# Evan Sultanik's Personal Website

> Personal and professional website of Evan A. Sultanik, Ph.D. — computer security researcher at Trail of Bits and occasional adjunct professor at Drexel University. Specializes in program analysis, smart contract security, static taint analysis, and distributed systems. Editor and frequent contributor to PoC||GTFO.

This website contains Evan's technical blog, open-source security research projects, academic publications, conference presentations, and a few easter eggs.

Last site modification: 2026-07-22T19:59:18Z

## About

- [Bio](https://www.sultanik.com/bio): Background, education (Ph.D. Computer Science, Drexel University), and research interests
- [Curriculum Vitae](https://www.sultanik.com/cv): Full academic and professional CV with PDF download
- [Now](https://www.sultanik.com/now): What Evan is working on right now
- [Academic Genealogy](https://www.sultanik.com/genealogy): Visualization of Evan's academic family tree

## Blog

- [Blog Archive](https://www.sultanik.com/blog/): Technical articles on security research, program analysis, AI, cryptography, and personal topics
- [Atom Feed](https://www.sultanik.com/recent.atom): RSS/Atom feed for content updates
- [Search](https://www.sultanik.com/search): Full-text search across all site content

### Recent Posts

- [Can chatbots craft correct code?](https://www.sultanik.com/blog/chatbots) — 2025-12-19: an update to an argument I made in 2017
- [Speedrunning the New York Subway](https://www.sultanik.com/blog/subwayspeedrun) — 2025-08-25: in which I am nerd-sniped into finding the shortest route that visits every NYC subway station
- [Detecting code copying at scale with Vendetect](https://www.sultanik.com/blog/vendetect) — 2025-07-21: a new tool that can discover coded copied between repositories
- [Investigate your dependencies with Deptective](https://www.sultanik.com/blog/deptective) — 2025-07-08: a new tool that can automatically run any command even if its dependencies are missing
- [Preventing account takeover](https://www.sultanik.com/blog/account_takeover) — 2025-02-05: on centralized cryptocurrency exchanges
- [Cruising Through Paradoxes](https://www.sultanik.com/blog/cruising) — 2024-08-01: Examining the Dialectics of Leisure and Urbanity
- [How to avoid the aCropalypse](https://www.sultanik.com/blog/acropalypse) — 2023-03-30: It could have been prevented if only Google and Microsoft used our tools!
- [libmagic](https://www.sultanik.com/blog/libmagic) — 2022-08-01: The Blathering
- [What does your code use, and is it vulnerable?](https://www.sultanik.com/blog/it_depends) — 2021-12-16: It-Depends!
- [PDF is Broken: a justCTF Challenge](https://www.sultanik.com/blog/PDF_is_broken) — 2021-02-02: In which a PDF is a webserver, serving copies of itself
- [So, you’re thinking about getting a Ph.D.](https://www.sultanik.com/blog/PhDCurious) — 2020-04-08: What next?
- [Breaking into Google Headquarters](https://www.sultanik.com/blog/GoogleIntrusion) — 2019-04-05: In which I tempt the criminal justice system while flaunting the California statute of limitations.
- [File Polyglottery](https://www.sultanik.com/blog/FilePolyglottery) — 2017-12-08: or, This Proof of Concept is Also a Picture of Cats
- [Has there been an increase in potential residency in Philadelphia?](https://www.sultanik.com/blog/ZoningDensity) — 2017-06-30: Analyzing Zoning Density Changes, 2012–2017
- [Is Automation of Automation Going to Kill Off Computer Science Jobs?](https://www.sultanik.com/blog/AutomationOfAutomation) — 2017-02-24: An Essay in Polite Dissent to Mark Cuban

## Projects

Open-source security and program analysis tools, organized by category:

### AI Gameplaying

- [Klondike](https://github.com/ESultanik/klondike): Implemented for fun and practice as part of kata 20.
- [2048-clai](https://github.com/ESultanik/2048-clai)
- [Othello](https://github.com/ESultanik/othello)
- [Rigid Body Physics Engine and Rope Swinging Game](https://github.com/ESultanik/physics)

### Cryptography

- [Lenticrypt](https://github.com/ESultanik/lenticrypt): Lenticrypt is a novel cryptosystem that provides true plausible deniability. It allows a single ciphertext to decrypt to multiple different plaintexts depending on the key that is used to decrypt it. Moreover, there is a theoretical guarantee that with nearly 100% probability there always exists at least one work in the public domain that some key will decrypt to, even if you don't know what that key is. You can read about its origins in this blog post.
- [Magiic](https://github.com/digitaloperatives/magiic): Magiic stands for Magiic Allows for GPG Indexing of IMAP on the Command-line. It is a simple ncurses-based command-line application for securely and efficiently performing full-text search over encrypted email. You can read more about it, along with a download link, on the Digital Operatives blog.

