Halvar Flake

Halvar Flake is the professional handle of Thomas Dullien, a German mathematician and self-taught reverse engineer who became one of the most influential figures in binary analysis and vulnerability research. He began reverse-engineering software as a teenager in the mid-1990s and moved into formal vulnerability and exploit-development work shortly after, becoming a fixture of the Black Hat conference circuit from the early 2000s onward, presenting talks such as "Auditing Binaries for Security Vulnerabilities" (2001) and "Automated Reverse Engineering" (Black Hat Asia 2003).

Structural Binary Diffing and zynamics

In 2004 Dullien founded SABRE Security, later renamed zynamics, to commercialize a new approach to comparing compiled binaries. His 2004 DIMVA paper "Structural Comparison of Executable Objects" treated executables as directed graphs and applied graph-theoretic matching algorithms instead of naive byte-by-byte comparison, an approach he refined further with Rolf Rolles in 2005. This work became the tool BinDiff, which let analysts identify what changed between two versions of a binary without source code access — useful for patch analysis, malware-variant tracking, and vulnerability discovery. zynamics also produced BinNavi (a reverse-engineering IDE) and VxClass (automated malware classification). In 2006 the company's malware-classification and code-similarity work won Germany's Horst Görtz Prize.

Google, zynamics' Acquisition, and Rowhammer

On March 1, 2011, Google acquired zynamics. Dullien spent the following years at Google integrating and scaling zynamics' reverse-engineering technology (Google subsequently open-sourced BinDiff). He later worked as a researcher on Google's Project Zero team, where in March 2015 he co-authored, with Mark Seaborn, the influential Project Zero blog post "Exploiting the DRAM rowhammer bug to gain kernel privileges," which demonstrated that repeated memory-row access could flip bits in adjacent DRAM rows and be weaponized into a kernel privilege-escalation exploit — helping establish Rowhammer as a landmark hardware security issue. That year, Dullien also received the Pwnie Award for Lifetime Achievement at Black Hat USA 2015.

Optimyze and Later Career

In January 2019, Dullien left Google to co-found Optimyze, a Zurich-based startup building an always-on, low-overhead continuous production profiler using eBPF technology. Elastic announced an agreement to acquire Optimyze on October 14, 2021, and completed the acquisition on November 2, 2021, with Dullien and co-founder Sean Heelan joining Elastic.

Legacy

Across two decades, Flake's structural/graph-based approach to comparing and analyzing binaries reshaped how security researchers and malware analysts work with compiled code lacking source access, and his research — from early Black Hat trainings to the Rowhammer disclosure — helped move binary diffing and hardware-fault exploitation from niche techniques into mainstream vulnerability-research practice.

Timeline

• 2004Founded SABRE Security (later zynamics) and published "Structural Comparison of Executable Objects" at DIMVA, introducing the graph-based approach behind BinDiff.
• 2006zynamics' graph-based malware classification technology won Germany's Horst Görtz Prize.
• 2011-03-01Google acquired zynamics, maker of BinDiff, BinNavi, and VxClass.
• 2015-03-09Co-authored, with Mark Seaborn, the Google Project Zero blog post "Exploiting the DRAM rowhammer bug to gain kernel privileges."
• 2015Received the Pwnie Award for Lifetime Achievement at Black Hat USA 2015.
• 2019-01Left Google to co-found the continuous-profiling startup Optimyze.
• 2021-11-02Elastic completed its acquisition of Optimyze; Dullien joined Elastic.