Current
mquire - github.com/trailofbits/mquire
A memory forensics tool for Linux that can analyze kernel memory snapshots without needing external debug symbols. It uses BTF type information and kallsyms data already embedded in the kernel to let you query running processes, open files, network connections, and kernel modules from a memory dump using SQL. It also supports recovering deleted files from the kernel’s file cache. More recent work adds triage views aimed at spotting compromise — injected code, dynamic-linker hijacks, unexpected capabilities, and kernel hooks that belong to no module — cross-checking several independent sources of process discovery to catch what a rootkit tries to hide.
btfparse - github.com/alessandrogario/btfparse
A Rust library for parsing BTF (BPF Type Format), the format Linux uses to store type information for BPF programs. It reads BTF into a typed model and lets you navigate it: resolve a type by name, follow pointers, compute a type’s size, and turn a dotted member path like d_name.len in dentry into a byte offset — the kind of queries you need to walk kernel structures in a memory dump. Input comes through a small Readable trait, so it works against a live /sys/kernel/btf/vmlinux, an in-memory buffer, or any source you adapt to it. This is a rewrite of the original C++ library, deliberately narrower: it drops the header generator and the FFI in favor of a clean navigation API. It is the crate mquire is built on.
ebpf-common - github.com/trailofbits/ebpf-common
A C++ library of building blocks for writing BPF tools, used across several of the projects below and by osquery. It can produce BPF programs two ways — by emitting LLVM IR directly through an IRBuilder-based helper API (with a BTF-to-LLVM type bridge), or by compiling C source with a bundled Clang frontend — and wraps the parts every BPF tool needs: maps, perf-event output, kprobe/uprobe/tracepoint attachment, and loading programs into the kernel.
Prototypes
podcell - github.com/alessandrogario/podcell
A personal tool for managing rootless Podman containers as isolated development environments. It was built out of the need to run AI agents in a contained space without worrying about what they might do to the host. It creates containers with a fixed security profile: most capabilities dropped, sensitive /proc and /sys paths masked, pasta networking, and user namespace mapping so file ownership works without friction. The podcell binary mounts itself into the container and acts as the entrypoint, handling both first-run initialization (creating a matching user, installing sudo and bash) and subsequent starts. Entering a container drops you into a login shell as your own user.
linuxevents - github.com/trailofbits/linuxevents
A C++ library for monitoring process execution events on Linux using eBPF, with no dependency on BCC or external compiler tooling. The key idea was to eliminate all external build-time requirements by driving the entire BPF compilation pipeline from within the process itself. At startup, it reads the kernel’s BTF data from /sys/kernel/btf/vmlinux using the C++ btfparse library, generates a complete kernel types header entirely in memory, and feeds that header alongside the BPF C source directly into an embedded Clang compiler instance. The compiler produces LLVM IR and then BPF bytecode without ever writing a file to disk. The result is a library that compiles and loads its own BPF probes at runtime using only libclang and LLVM as dependencies.
Past
btfparse (C++) - github.com/trailofbits/btfparse
The original C++ library for parsing BTF debug symbols from the Linux kernel. Beyond parsing, it can reconstruct a compilable C header from the BTF data entirely in memory: it resolves the full type dependency graph, orders the declarations topologically, breaks cyclic dependencies with forward declarations, materializes explicit struct padding so layouts stay ABI-correct, and names anonymous types. Includes a dump-btf command line tool compatible with bpftool output. Superseded for my forensics work by the Rust rewrite, which took a different, navigation-focused direction.
ebpfault - github.com/trailofbits/ebpfault
A syscall fault injector built on eBPF. It lets you configure system calls to fail at a given probability, which is useful for testing how applications handle error conditions. Under the hood it attaches a kprobe to the chosen syscall and runs a small BPF program that rolls a random number against your configured probabilities and, on a hit, uses bpf_override_return to make the call fail with the errno you picked instead of executing. You can target a new process, specific PIDs, or the whole system minus an exclude list. Works on any machine with a compatible kernel, no other requirements — no kernel module or driver.
ebpfpub - github.com/trailofbits/ebpfpub
A Linux function tracing library built on eBPF. It was purpose-built to trace system calls on older distributions with limited BPF support, back before CO-RE existed — so it couldn’t ship precompiled BPF bytecode, which only runs on the exact kernel it was built for. Instead it generates each probe at runtime: it reads the event’s field layout from the running kernel’s own tracepoint format descriptors and emits the program on the fly as LLVM IR, so it needs no kernel headers on the target and adapts to whatever kernel it lands on. This covered a wide range of kernels that more modern BPF tools could not run on. Still used by osquery. Now considered legacy, as the older-kernel constraints it was designed around are no longer relevant.
IDA Function Tagger - github.com/alessandrogario/IDA-Function-Tagger
An IDAPython script for IDA Pro that automatically tags subroutines based on which imported functions they call. It helps quickly identify the purpose of functions during reverse engineering without having to inspect each one manually.
Zeek Agent - github.com/zeek/zeek-agent
An endpoint monitoring tool and enrichment addon for Zeek. It collects file, socket, and process events from Linux and macOS endpoints and reports them to Zeek, giving the network security monitor visibility into endpoint activity. Uses osquery for scheduled endpoint queries. Archived in 2022, superseded by zeek-agent-v2.