Security researcher at Intel since January 2022, in IPAS since August 2025.
I build fuzzing and introspection infrastructure for hard-to-reach targets: firmware, kernels and hypervisors, where snapshotting and hardware-assisted coverage replace the source instrumentation used elsewhere.
Before Intel I worked on virtual machine introspection at ANSSI and F-Secure, and I have been maintaining open-source VMI tooling for Xen and KVM since 2015.
| Repository | Stars | What it is |
|---|---|---|
| Fuzzing | ||
| kAFL |
|
Snapshot-based, hardware-assisted kernel fuzzer (Intel PT coverage, KVM) |
| TSFFS |
|
Coverage-guided fuzzer for firmware and bare-metal targets, built on SIMICS |
| Virtual machine introspection | ||
| libmicrovmi |
|
Cross-platform, hypervisor-agnostic VMI API in Rust, backed by published crates.io bindings for Xen, KVM, Hyper-V and VirtualBox |
| KVM-VMI |
|
VMI on KVM: framework, patched KVM and QEMU forks, and Nitro |
| Binary analysis | ||
| checksec.py |
|
Binary hardening scanner for ELF, PE and Mach-O, based on LIEF |
| Reference | ||
| awesome-virtualization |
|
Curated list of virtualization resources |
| Archived | ||
| pyvmidbg |
|
Agentless, guest-aware GDB server built on LibVMI |
| r2vmi |
|
Hypervisor-level debugger built on radare2 and LibVMI |
Every release of Windows from 95 to 11, and Ubuntu from 6.10 to 25.10, captured and indexed as a single content-addressed graph.
Images are built and captured offline from their qcow2 disks, with no agent running in the guest, then modelled in Neo4j on a git-inspired Branch -> Commit -> Tree -> Blob structure. Filesystems, the Windows registry, PDB symbols with reconstructed C structs, DWARF, and syscall tables are indexed as first-class entities, so any two releases can be diffed and any artifact can be traced by hash across every release that ever shipped it.
Seven repositories, Apache 2.0, spanning capture, graph modelling, enrichment, query and UI:
| Repository | Language | Role |
|---|---|---|
| osw-builder | Python | Builds and captures whole sets of OS images |
| neogit | Python | Content-addressed merkle model on top of Neo4j |
| oswatcher-plugins | Python | Post-capture enrichment: registry, symbols, DWARF, syscalls, file types |
| oswatcher-procedures | Java | User-defined Neo4j procedures for fast tree diffing |
| graphql-api | TypeScript | Query surface over the corpus |
| frontend | TypeScript | Web UI |
| oswatcher-deploy | Shell | Deployment orchestration |
- 2020: FOSDEM - Rustifying the Virtual Machine Introspection ecosystem
- 2019: Hack.lu - Leveraging KVM as a Debugging Platform
- 2019: Insomni'Hack - Building a Flexible Hypervisor-Level Debugger
- 2018: Hack.lu - Hypervisor-Level Debugger Benefits & Challenges
- 2018: M. Cafasso, M. Tarral, Designing flexible sandboxing solutions to adapt to new malware trends, Computer Fraud & Security, 2018(2), 5-9
- 💪 Opened PR #379 in intel/tsffs
- 🗣 Commented on #338 in intel/tsffs
- 🗣 Commented on #347 in IntelLabs/kAFL
- 💪 Opened PR #105 in OSWatcher/oswatcher-procedures
- 🎉 Merged PR #104 in OSWatcher/oswatcher-procedures