pancake :radare2:

Also known as trufae, author of :radare2: radare :verified: (npub1xch…hhww) 🌱

in catalan: pancake 🌱🥞 (npub14tc…r0ep)
Author of: https://radare.org
Tooting for r2: :radare2: radare :verified: (npub1xch…hhww)

Public Key

npub1en9zfs08erwfq69scrmw6wr8pkv46skxl8k4lhx8yka2pcua5xnq26wye5

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsvej3yc8nu3hysdzcvpahd8pnsmx2agtr0nm2lmnrjtw4quww6rfspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsw5dtc3

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1en9zfs08erwfq69scrmw6wr8pkv46skxl8k4lhx8yka2pcua5xnq26wye5

Show more details

Last Notes

2026-03-23 12:40:19 GMT

- reply

yep, escaping agent sandbox is a pretty common vuln and all agents are affected because there's literally no way to fix this than just add more checks when a escape is found. and even if you are requested to give permission to a directory, agents can write programs and execute without supervision or with hidden ways which makes it possible to access anything bypassing the classic checks.

2026-03-19 15:58:09 GMT

I just released new versions of r2, r2ghidra, r2frida, r2mcp, r2ai, r2sarif, r2yara, iaito, r2hermes, r2pipe, r2lang! Time to cook my lunch now! Merry xmas!

2026-03-08 07:42:30 GMT

- reply

happy to see gtk running in Haiku! Wondering if latest gtk versions are also maintained for this OS 🤔

2026-02-11 19:34:13 GMT

r2ghidra is ready for release. i'm waiting to cut r2-6.1 to trigger the ci. please help #radare2 to be tested as much as possible so we can make another stable release again!

2026-02-02 15:14:08 GMT

One of many talks I missed for not going to #fosdem, happy to watch them online now! “ga68, the GNU Algol 68 compiler at FOSDEM 2026” — https://m.youtube.com/watch?v=42rOV7mBd1E

2025-12-30 11:32:12 GMT

Today I saw this UNIX v4 PDP11 emulator (running simh in the browser) and decided to write an IO plugin for radare2 to load tapes. Here's the source in case you are curious about how tapes are structured and how to extend r2 with new features like IO backends. https://github.com/radareorg/radare2/commit/aeeccc1d23d3b75edcd6e0013f1372830a6af134

2025-12-30 10:05:01 GMT

“The tiktok alternative for intelligent people”

2025-12-27 18:37:23 GMT

- reply

swig? I hads lots of fun messing with it when binding the r2 apis. I ended up writing my own binding toolkit, but there are lots of bottlenecks, and then you have to choose between memory leaks or double frees. Python is awful xD thats why i ended up doing r2pipe and json serializers for everything. Faster, simpler and easier to maintain

2025-12-27 18:29:53 GMT

- reply

wonderful 🤩

2025-12-27 12:13:40 GMT

- reply

it’s also about finding a balance, not saying r2 apis are the best but i focus on fun and i try to stabilize apis in r2 and i prefer not to document anything as it’s time lost and prefer meaningful apis/structs

2025-12-27 09:14:00 GMT

- reply

both ghidra and ida are awful platforms for developing anything. My condolescenses

2025-12-27 06:39:15 GMT

- reply

i dont think a crappy api gets any better with documentation

2025-12-19 09:31:42 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/745/534/738/483/894/original/787c6f2c4701276e.jpeg

2025-12-18 08:30:30 GMT

- reply

do you have a sample json for testing? I can do the r2 plugin for this

2025-12-08 22:26:12 GMT

- reply

whats a function register?

2025-12-07 20:12:48 GMT

- reply

know that from the very first hand. My mother was ignored by several specialists. Took more than a year of tests to identify that was a tumour. It was too late, once found she wasnt treated for 3 month and then every single session destroyed her a little. I dont trust doctors and the medical system is super saturated.

2025-12-03 08:40:47 GMT

So deadmau5 is now into reversing huh https://www.threads.com/@ikontact_official/post/DRxAG0iEQxi
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/654/737/535/176/861/original/725c74288ecd5135.jpeg

2025-11-30 10:45:06 GMT

The Algol68 compiler fronted has been merged in GCC and the very next gcc16 will ship it! Cant mention the author here, but good job Jose!

