pancake
banner
trufae.bsky.social
pancake
@trufae.bsky.social
Author of @radareorg, mainly active in the fediverse @pancake@infosec.exchange
Reposted by pancake
Never again will an Apple Watch tell me to stand up when I’m already standing up.

New Pebble and old Pebbles: back in business!

thanks @ericmigi.com
November 1, 2025 at 7:20 PM
Reposted by pancake
Sonic, la mascota més genial
October 6, 2025 at 3:55 PM
Reposted by pancake
Happy radare2 6.0.4 release day infosec.exchange/@radareorg/1...
September 28, 2025 at 7:29 AM
Reposted by pancake
📣The list confirmed talks for #r2con2025 are now public! How does it look?

🧸Bear in 🧠 mind that the list is incomplete because the CFP is still open and there are some unconfirmed talks still to be published!

⚓️ radare.org/con/2025
radare.org
September 8, 2025 at 6:34 PM
Just posted about tricks to structure prompts in oneliners, understanding the different uses of newlines and finding the right alternative puctuations. #llm #ai trufae.github.io/aiblog/oneli...
Posts Madeup by AI
trufae.github.io
September 8, 2025 at 6:36 PM
Reposted by pancake
A Mastodont ens han ensenyat a hackejar el MetaAI per què parli en català.
August 27, 2025 at 7:38 AM
Reposted by pancake
longjmp implies the existence of floatjmp and doublejmp
they should make longjmp2, a new and more fucked up longjmp variant
July 2, 2025 at 10:18 PM
Just arrived the #radare2 book! I will finally had a chance to learn it! #reverseengineering #books
July 2, 2025 at 6:27 AM
In my journey thru all the social networks I use to forget bsky is a thing, sorry if I don’t post much here, i’m mainly in the fediverse
June 28, 2025 at 7:13 PM
📦 In my last video for r2tv I introduce r2pm, the package manager. Learn about how to create, search and install plugins and tools for radare2!

▶️ 10 min - www.youtube.com/watch?v=N31b...
▶️ 20 min - youtu.be/DbVBbxOL7KY
June 28, 2025 at 8:06 AM
Reposted by pancake
¡Atención activistas!

La Marcha por los Animales de Barcelona ya tiene fecha:

📅 21 de junio de 2025
⏰ 17:00 - 19:00 h
📍 Empieza en: Plaza Catalunya
🎯 Termina en: Arco de Triunfo

🔸 Resérvate el día y mantente atenta, porque pronto compartiremos más detalles.
March 19, 2025 at 7:05 PM
📺 In the second video for #r2tv I explain the caveats of injecting null bytes in the process environment with rarun2, inspect the stack with r2frida and bypass limitations encoding the payload with ragg2! www.youtube.com/watch?v=-CMH...
Exploiting the environment with null bytes with radare2
YouTube video by r2con
www.youtube.com
June 15, 2025 at 7:48 PM
💥 I'm a youtuber now! 📺

Just recorded a short video solving a crash in the #r2dec decompiler to lower the barrier to help new contributors get handy with the radare2 codebase and common developer workflows.

www.youtube.com/watch?v=Fr6c...
Fixing r2dec crash -- by pancake
YouTube video by r2con
www.youtube.com
June 14, 2025 at 9:50 AM
Reposted by pancake
userland ROP on day 1 💪
June 5, 2025 at 8:48 AM
Reposted by pancake
We can finally spin donuts in iaito! 🍩 🍩 (i know, that's an ancient feature request that brings us closer to get 1:1 feature parity with #radare2 ) But it's better late than never! Enjoy 🎉

PD: You can spin as many donuts as you want!
May 30, 2025 at 8:09 PM
In X right now if you don't pay, your posts won't be seen by anyone, no matter if you search for keywords, use hashtags or mention. I have to go right to the profile and scroll down to the posts of each user to see if anyone said anything. If I just didn't had enough reasons for not using it
May 30, 2025 at 4:28 PM
Reposted by pancake
❗️ Hemos sido testigos del horror en el que sobreviven los cerdos antes de ser enviados al matadero.

Las afecciones en el sistema respiratorio, el canibalismo, los prolapsos y las afecciones oculares son algunos de los problemas de salud más comunes.

