Currently: OTClient UI engineer (contract)

Kizuno.
Reverse engineer & full-stack dev — building game internals since 2014.

I’ve been shipping software in the Tibia / OTClient / RE space since I was 14. Today that means LuaJIT inline hooks, Rust workspaces, Tauri desktops, and Next.js SaaS dashboards.

Also shipped

• mehah/otclient · Bot V8 sponsor ↗Sponsored the Bot V8 port from otcv8 into the mehah/otclient codebase. Credited in the upstream README.
• tsBigNew · Tibia 8.60 socket bot (Rust)Tibia 8.60 socket bot in Rust simulating real Cipsoft-client packets. Demo on YouTube.
• inivzap-botFull-stack WhatsApp automation platform — Baileys + Express + Socket.io + Next.js.
• kizubotFlagship Tibia botting platform — origin product behind the dashboards, infra, and clients.
• kizu-otcCustom OTClient fork — BigOTC client, ElfBot NG 4.1.4 in C++, with Level 1+ anti-reverse hardening. Hosts the 2023 ChatGPT-pipe Lua module.
• sentinel-core-launcherTauri 2 launcher for the Sentinel Core anti-cheat OTClient.
• tibia-coins-checkerScrapes tibia.com Tibia Coin transactions and exposes them as a REST API.
• monitoring-environmentCentral monitoring infrastructure for all kizuno18 projects.
• apex-editorTauri 2 desktop editor for Tibia client assets — SPR/DAT/v12 appearances + LZMA sprites.
• bigot-nextFull Gesior → Next.js 16 rewrite of the bigot.com.br portal (started Jan 2026).
• playwright-audio-captcha-solver ↗Solves audio reCAPTCHA via Playwright + speech-to-text, with a manual fallback.
• windows-reversing ↗Public Ghidra scripts that trace LuaEngine internals inside a real game binary.
• kizu-llmNotebookLM → WhatsApp bridge over Baileys.

Case studies

Twitch bot operation — mongebot in production

Production artefacts from the Twitch automation stack (private `mongebot` Docker fleet + public YaBoi humanization branch). Six screenshots covering the bot driving live viewer counts, the resulting Twitch analytics, geographic spread, and the actual ad / bits revenue and PayPal payouts the operation generated.

HadesOT skin changer (OTClient, Cipsoft-only era)

Built a skin-changer module for OTClient on HadesOT back when the server officially only supported the Cipsoft client. Required running a private OTClient build against the live Cipsoft protocol and swapping outfit/look bytes client-side without server cooperation.

Demolidores miner bot (cast-driven, multi-MC)

99%-functional mining bot for the Demolidores server: opens a password-protected cast, auto-reconnects and repositions, manages multiple miners through a proxy pool to bypass the 4-MC limit, parses the `using the last pick` textMessage to confirm mining, counts pepitas in real-time, calculates per-hour rate, and uses a keyword + challenge handshake to drop pepitas at the leader's feet for collection.

tibia-socket — 200 concurrent processes on a starter VPS

Production density benchmark of the `tibia-bot-rs` socket core: 200 concurrent `tibia_socket` processes running on a 1 vCore 3.6 GHz / 2 GB RAM / 40 GB SSD OVH starter VPS at 57.1% user + 41.3% sys CPU, ~10 MB RES per process, ~1.5 GB total RAM in use.

OTServ in 3 minutes — Docker pipeline

Show-off of the local Docker workflow for OTServ that replaced the old VM cycle. Learned from marcoshps11 in 2023, with detours through ChatGPT and the tibiaking.com tutorial. Published on YouTube as `[Show off] ABRINDO OTSERV EM 3 MINUTOS — Docker` (2024-09-27).

baiak-icewar — spoof spike (Oct 2023)

A single-night protocol-socket exercise that pushed baiak-icewar from a ~65-player baseline to a 217-player peak on otservlist (logged at 2023-10-15 04:14). Filed as a `[Show off]` retroativo to back the public claim that otservlist's spoof-detection was selectively enforced. OTLand thread: https://otland.net/threads/fake-characters-he-said-xinn-a-black-hole-of-ignorance.286599/

BigOTC · ElfBot NG 4.1.4 (proprietary C++ bot module)

From-scratch C++ recreation of ElfBot, shipped inside the BigOTC OTClient build, hardened against reverse engineering (compile-time XOR string obfuscation, opaque typeinfo via class renames, fmt::runtime error formats, hidden visibility, dead-code stripping, paired-binary-diff release gate).