### Data Science

- [Philadelphia Zoning Analysis](https://github.com/ESultanik/ZoningMaps): This repository contains software and some partial analysis results of the Philadelphia zoning code. See this blog post for more information.

### Polyglottery

- [PolyFile](https://github.com/trailofbits/polyfile): A utility to identify and map the semantic structure of files, including polyglots, chimeras, and schizophrenic files.
- [NES Résumé Polyglot Game](https://www.sultanik.com/projects#nesresume): Evan’s résumé PDF is also a Nintendo Entertainment System game that you can emulate. You can even emulate it directly in your web browser!
- [This Git Repository is a PDF](https://github.com/ESultanik/PDFGitPolyglot): A PDF that can be git cloned, producing a repository containing the LATEX source of the PDF, all of the scripts necessary to rebuild the polyglot, and a copy of itself. See PoC||GTFO Issue 0x15.

### Program Analysis

- [PolyTracker](https://github.com/trailofbits/polytracker): PolyTracker is a tool for the Automated Lexical Annotation and Navigation of Parsers, a backronym devised solely for the purpose of referring to it as The ALAN Parsers Project. It is a an LLVM pass that instruments the programs it compiles to track which bytes of an input file are operated on by which functions. It outputs a JSON file containing the function-to-input-bytes mapping..
- [Manticore Symbolic Execution Engine](https://github.com/trailofbits/manticore): I am a frequent contributor to the Manticore symbolic execution engine.

### SBOM

- [Vendetect](https://github.com/trailofbits/vendetect): A command-line tool for automatically detecting vendored and copy/pasted code between repositories.
- [Deptective](https://github.com/trailofbits/deptective): Deptective automatically determines the native dependencies required to run any arbitrary program or command.
- [It-Depends](https://github.com/trailofbits/it-depends): It-Depends is a tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories. You can use it to enumerate all third party dependencies for a software package, map those dependencies to known security vulnerabilities, as well as compare the similarity between two packages based on their dependencies.

### Smart Contracts

- [solc-select](https://github.com/crytic/solc-select): A script to quickly switch between Solidity compiler versions.It is becoming increasingly hard to run older versions of solc, particularly on macOS since there are no official binary releases. Versions prior to 0.5.0 no longer compile on macOS and are not maintained. This is a problem because older Ethereum contracts no longer compile on modern versions of Solidity. solc-select is a utility that allows one to run any legacy version of Solidity simply by setting an environment variable.
- [Etheno](https://github.com/crytic/etheno): Etheno is the Ethereum testing Swiss Army knife. It’s a JSON RPC multiplexer, analysis tool wrapper, and test integration tool. It eliminates the complexity of setting up analysis tools like Manticore and Echidna on large, multi-contract projects. In particular, custom Manticore analysis scripts require less code, are simpler to write, and integrate with Truffle.

### Typesetting

- [LaTeX Coffee Stains](https://github.com/ESultanik/coffee-stains): This package provides an essential feature to LATEX that has been missing for too long. It adds a coffee stain to your documents. A lot of time can be saved by printing stains directly on the page rather than adding it manually.

### Utilities

- [DineAssign](https://github.com/trailofbits/dineassign): A tool for optimizing restaurant reservations to maximize diners’ preferences.
- [Graphtage](https://github.com/trailofbits/graphtage): A command line utility for semantically comparing tree-like files, such as JSON, YAML, XML, HTML, and TOML.
- [Visie is a Simple Initialism Enumerator](https://github.com/ESultanik/visie)
- [Notify When Done (NWD)](https://github.com/ESultanik/nwd): NWD is a utility for triggering alerts when a process finishes. Kicking off a long-running compile? NWD can post a popup notification when it's done. Starting a job on a remote server? NWD can send you an e-mail when it's done. Want to run a custom script once another finishes? NWD can facilitate that, too.
- [Biggest](https://github.com/ESultanik/biggest): A utility for finding the largest directories and/or files in a given directory hierarchy. Biggest supports pretty printed and colorized output to the terminal.
- [Ascid is the Self-referential Cycle IDentifier](https://github.com/ESultanik/ascid): It is capable of quickly (in linear time) detecting the maximum length repeated substrings in text files.This is often useful, e.g., when debugging a program that loops infinitely, vi&., ascid can determine the point at which the log output loops back on itself.