Visita y comparte Granjas.org ✍️
May 29, 2025 at 6:28 AM
Reposted by pancake
Detecting malicious Unicode
In a recent educational trick, curl contributor James Fuller submitted a pull-request to the project in which he suggested a larger cleanup of a set of scripts. In a later presentation, he could show us how not a single human reviewer in the team nor any CI job had spotted or remarked on one of the changes he included: he replaced an ASCII letter with a Unicode alternative in a URL. This was an eye-opener to several of us and we decided we needed to up our game. We are the curl project. We can do better. ## GitHub The replacement symbol looked identical to the ASCII version so it was not possible to visually spot this, but the diff viewer knows there is a difference. In this GitHub website screenshot below I reproduced a similar case. The right-side version has the Latin letter ‘g’ replaced with the Armenian letter co. They appear to be the same. GitHub shows a diff. But what is actually the difference? The diff viewer says there is a difference but as a human it isn’t possible to detect what it is. Is it a flaw? Does it matter? If done “correctly”, it would be done together with a _real_ and expected fix. The impact of changing one or more letters in a URL can of course be devastating depending on conditions. When I flagged about this rather big omission to GitHub people, I got barely no responses at all and I get the feeling the impact of this flaw is not understood and acknowledged. Or perhaps they are all just too busy implementing the next AI feature we don’t want. ## Warnings When we discussed this problem on Mastodon earlier this week, Viktor Szakats provided me with an example screenshot of doing a similar stunt with Gitea which quite helpfully highlights that there is something special about the replacement: Gitea warns that the replacement is using “ambiguous Unicode characters” I have been told that some of the other source code hosting services also show similar warnings. As a user, I would actually like to know even more than this, but at least this warns about the proposed change clearly enough so that if this happens I would get the code manually and investigate before accepting such a change. ## Detect While we wait for GitHub to wake up and react (which I have no expectation will actually happen anytime soon), we have implemented checks to help us poor humans spot things like this. _To detect malicious Unicode._ We have added a CI job that scans all files and validates every UTF-8 sequence in the git repository. In the curl git repository most files and most content are plain old ASCII so we can “easily” whitelist a small set of UTF-8 sequences and some specific files, the rest of the files are simply not allowed to use UTF-8 at all as they will then fail the CI job and turn up red. In order to drive this change home, we went through all the test files in the curl repository and made sure that all the UTF-8 occurrences were instead replaced by other kind of escape sequences and similar. Some of them were also used more or less by mistake and could easily be replaced by their ASCII counterparts. The next time someone tries this stunt on us it could be someone with less good intentions, but now ideally our CI will tell us. ## Confusables There are plenty of tools to find similar-looking characters in different Unicode sets. One of them is provided by the Unicode consortium themselves: https://util.unicode.org/UnicodeJsps/confusables.jsp ## Reactive This was yet another security-related fix _reacting_ on a demonstrated problem. I am sure there are plenty more problems which we have not yet thought about nor been shown and therefore we do not have adequate means to detect and act on automatically. We want and strive to be proactive and tighten everything _before_ malicious people exploit some weakness somewhere but security remains this never-ending race where we can only do the best we can and while _the other side_ is working in silence and might at some future point attack us in new creative ways we had not anticipated. That future unknown attack is a tricky thing.
daniel.haxx.se
May 16, 2025 at 7:10 AM
Today I presented at #hackbcn some practical usecases integrating language models for reverse engineering purposes with #radare2 Check out my slides at radare.org/get/r2ai-hac...
May 16, 2025 at 7:30 PM
Reposted by pancake
curious about what each engineer is working on? let's find out!
May 13, 2025 at 10:12 PM
Reposted by pancake
What's new in Swift 6.2? A whole ton of stuff – raw identifiers, Collection conformances for enumerated(), method key paths, backtracing, weak let, Observations, InlineArray, and of course a big batch of concurrency changes too. Want to see it all in action? www.hackingwithswift.com/articles/277...
What's new in Swift 6.2?
Raw identifiers, backtraces, task naming, and more.
www.hackingwithswift.com
May 9, 2025 at 8:12 PM
Reposted by pancake
El día de hoy en #RetroBarcelona.se ha dado bien, diría yo.

Nos vemos mañana en @retrobarcelona.bsky.social con John Romero a las 15:00.
May 3, 2025 at 11:15 PM
Reposted by pancake
Gent, aquesta tarda a la #RetroBarcelona no us podeu perdre l'entrevista al John Romero que farem la @lauralunalu.bsky.social i un servidor a les 15:00 a l'escenari gran.

I, atenció, a les 18:30 faré una visita guiada (en català) a l'exposició d'ordinadors. Em farà ilu que vingueu!!
May 4, 2025 at 9:02 AM
Reposted by pancake
Deno 2.3 is here:
🌱 deno compile with FFI & Node native add-ons
📦 Local npm packages
⭐ deno fmt CSS/HTML/SQL in tagged templates
🔭 OTel event recording & tracing in distributed services
and more —

deno.com/blog/v2.3
Deno 2.3: Improved deno compile, local npm packages, and more
Deno 2.3 adds new features for deno compile and deno fmt, support for using local npm packages, several performance improvements, and more. Here are the biggest highlights.
deno.com
May 1, 2025 at 3:45 PM