2025-11-28 23:50:08 GMT

- reply

ooh! that's a good idea! i'll do it when i find some spare time. I wish i could bind it to the fediverse somehow, but sadly can't be done in static

2025-11-28 18:00:58 GMT

- reply

fixed https://github.com/trufae/aiblog/commit/feb29854cca82100c5f1f52a8c8e13bf71ca20ac

2025-11-28 12:14:57 GMT

- reply

i can also rename all those .md files for that indeed. https://github.com/trufae/aiblog i never use bookmarks in the browser and i care about typing economy thats why i use short names and such, but yeah, ill take that into account. hopefully not breaking much seo... about the title.. well i need to rewrite the script that “compile" the posts. ill note that for my future self :D

2025-11-28 12:03:38 GMT

👀 Before the #radare2 6.0.6 release during the testing stage I spotted a crash on Windows and decided to write a post explaining how I fixed it using only the cmd interface 👉 https://trufae.github.io/aiblog/WinCdbNull-en.html
As a UNIX person I'm not comfortable on #windows but i was happy to learn some commandline #debugging tools and shared some insights for #reverseengineering in my writeup. Hope you enjoy the reading!

2025-11-26 00:21:11 GMT

- reply

404

2025-11-20 23:44:44 GMT

So Google shipped a reverse enginered version of AirDrop? Im lazy to search for more info, fedi do your magic

2025-11-10 15:38:50 GMT

Few exploits with their CVEs for the Unitree G1 humanoid robot https://github.com/Bin4ry/UniPwn

2025-10-27 09:40:32 GMT

I’ve uploaded the slides and added the links to the videos of the two presentations i did at #r2con2025
* TocTouMaps https://github.com/radareorg/r2con2025/tree/main/TocTouMaps
* VibeReversing https://github.com/radareorg/r2con2025/tree/main/VibeReversing

2025-10-21 22:52:56 GMT

ProTip: A recommendation to enjoy more this year’s #r2con2025 as long as it's 100% online: Gather some friends with drinks and popcorn and watch the stream live together!
All the presentations are recorded, so the speakers will be available in the chat and really appreciate your live feedback in the Telegram/Discord and YouTube channels!

2025-10-21 06:33:44 GMT

- reply

wtf i just saw that Sam Altman is using a Ghibli style avatar.. that says a lot

2025-10-11 09:17:36 GMT

The IBM System/360 machine instructions reference card #s360 #assembly #mainframe https://archive.computerhistory.org/resources/access/text/2010/05/102678081-05-01-acc.pdf
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/354/779/830/252/137/original/c756eccd5f83273c.jpeg

2025-10-09 10:02:26 GMT

How you like/use your text editor? #vim #neovim #vscode #emacs #zed #ed #nano #HelixEditor

2025-09-18 10:48:54 GMT

“Rowhammer Attacks on DDR5 ::: PTE Exploit Demo” https://www.youtube.com/watch?v=1emxVQ6__qg

2025-09-09 23:27:46 GMT

Just pushed the last #webassembly build from git in the r2wasm test website. Testing, feedback and patches are welcome! Let’s make the web a solid foundation for r2 users too https://radareorg.github.io/r2wasm/index.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/176/928/391/676/724/original/5eaa80d938feee74.jpeg

2025-09-04 15:16:57 GMT

Firefox AI summaries for websites is just inlining the website contents with quotes, not even escaping the quotes inside, plenty of prompt injection vulns here..

2025-08-27 15:00:41 GMT

This page intentionally left blank
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/101/324/957/393/055/original/6cef523e6e9017af.jpeg

2025-08-22 09:01:35 GMT

📣I will be reaching out all the #r2con2025 speakers next week, in order to confirm the details of every presentation and get the schedule published in September!
If you are willing to present the #CFP closes in October! Reach me out if you have questions or half-shaped proposals to show!

2025-08-05 04:45:04 GMT

- reply

is the plugin loading greyed button fixed here?

2025-07-04 09:34:43 GMT

Funny FPU trick I discovered yesterday to detect arm64 or x86_64 architecture at runtime
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/794/278/325/994/881/original/f050d7233732ff58.png

2025-07-01 08:43:05 GMT

If case there was any doubt, Fediverse account are prefered over X mirror bots. Considering how poorly reliable X bridges are, the amount of api restrictions and the lack of interop for boostings and replies, consider posting here if you are a casual visitor!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/777/088/471/388/014/original/95fbe78f1e84ea65.jpeg

2025-06-24 17:30:56 GMT

Memory leaks be like
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/739/527/863/795/383/original/ceff8084bd162c61.jpeg

2025-06-11 05:52:07 GMT

👇
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/663/169/999/118/040/original/bf13e5eb02b859bf.jpeg

2025-06-07 12:54:41 GMT

💥 I'm a youtuber now! 📺
Just recorded a short video solving a crash in the #r2dec decompiler to lower the barrier to help new contributors get handy with the radare2 codebase and common developer workflows.
https://www.youtube.com/watch?v=Fr6cOa_YRkI
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/642/182/362/243/925/original/23c92c26866cbde2.jpeg

2025-05-26 10:20:47 GMT

Any recommended app for #gnome to do #TTS with good voice quality?

