Security engineer and researcher turning low-level technical analysis into practical security outcomes: detections, investigations, response workflows, and tools.

My work spans systems security, reverse engineering, threat intelligence, incident response, detection engineering, and AI-enabled security automation.

• fkie-cad/cwe_checker — Former developer and maintainer of a cross-architecture binary-analysis tool that detects vulnerable patterns in compiled code.
• fkie-cad/FACT_core — Former developer and maintainer of a platform for automated firmware extraction, analysis, and comparison at scale.
• BSD engineering — Security and reliability work across FreeBSD, NetBSD, and OpenBSD through responsible disclosure, upstream fixes, public PoCs, and maintenance of FreeBSD's misc/xdelta3 port, whose adoption and update landed upstream.
• tbarabosch/macos-re — A maintained collection of Python, C, C++, assembly, and shell tooling for practical macOS reverse engineering.
• Research systems — Quincy, an archived memory-forensics prototype supporting DIMVA 2017 research, and LuckyCAT, a distributed fuzzing-management framework presented at Black Hat Europe 2018.
• tbarabosch/apihash_to_yara — Author of a tool that generates YARA rules from Windows API hashes for malware detection and hunting.
• Selected upstream contributions — 17 commodity Linux TTPs for Meta's ForgeArmory, contributions to Deutsche Telekom's malware-analysis artifacts, and BAP/Emacs tooling.

• 15+ years across security research, engineering, threat intelligence, detection, and incident response.
• PhD in Computer Science on formalizing and detecting host-based code injection attacks in the context of malware.
• Systems security research: five disclosed CVEs and credit across 58 upstream BSD commits.
• Research communication: Published research and presentations span binary analysis, fuzzing, firmware, kernel security, malware, and botnet operations; presentation venues include Black Hat USA and Europe, FOSDEM, Pass the SALT and Botconf amongst others.
• Community service: Botconf programme committee member since 2017.

• Active and substantial:
• Representative systems work: macos-re and 1001-injects apply these languages to reverse engineering and code-injection research.
• Language path: → → → → , evidenced by yaipl and the early cwe_checker.
• Exploratory: , including recent writing on Prolog for auditable reverse-engineering reasoning and Lisp/Scheme recipes in cwe_checker.
• Specialized public work: in apihash_to_yara.

• Adopting a FreeBSD port — maintaining the metadata, checksums, dependencies, patches, and packaging decisions behind pkg install.
• One BSD’s fix is another BSD’s bug — finding security fixes that may not have propagated across related kernels.
• Trap fuzzing: random instructions, real bugs — why random native instructions expose privileged failure paths.
• Detect API hashing with YARA — turning Windows API hashes into practical malware hunting rules.
• From Problem to Operations — an engineering workflow for security tooling that lasts.
• The Agentic Performance Ladder — one reverse-engineering workload across Python, native C++, and Metal.

Read all articles →