OTClient UI redesign (2026 contract)

Active client engagement: modernising the in-game UI of an OTClient-family client without touching gameplay. Yellow-medieval layouts → dark, dense, search-able panels with consistent affordances.

Pokémon Captured

VIP / Friends list

Pokémon Seller

Open-source contributions

Experience

1. 2026 — present

   Current

   OTClient UI engineer (contract)

   Confidential client

   Rebuilding the in-game UI for an OTClient-family client — modern theming, redesigned interface, parity with the existing gameplay surface.

   • Replacing legacy OTClient UI module set with redesigned components
   • Maintaining 100% gameplay parity while modernising look-and-feel

2. 2023 — 2025

   TFS / C++ engineer · Full-stack

   bigot.com.br (Baiak 999x)

   Built and maintained a Baiak 999x Tibia server (mounts, auras, wings) on a heavily modified TFS C++ codebase, plus the game's web portal stack.

   • Shipped new TFS systems in C++ — mounts, auras, wings, custom content pipelines
   • Authored Python codegen for items/monsters/spells (JSON → XML + Lua)
   • Packaged the server as a multi-stage Docker image with MariaDB + Nginx reverse proxy
   • Owned the PHP web portal (big_website) and led its Next.js migration (bigot-next)

3. 2024 — present

   Founder · Full-stack engineer

   KizuBot

   Own and operate a multi-target Tibia botting platform — bot cores, web dashboard, infra, payments, anti-detection layers. Started May 2024, opened to paying customers in October 2024.

   • Designed and shipped Lua/C++ injection cores running inside live LuaJIT/Tibia clients
   • Built the Next.js + PostgreSQL dashboard (auth, billing, real-time machine grid)
   • Operated the Docker-based VM fleet (kizuno-vm) used by remote customers
   • Reverse-engineered private Tibia game-protocol surfaces to keep the platform compatible
   • Densified the runtime via the `tibia-bot-rs` core: 200 concurrent `tibia_socket` processes at 57–71% CPU on a 1 vCore / 2 GB / 40 GB OVH starter VPS

4. 2016 — 2019

   OTClient & Tibia network engineer (self-directed)

   Independent

   Shipped custom OTClient builds and protocol-level tooling for the Tibia/OTServ community.

   • Authored custom OTClient forks (kizu-otc) tailored for botting/anti-cheat use cases
   • Built socket-level Tibia clients in Rust and TypeScript (tibia-bot-rs, tibia-coins-checker)

5. 2014 — 2016

   Xenobot scripter (Tibia Global)

   Xenobot.net community

   Wrote and sold casino/automation scripts on the (then-dominant) Tibia Global botting platform.

   • Earliest commercial dev work; first contact with packet captures and debuggers

Skills

Story

1. 2014

   Tibia casino scripts on Xenobot.net

   Started at 14 reverse-engineering casino bots on the (then-dominant) Tibia Global botting platform. First contact with packet captures and a Windows debugger.

2. 2015–2017

   Apprenticed under Cjaker

   Two formative years working under Cjaker — creator of ZeroBot (zerobot.net) and a respected figure in the OTServ community. Shaped how I communicate, how deep I go on a problem, and how long I'm willing to stay with it.

3. 2016–2019

   OTClient + Tibia network internals

   Fell into the OTClient (C++/Lua) ecosystem. Learned socket/packet structures, opcode tables, encryption layers, and how to build custom clients that the official protocol would still accept.

4. 2017–2019

   Custom ElfBot for HeroesOT (built from scratch)

   Before otcv8 and otclient-redemption/mehah were a thing, I wrote a custom ElfBot from scratch in Lua to play on "The Heroes of Time" (later HeroesOT). First real product I shipped end-to-end on the OTServ side.

5. 2018

   First exploit — accidental SQLi on HeroesOT

   While building a multi-character login button on top of OTClient, a malformed query in my own code surfaced a SQL injection in HeroesOT's `protocolLogin` (login/password inputs). I ended up logged in as the server's admin by accident. That bug was the moment glitches and exploits became a real interest.

6. 2019

   ElfBot ported from Lua to C++ (otclient-redemption)

   Rewrote the earlier Lua ElfBot directly inside a private fork of otclient-redemption as a plug-and-play `.cpp` / `.h` module. Moving the bot out of Lua into the engine itself defeated the trivial Lua-string leaks that made the old version easy to copy — much harder to lift from a stripped binary.

