Mathieu Tarral

Security Research @intel ·
kAFL : HW assisted feedback fuzzer for x86 VMs ·
tsffs : Coverage guided fuzzer built on SIMICS ·
OSWatcher: Git for OS

[Mathieu Tarral @mtarral]

🚀 OSWatcher 0.6
Git Log is here !

Trace a <file / registry key / symbol / struct field> accross commits

Demo with _EPROCESS.Flags2 evolution ⬇️

➡️https://t.co/PeWLVBR60x

[Mathieu Tarral @mtarral]

🤝 Open-sourcing this is step one. I'd love to grow a community around the project.

Feedback, ideas, and contributors all welcome !

https://t.co/PeWLVBR60x
cc @0x_shaq , @m0n1x90 , @PetrBenes , @xaitax
@neo4j

[Mathieu Tarral @mtarral]

🚀 Just open-sourced Neogit

Foundation library behind OSWatcher project
Git-like snapshots for filesystems, backed by a Neo4j graph you can query

📦pip install neogit
⭐https://t.co/gmDIMPi0Ws

Here capturing and diffing 2 Debian container filesystems

[Mathieu Tarral @mtarral]

OSWatcher has a whole stack on top:
GraphQL server, custom Neo4j procedures, extraction plugins..

🏗️ But the big one is the builder:
Recipes that rebuild decades of OS history from scratch and capture it all into the graph, updates included.

🚀That's what I'll focus on next..!

[cr3ghost @cr3ghost]

Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.

A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.

No paywall. No course. Just research. Free as in beer.

https://t.co/x516DQRcB8

Author: @ale_sp_brazil

#ReverseEngineering #MalwareAnalysis #InfoSec

[Hexacon @hexacon_fr]

Windows Internals for Security Engineers by @yarden_shafir

📅 Oct 12-15
📍 Espace Vinci or Espace Cléry, Paris 2nd
👉 https://t.co/90NKwD8DU3

[_ZN4DionC1Ev @justdionysus]

Given access to recent LLMs, the number of things you could be doing explodes. Choosing how to spend your time has never been more important both technically and personally. Building because you can is seductive and it compounds with inexperience. It looks like addiction to me.

[offensivecon @offensive_con]

Offensivecon's talks are now available on our YouTube channel!

🔗 https://t.co/cBmHPsj7qV

[Mathieu Tarral @mtarral]

@Digital_Cold ~7M nodes / 41M edges
341 OS snapshots (Win desktop + Ubuntu) across 72 branches

Multi-layer per snapshot:
- 2.6M file blobs (filesystem)
- 824K registry keys / 616K values
- 2M symbols, 38K structs & fields (PDB)

Happy to index mobile OS as well.

[Mathieu Tarral @mtarral]

Some news: I'm open sourcing OSWatcher 🎉

First piece is neogit ⚡️
Commits entire OS filesystems into Neo4j as a content-addressed graph.

Polishing the repo rn, here's a sneak peek 👇

[Mathieu Tarral @mtarral]

@Digital_Cold Need SSH to connect to the DB.

But in the meantime, here's the frontend ! 👏
https://t.co/PeWLVBR60x

[Mathieu Tarral @mtarral]

cc @0x_shaq @m0n1x90 @neo4j

[Mathieu Tarral @mtarral]

@JonnyJohnson_ Sincere congrats to you both 👏🥂

[Adam Karpiak @Adam_Karpiak]

“listed as ‘remote’ for visibility” is wild

[Calif @calif_io]

Google paid us $57,000 for two bugs in Chrome.

We’re not doing this for the bounty, but it’s always fun to get rewarded.

These bugs were found using nothing fancier than a $20/month AI subscription.

If you’re curious, come check out our talk at the Real World AI Security Conference at Stanford: https://t.co/QPanlB3lUS

We haven’t published the Chrome bugs in our MAD Bugs series. They work better as part of something even more fun, stay tuned!

[Unprompted AU @UnpromptedAU]

The https://t.co/NSdktUM8QC CFP is officially OPEN! If you are doing cool stuff with AI in offense, defense, or working on core AI tech (from frontier models to open source LLMs), we'd love to hear from you! Submit here: https://t.co/d9C6yxxZbi

[Zach Lloyd @zachlloydtweets]

https://t.co/cjyoRlzgxO

[Tim Blazytko @mr_phrazer]

Excited to teach my deobfuscation class at Hexacon in October again. This will be the only planned on-site iteration in Europe this year.

[Adam Thierer @AdamThierer]

truly one of the most amazing developments in trans-Atlantic tech policy over the past 20 years is the way that Europe set out to regulate US tech giants into the ground, but only made them more dominant as a result.

This Economist headline really says it.

[Mathieu Tarral @mtarral]

@b1ack0wl Happy birthday 👏 🎂 !