- [All Projects](https://www.sultanik.com/projects): Complete list of projects

## PoC||GTFO

- [PoC||GTFO Mirror](https://www.sultanik.com/pocorgtfo): Neighborly mirror of The International Journal of PoC||GTFO, a hacker zine of proofs-of-concept. Evan is an editor and frequent contributor, with articles on file format polyglots, parser exploitation, and creative hacks.

## Publications

- [Academic Publications](https://www.sultanik.com/publications): 53 peer-reviewed papers on distributed systems, multi-agent coordination, constraint reasoning, and security
- [BibTeX](https://www.sultanik.com/ESultanik.bib): Bibliography file for citations

## Presentations

- [From Polyglots to Prompt Injections](https://www.youtube.com/watch?v=1U6dybaZloA) — <a href="https://jawncon.org/jc0x2.html" target="_blank">JawnCon 0x2</a> (2025-10-11)
- [In Pursuit of Silent Flaws](https://www.youtube.com/watch?v=RuA0eerGqEE) — <a href="https://www.cerias.purdue.edu/news_and_events/events/security_seminar/details/index/2j7p81asqqt39nkaf72a0ejdcg" target="_blank">Purdue CERIAS Seminar</a> (2024-04-15)
- [A Sermon on the Indulgences of Computational Sacrifice](https://www.youtube.com/watch?v=RTjP3fnQ5d8) — <a href="https://absoluteappsec.com/cons/midwinter-2020/" target="_blank">A Midwinter Night's Con</a> (2020-12-17)
- [Toward Automated Grammar Extraction via Semantic Labeling of Parser Implementations](https://www.youtube.com/watch?v=N2QYMUPKQRE) — <a href="http://spw20.langsec.org/" target="_blank">The Sixth Workshop on Language-Theoretic Security</a> at the <a href="http://www.ieee-security.org/TC/SP2020/workshops.html" target="_blank">41st IEEE Symposium on
Security and Privacy Workshops</a> (2020-05-21)
- [The Treachery of Files, and Two New Tools that Tame It](https://www.youtube.com/watch?v=LqRbfzhcI5g) — <a href="https://www.empirehacking.nyc/" target="_blank">Empire Hacking</a> (2019-12-10)
- [Fantastic Bugs and How to Squash Them;](https://github.com/trailofbits/publications/blob/master/presentations/Anatomy%20of%20an%20unsafe%20programming%20language/Fantastic%20Bugs%20and%20How%20to%20Squash%20Them.pdf) — <a href="https://www.meetup.com/Philadelphia-Ethereum-Meetup/events/262608448/" target="_blank">Philadelphia Ethereum Blockchain Meetup</a> (2019-07-25)
- [Anatomy of an Unsafe Smart Contract Programming Language](https://www.youtube.com/watch?v=JaUIxMJAOsA) — <a href="https://www.empirehacking.nyc/" target="_blank">Empire Hacking</a> (2018-12-12)
- [Introducing Etheno](https://www.sultanik.com/presentations) — <a href="https://www.trufflesuite.com/events" target="_blank">TruffleCon 2018<a> (2018-10-07)
- [Parsing and Interpreting are Hard:](https://www.evensi.us/dc215-gathering-0x2-september-yard/266752633) — <a href="https://dc215.org/" target="_blank">DC 215 Gathering 0x2</a> (2018-09-25)
- [File Polyglottery;](https://www.youtube.com/watch?v=KNFeb98TkZ4) — <a href="https://bsidesphilly.org/" target="_blank">BSidesPhilly</a> (2017-12-08)
- [Automatic Construction, Maintenance, and Optimization of Dynamic Agent Organizations](https://www.youtube.com/watch?v=Q3NnEuCLADE) (2010-09-08)
- [All Presentations](https://www.sultanik.com/presentations): Complete list of recorded talks

## Easter Eggs

- [NES Resume](https://www.sultanik.com/nesresume): Evan's industry resume as a polyglot file that is simultaneously a valid PDF and a playable NES ROM, emulatable directly in the browser
- [Terminal Emulator](https://www.sultanik.com/#term): An interactive JavaScript terminal emulator accessible via the "XTerm" link in the navbar, featuring a CTF challenge with a hidden secret

## Optional

- [PGP Key](https://www.sultanik.com/pgp): Public key for encrypted communication
- [Sitemap](https://www.sultanik.com/sitemap.xml): Machine-readable list of all indexable pages