7. 2019

   First reverse-engineering project

   Spent 4 months building an external bot for PokeXGames alongside Cjaker. First real RE work — pointer scanning, offset structures, and hands-on time with x64dbg, OllyDbg, and Fiddler.

8. 2021

   Sponsored Bot V8 port to mehah/otclient

   One of the sponsors of the Bot V8 port (originally otcv8) into the mehah/otclient codebase. Credited in the upstream README alongside @luanluciano93, @SkullzOTS, @kokekanon and @FranciskoKing — https://github.com/mehah/otclient

9. 2022–2024

   Twitch 360 bot · YaBoi + mongebot

   Built a full Twitch automation suite — multi-stream viewing, account creator, token + revenue manager, bits/subs/comments/VOD views, partner+affiliate accounts, channel points, lurk, chat ads, SEO. Two parallel branches: public YaBoi (C# → Python) focused on 100% human-like browser behaviour, and the private API-request implementations (mongebot Python → mongebot-go Go) that handled scale. Reached elite tier in under 2 months. Eventually handed dashboard-inflation methods to the two largest names in Twitch botting after they couldn't crack them. Heavy schooling in web crypto and network protocols.

10. Mar 2023

    wppBot · 60k users

    Released the first version of the Kizuno18 WhatsApp bot. It hit 60k users across 2k groups before Meta forced the upstream library (@open-wa/wa-automate) to stop. Source is now public on GitHub.

11. May 2023

    Massive Botting · Mineração (Demolidores)

    Shipped a 99%-functional cast-driven mining bot for the Demolidores server: proxy pool bypasses the 4-MC limit, auto-reconnect + reposition, anti-idle, real-time pepita counter + per-hour rate, textMessage parsing to confirm mining, keyword/challenge handshake to drop loot at the leader's feet. Each miner ran at ~0–0.7% CPU and 100 MB RAM on a Ryzen 9 6900HS / 40 GB DDR5.

12. 2023

    Ghidra deep-dive with Sharingan & Luckez

    Learned Ghidra properly alongside Sharingan and Luckez — the point where reverse engineering stopped being pointer hunts and started being real binary analysis: decompilation, RTTI extraction, control-flow tracing, scripting the disassembler.

13. 2023

    Docker pipeline for OTServ — learned from marcoshps11

    Picked up Docker properly under marcoshps11. Replaced the old VM workflow with containers — `docker compose up` and an OTServ instance is live in ~3 minutes instead of a half-day VM rebuild. Published as a `[Show off] ABRINDO OTSERV EM 3 MINUTOS — Docker` later (2024-09-27).

14. Aug 2023

    bigot.com.br · TFS C++ (2023–2025)

    Started two years on the Baiak 999x server: heavily modified TFS C++ core, new mounts/auras/wings systems, custom DB-backed servos system, Python codegen for game data, Docker production stack, legacy-character SQL bridge.

15. Oct 2023

    baiak-icewar spoof spike — listing-fraud demo

    A one-night demonstration: opened raw protocol sockets against baiak-icewar to push its otservlist player count from ~65 baseline to a 217-player peak in minutes (chart at 2023-10-15 04:14). The point was to back a public complaint that otservlist's spoof-detection was selectively enforced — large servers paying to keep their listings safe. Posted as a `[Show off]` after the OTLand thread.

16. May 2024

    KizuBot launch

    Started building KizuBot in May 2024 — a multi-target Tibia botting platform with its own bot cores, dashboard, infra, and billing. Opened to paying customers in October 2024; still the active flagship today.

17. 2024

    IDA Pro with Caio Cesar

    Picked up IDA Pro under Caio Cesar. Crossed the gap from Ghidra-only to working comfortably in both — function recovery, type propagation, IDC/IDAPython automation.

18. 2024–2025

    Anti-cheat, Rust, infra at scale

    Shipped Sentinel Core (anti-cheat for OTClient), the kizuno-vm hardened gaming sandbox, mongebot-go (Go+Tauri), and the tibia-bot-rs Rust workspace (9 crates).

19. Jan 2026

    Gesior → Next.js 16 (BigOT portal)

    Wrote bigot-next: a from-scratch Next.js 16 rewrite of Gesior (the OTServ PHP CMS) for bigot.com.br — characters, guilds, highscores, sales, account flows, all hitting the live game MySQL directly.

20. 2026

    Reverse-engineering as a product

    luahook, kizuEx, windows-lab — RE tooling productised: inline hooking across LuaJIT games, dual-platform shims, reproducible Windows RE labs with Ghidra/IDA-headless MCP servers.