@fra__bert

Juggler of bytes and all-purpose tinkerer. Research @trailofbits, bassist/guitarist/composer @havenlightsband

bertolaccini.dev
Joined June 2021
  • Tweets14
  • Following56
  • Followers25
1Media
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits12 Sep 2023
Macroni, a Clang front end that gives macros semantic representation, is now available on out Github. Use Macroni to extend the C language with Rust-like "unsafe" regions or fix C's type system with strong typedefs. buff.ly/3PAyl8I
4
1
23
4,054
Francesco Bertolaccini retweeted
Peter Goodman
@peter_a_goodman28 Jul 2023
PASTA is the culmination of years of work trying to wrangle reliable and actionable data out of Clang. The effort has required a lot of hacking and custom patches to Clang, especially in the preprocessor, but the results speak for themselves.
Trail of Bits
@trailofbits28 Jul 2023
Clang isn't a toolsmith's compiler. PASTA tries to fix this by providing safe-to-use C++ and Python wrappers to the Clang AST. PASTA also answers questions that Clang can't, like how parsed tokens relate back to macro expansions and files. Learn more: blog.trailofbits.com/2023/07…

The future of Clang-based tooling

Clang is a marvelous compiler; it’s a compiler’s compiler! But it isn’t a toolsmith’s compiler. As a toolsmith, my ideal compiler would be an open book, allowing me to get to everywhere from anywhe...

blog.trailofbits.com
8
28
7,869
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits22 Dec 2022
The naive approach to searching for patterns in source code is to use regular expressions, but that has limitations. Our intern prototyped an internal tool that does searching on Clang ASTs to avoid these limitations blog.trailofbits.com/2022/12…

Fast and accurate syntax searching for C and C++

The naive approach to searching for patterns in source code is to use regular expressions; a better way is to parse the code with a custom parser, but both of these approaches have limitations....

blog.trailofbits.com
3
14
1
91
13,872
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits14 Nov 2022
We’ve built many high-impact tools that we use for security reviews. But mastering them can take time. So we're bringing the mastery to you: we're going to be livestreaming tool workshops on our Twitch and YouTube channels! blog.trailofbits.com/2022/11…

We’re streamers now

Over the years, we’ve built many high-impact tools that we use for security reviews. You might know some of them, like Slither, Echidna, Amarna, Tealer, and test-fuzz. All of our tools are open...

blog.trailofbits.com
6
29
6
114
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits10 Nov 2022
During research that led to our discovery of a vuln in SQLite, we found something we call "divergent representations." Once we started looking for them, we found them everywhere blog.trailofbits.com/2022/11…

Look out! Divergent representations are everywhere!

Trail of Bits recently published a blog post about a signed integer overflow in certain versions of SQLite that can enable arbitrary code execution and result in a denial of service. While working on...

blog.trailofbits.com
3
36
5
153
Francesco Bertolaccini retweeted
Peter Goodman
@peter_a_goodman8 Nov 2022
Interested in how MLIR can help static analysis of C and C++? Then seek out @HenrichLauko at the LLVM developers meeting this week and hear him talk about VAST (github.com/trailofbits/vast), our system for modelling code as a tower of IRs.

GitHub - trailofbits/vast: VAST is an experimental compiler pipeline designed for program analysis...

VAST is an experimental compiler pipeline designed for program analysis of C and C++. It provides a tower of IRs as MLIR dialects to choose the best fit representations for a program analysis or fu...

github.com
1
7
35
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits25 Oct 2022
Earlier this year, one of our interns found a vulnerability that affects applications using the SQLite library API. We are publicly disclosing that vuln today. blog.trailofbits.com/2022/10…

Stranger Strings: An exploitable flaw in SQLite

Trail of Bits is publicly disclosing CVE-2022-35737, which affects applications that use the SQLite library API. CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000)...

blog.trailofbits.com
6
92
8
296
Francesco Bertolaccini retweeted
kleesymex@kleesymex15 Sep 2022
Peter Goodman @peter_a_goodman giving the first industry keynote at the @kleesymex workshop, posing an interesting question: Can Symbolic Execution Be a Productivity Multiplier for Human Bug-Finders?
2
7
43
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits25 Aug 2022
Magnifier is a UI that helps reverse engineers explore decompiled programs interactively without all the manual note-taking. Read about this excellent work from our intern, @tcode2k16! blog.trailofbits.com/2022/08…
1
25
1
109
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits22 Jun 2022
To hear Peter discussing in plain English the last 20 years - and future - of compilers, have a listen to the Trail of Bits Podcast episode, Future - trailofbits.audio/episodes/f…

Trail of Bits

Companies that make high assurance software - programs whose failure means catastrophic consequences like, a billion dollars disappears, or the rocket ship blows up on the launch pad - are adopting...

trailofbits.audio
Peter Goodman
@peter_a_goodman22 Jun 2022
I think this is the future of C and C++ compilers, static analysis, and source code verification. Also decompilers; can't forgot those! I want to see an open-source tower of IRs that can be descended by compilers, and ascended by decompilers.
1
6
Francesco Bertolaccini retweeted
Trail of Bits
@trailofbits17 May 2022
rellic-xref is our new interactive web interface for Rellic that displays your original LLVM modules and the decompiled C code side-by-side. Try it out and let us know what you think! blog.trailofbits.com/2022/05…

Interactive decompilation with rellic-xref

Rellic is a framework for analyzing and decompiling LLVM modules into C code, implementing the concepts described in the original paper presenting the Dream decompiler and its successor, Dream++. It...

blog.trailofbits.com
22
1
61
Load more