, Sysinternals, LLDB, GDB, Frida, ADB, QEMU, Qiling, VirtualBox, strace

Detection engineering: YARA, Sigma, Suricata, capa

Programming languages: C, C++, Rust, Objective-C, Swift, Python 3, Java, Assembly (ARM64, x86-64), Bash

Vulnerability research: AFL++, checksec, ROPgadget, Clang-Tidy, Valgrind

Network and traffic analysis: Wireshark, Burp Suite, mitmproxy, Zeek, FakeNet-NG, INetSim

Platforms and DevOps tools: Linux (Fedora, Ubuntu), macOS, Windows, Git, Docker, GitHub Actions, Jenkins

Certifications

CompTIA Security+, CompTIA CASP+/SecurityX, EC-Council CEH, TCM Security PMAT, Invoke RE IMBT and others.

Open source contributions

• ghidra: contributing bug reports and patches to Ghidra, focusing on the BSim, Debugger and FunctionID features
• threat-detection-rules: publishing YARA, Sigma and Suricata rules for analyzed malware families
• ghidra-scripts | reversing-scripts: developing custom scripts to support reverse engineering
• phantom-pass | o-mvll: implementing and improving LLVM-based code obfuscation pass plugins
• rust-arm64: writing a Rust book about analyzing Rust-to-ARM64 compilation

Education

MSc in Mechatronics Engineering @ Budapest University of Technology and Economics Feb 2016 – June 2018

BSc in Mechatronics Engineering @ University of Pannonia Sept 2012 – Jan 2016