Portfolio

Case studies — problem · constraints · approach · outcomes · lessons

Eight flagship deep-dives from 02_Flagship_Deep_Dives.md. Each links to corporate products where a product surface exists (PlanMyBenefits → products, OmniTrust → ecosystem). Hardware cards note where firmware + tooling + RCA ship as one system. No unverified firsts — only lineage you can diligence in the repos.

Fintech / Employee Benefits

Corporate ↗

PlanMyBenefits — legacy monolith to microservices strangler

Problem: EOL netcoreapp2.2 monolith (MVC/jQuery, EF Core 2.x, IdentityServer4, 4 DbContexts) could not scale securely; calculation matrices needed isolation and testability.

Constraints: Live benefits calculations; POPIA/FICA sensitivity; Azure estate; team had to keep shipping while modernizing; no big-bang rewrite risk.

Approach: Split Dataservice.Api (per-schema controllers) + CalculationEngine.Api (actuarial matrices) + ClientAccess.Api (BFF) + standalone Identity microservice; Redis/In-Mem cache, Dapper hot paths, Hangfire, OpenAPI, 4 envs + APITEST; SendGrid/RabbitMQ/ServiceBus eventing; scoped Clients boundary for mentored handover.

Outcomes: Uniform net10 + CPM, streaming HttpClient + SessionStorage Blazor UI (MudBlazor/Radzen/ApexCharts); reproducible strangler curriculum (DEVOPS_MIGRATION_ROADMAP 6–18h modules + 15 parity/gap docs + WebForms→Blazor teaching pair).

Lessons: Parity tables beat promises; scoped solution boundaries let client devs learn without blocking production; APITEST environment pays for itself.

C# .NET 10Blazor ServerEF Core 10RedisDapperAzure DevOps

Identity / Reverse Engineering

SADL / NAMDL driver-licence barcode RE chain

Problem: No documented private decoder chain for SA/Namibian DL 2D barcodes existed outside vendor DLLs (SWI32/zarlib/Summus.WiSDK).

Constraints: Undocumented binary formats, RSA blocks, marshalled structs, ARM/x86 and Android NDK variants; field scanning on low-end devices.

Approach: Framework 4.6.1 WinForms P/Invoke → net6/netstandard loader + Unicorn 2.1.3 + ELFSharp emulation → AGP 3.6.3 Android SDK → net6 decoder (GroupsStruct, F7/3B separators) → MAUI 8.0.72 ZARScannerSDK (BarcodeScanner.Mobile, Camera.MAUI, BouncyCastle, RSA 128/74-block + StripRowControlBytes, KeySet/VersionDetector).

Outcomes: Owned crypto/parser SDK from vendor glue to cross-platform decoder; MAUI demo with live camera capture.

Lessons: Emulation (Unicorn/ELFSharp) unlocks cross-platform RE without hardware; versioned KeySets future-proof against barcode revisions.

VC++C#UnicornBouncyCastleMAUIAndroid NDK

Logistics / Rail

Transnet RFID AEI tag decoder (rail)

Problem: Transnet rail tags used a 128-bit AEI encoding with undocumented field packing; existing tooling relied on opaque ParseATA.dll.

Constraints: Wiegand/McGain nibble checks, 6-bit ASCII/initials/trailer, ten equipment groups; junior spike needed to become owned protocol.

Approach: Framework 4.7.2 WinForms + ParseATA.dll + ATAUtils (389 lines) → net7/net8 AEITagDecoder (753 lines: getTagBits, EquipmentGroups 1/5/6/8/10/19/21/24/27/28, Locomotive/Wagon.FromString).

Outcomes: Self-contained 128-bit AEI decoder with full equipment-group coverage; verifiable rail-logistics building block.

Lessons: Decompiled checksum decoders (Sub10001xxx) are a stepping stone—own the bit layout to own the domain.

C# .NET 8AEI 128-bitWinForms

Embedded / Biometrics / Access Control

RDT fingerprint USB/Modbus terminals

Problem: Sites needed offline-capable biometric terminals with import/export, Excel fuzzy mapping, and field serviceability — surviving power and link outages.

Constraints: ESP32-S2 memory (16KB stack/heap RCA required), ArduinoJson streaming, Modbus/Relay/HID, SPIFFS employees.json, single-file WinForms deployment.

Approach: ESP32-S2 Arduino (USB CDC+HID, WiFi/WebServer/SPIFFS, Modbus, AS608/R558) + net8-windows WinForms single-file (ClosedXML, System.IO.Ports, RdtBackupTool/ImportExport/JsonRepair, xUnit tests) + ESP32_S2_Mini_Memory_Analysis (deserializeJson(doc,file), chunked print, yield/vTaskDelay).

Outcomes: Firmware + tested desktop tooling + written RCA as one field-deployable access-control system; stable snapshots documented.

Lessons: Streaming deserialize and chunked prints beat “it works on my desk”; offline SPIFFS ACL is non-negotiable for estate/yard lanes.

