Stefano Bonicatti

While we take great pride in the tools we develop, we also benefit from tools maintained outside of the company. In 2022, we had more than 400 pull requests merged into non-ToB repos. We thank the maintainers for innumerable hours spent on this work! blog.trailofbits.com/2023/01/10/ope…

My last BPF article has a new home! In case you missed it, it's a handy introduction on programmatically generating tracers at runtime using the LLVM libraries. Be sure to check out the companion code too: github.com/trailofbits/bp… blog.trailofbits.com/2021/11/09/all…

Here's a new ebpfpub example to trace bash events with #eBPF using C++ and the LLVM libraries: github.com/trailofbits/eb… asciinema.org/a/ZIxGquPIQdG2…

Ever wanted to dynamically codegen and load your #bpf programs from C++ with nothing except #llvm? Take a look at this example we have released! github.com/trailofbits/mo…

I've added a new execsnoop example to our #eBPF based function tracing library! 😀 github.com/trailofbits/eb…

Inspired by the Linux version of #ProcMon, I wrote a new SocketMonitor example for the ebpfpub library from @trailofbits! You can find it here: github.com/trailofbits/eb…

Syscall fault injection is a really cool testing technique, but doing it reliably is hard. BPF has got your back, thanks to the bpf_override_return() helper! Here's a small tool I developed to play with it: github.com/trailofbits/eb…

BPF provides powerful system tracing capability on Linux but it is difficult to integrate into your applications. Today I'm releasing a BPF library, ebpf-common, and a tracing library based on LLVM: github.com/trailofbits/eb…

TSC Frequency For All: Better Profiling and Benchmarking blog.trailofbits.com/2019/10/03/tsc…

Slides from my talk about how we do cross platform packaging here at @Kolideco ! #querycon github.com/directionless/…

Tired, but excited about all the awesome interactions @QueryConf this year. Thanks to @trailofbits, @Kolideco and @CarbonBlack_Inc, well done. Biggest takeaway this year is that the @osquery community deeply cares about the privacy of users.

@trailofbits generously supports the infosec community in many ways (github.com/osql/osql, hosting @QueryConf, etc) 🙌 We're stoked they've joined our "Friends of Objective-See" program & as an OBTS conference sponsor 🥳 Mahalo for your community commitment & involvement !😍

We are happy to announce the first two talks for @QueryConf, with many more on the way. First up, Stefano Bonicatti of @trailofbits will share our work and vision for osql, our fork of osquery #speakers" target="_blank" rel="nofollow noopener">querycon.io/program#speake…

Second, our own @alessandrogario will review the past and present state of Linux event monitoring with osquery, including a demonstration of our new eBPF backend.

Watch this space for more talks being announced on Monday, and register now to reserve your spot to attend @QueryConf: eventbrite.com/e/querycon-201…

Based on popular demand, we have added Press Passes to @QueryConf! Please register via eventbrite for a free ticket to attend the conference. querycon.io

Announcing the community-oriented osquery fork, osql blog.trailofbits.com/2019/04/18/ann…

Announcing QueryCon 2019 blog.trailofbits.com/2019/04/09/ann…

I can confirm! twitter.com/Terrorbane_BNS…

Tracking a stolen code-signing certificate with osquery blog.trailofbits.com/2017/10/10/tra…