ESP32-S2Arduino C++C# WinFormsModbusAS608/R558

Security / Identity / MDM

Corporate ↗

OmniTrust / OmniLock zero-trust mesh

Problem: Sovereign SA-resident identity, defence mesh, MDM and cryptographic sealing without a central honeypot of PII.

Constraints: POPIA by architecture; 150+ Android policies; offline queues; edge verification latency; BYOS sealed blobs.

Approach: One-Agent SKM Mesh: OptiID DPoP STS (Heart/OpenIddict 7.4, Npgsql, Redis, FIDO2/SAML2), OmniWall/WAF (Go/eBPF, Coraza→ipset), MFA Mesh (8 providers), OmniVault Argon2id ZK, OmniKey air-gap, OmniTouch Modbus/Relay/HID, Gauss C2/SWERG BLE, OmniTrade Pedersen/Bulletproofs; OmniLock Blazor (EF8/Npgsql, ServiceBus/SignalR/MQTT/MassTransit, YARP, SkiaSharp QR; 10 FPS remote-control bypassing Blazor circuit).

Outcomes: 40+ csproj, threat-model/red-team audits, whitepapers; OmniTrust-STS extraction (GraphQL, PayFast, FICA/RICA+POPIA); production-grade MDM on rugged Zebra/Honeywell.

Lessons: Ed25519 purpose-bound tokens verified at the edge eliminate central permission lookups; sealed-blob schemas (values client-encrypted) de-risk tenancy.

OpenIddict 7.4Go/eBPFKotlin/NDKBlazor WASMMQTT/MassTransit

Enterprise / Corridor Logistics

CTMS / TTTFP kiosk MDM (SADC corridor)

Problem: SADC corridor needed operator + officials apps with MDM lockdown and enterprise deployment under constrained connectivity.

Constraints: Framework 4.7.2 WCF/EF6 + net7 Blazor coexistence; Pomelo MySQL/EF7/OData; offline APK deployment; per-event email builders.

Approach: Radzen Blazor + Pomelo MySQL/EF7/OData + Framework WCF/EDM + BouncyCastle/MailKit; MemberState/Device/Application/Supervisor/User/Token model; HelpDesk services; custom AES512/passwords/validations; APKDeploy/XamarinKeystore/db.bak + Kiosk_Guide v1.1.

Outcomes: Freelance SADC/Corridor Truck Association delivery (Fischer) with documented system guides and MDM lockdown.

Lessons: Kiosk guides are product; WCF→Blazor coexistence is viable when bounded contexts are explicit.

BlazorWCFMySQLBouncyCastleMDM

IoT / Energy / Hardware

Corporate ↗

OmniGrid HEMS energy mesh

Problem: Homes and yards needed solar HEMS surviving load-shedding, with frictionless onboarding and edge rules when cloud is absent.

Constraints: ESP-NOW → MQTT → SQLite rules → Shelly/Tasmota + 40A contactors; buck sizing (MP1584EN/LM2596), MAX3232, ACS712, epoxy potting, TV-box hub.

Approach: ESP32-C3 SuperMini (PlatformIO/ESP-IDF, ImprovWiFi BLE) + .NET10 edge (Kestrel+Mosquitto MQTTnet+SQLite EF) + MAUI (Plugin.BLE, ZXing); dongle Arduino (LittleFS, Modbus RTU, inverter_maps/battery_maps with Seplos/Daly/JK-BMS fallback); Tiqr QR + heartbeat anti-theft.

Outcomes: Full electrical spec, wiring diagrams, and JULES_MASTER_PROMPT as a repeatable HEMS kit.

Lessons: Edge SQLite rules survive the outage; QR/BLE onboarding removes the install-friction that kills HEMS adoption.

ESP32-C3MQTTnet.NET 10MAUIModbus RTU

Logistics / Ports / Estates

Container / OCR / logistics pipeline

Problem: Yards needed scan→parse→weigh→store→API with OCR on rugged handhelds and offline yards.

Constraints: TF-GPU 1.15, PixelLink+MobileNetV2+LSTM, 200ms/1080p target; MAUI CameraX/MLKit; weighbridge serial→TCP bridging.

Approach: ContainerRowCall (XAF 18.2 + net6 WebAPI EF7 + net6-android MAUI MLKit/CameraX) + ocr_images (VoTT labels, PaddleOCR) + RapidCM_New (ZXing/Tesseract, sqlite-net) + SerialToTcpScaleReader (net48 fan-out + emulator) + Teltonica/Maxi VMS.

Outcomes: End-to-end yard-to-gate story directly monetizable in ports/logistics/estates.

Lessons: Serial→TCP fan-out keeps yards running when links flap; on-device OCR latency budget (200ms) drives model choice.

PaddleOCRMLKitMAUISerial→TCPTeltonica

Related corporate surfaces

Products and ecosystem maps live on www.mobisec.co.za/products and /ecosystem — the corporate site is the catalogue; this site is the portfolio/CV. See also Achievements for the cross-cutting view.