2025-05-16 18:07:58 GMT

Today I presented some practical usecases integrating language models for reverse engineering purposes with #radare2 eliminating the learning curve, decompiling high level abstractions, automating complex tasks and finding vulnerabilities with local models. Check out my slides at https://radare.org/get/r2ai-hackbcn.pdf
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/518/843/428/257/981/original/6c952d9e6aaaaa0e.jpeg

2025-04-26 10:17:22 GMT

Fyi, the deprecated decorator has been deprecated
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/403/746/719/572/627/original/2af2a470e93cc613.jpeg

2025-04-26 06:47:45 GMT

Threads is starting to rollout ads, another feature that we will never have in here
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/402/922/486/032/526/original/6eaa7a3a6834f6da.jpeg

2025-04-08 10:08:18 GMT

Git turned 20 yesterday. I feel old. Again https://github.blog/open-source/git/git-turns-20-a-qa-with-linus-torvalds/

2025-03-30 10:30:39 GMT

- reply

guess thats useful for intel and seo. Considering its suposed to be an inner job maybe there are some more private details but meh

2025-03-30 10:15:08 GMT

Poor X users https://hackread.com/twitter-x-of-2-8-billion-data-leak-an-insider-job/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/250/855/524/957/317/original/78a0c61d2d149428.jpeg

2025-03-28 14:25:01 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/240/512/365/379/050/original/0e0b34adf64e9eba.jpeg

2025-03-17 12:05:23 GMT

The first TUI disassemble and debugger I used which I spent lots of time in there for reversing viruses and understand better the internals of the DOS operating system was HACK from the nocash dude. I'm always happy to find its website up and use it in dosbox https://problemkaputt.de/hack.htm #reverseengineering #tui
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/177/678/418/800/777/original/db6961cfa6042861.png

2025-02-25 14:29:33 GMT

“Chrome Browser Exploitation: from zero to heap sandbox escape - Matteo Malvica - NDC Security 2025" https://www.youtube.com/watch?v=RL2po1swXO4

2025-02-18 14:53:51 GMT

Fun query I did today to perplexity. "Why this bloom filter have false negatives?" After 3h is still trying to find out the reason.

2025-02-18 06:56:24 GMT

I had a weird dream today, Apple was releasing a JVM written in Swift, enabling Java apps in the AppStore, this rumour was going to be released later this year in September. I hope my dreams don’t come true

2025-02-03 04:54:29 GMT

“For Sale: Binaries Compiled From Hand-Crafted Artisanal Code”
https://jasonbrownlee.me/blog/posts/hand-crafted-code/

2025-01-30 12:10:34 GMT

- reply

i'm surprised, i unsubscribed from all of them around the year 2000. i think its a terrible way to communicate, web forums is much worse. but it was burning my nerves to get my mailbox full everday. and i'm used to manually review 200 mails every day

2025-01-30 06:21:03 GMT

Do you (still) use mailing lists? #poll

2025-01-22 12:28:45 GMT

Will bluesky end up like X or Threads?

2025-01-22 09:12:35 GMT

American History Twitter

2024-12-18 06:43:00 GMT

- reply

what are the reasons for closing? :(

2024-12-09 18:09:56 GMT

Totally missed Huawei's new programming languages: ArkTS (ts subset that compiles to native code) and Cangjie (too much chinese documentation for me to understand it):
https://en.wikipedia.org/wiki/ArkTS
https://www.gizmochina.com/2024/06/21/huawei-cangjie-programming-language/

2024-12-06 16:35:03 GMT

RedSky #rightnow
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/606/863/282/192/751/original/cd798dc841525097.jpeg

2024-12-02 12:12:03 GMT

Yay! The r2k plugin for #radare2 is back! #kernel #reverseengineering
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/583/161/631/317/093/original/4d71ae8254db4952.png

2024-12-01 09:26:46 GMT

- reply

because I use vim all the time, i dont feel comfortable in any other editor, and even if this is solvable with custom configuration in vim or other editors, it feels like a ver inconvient place to script anything. Ida is way worse for scripting, but my experience in ghidra is totally out of my workflow

2024-12-01 08:22:55 GMT

- reply

lol. Another reason for not using ghidra

2024-11-29 10:55:54 GMT

How to enable ads in here??!1

2024-11-27 14:52:49 GMT

- reply

Maybe i can just priorize the lines of the selected bit group with the arrow keys, but i'm unsure about the the best choice for visualizing the instructions decomposed (the first at the top is the current one).

2024-11-27 14:42:33 GMT

Which one looks better to you? (vote in the reply post below because @npub163h…mv0n sucks by not allowing me to post a picture and a poll in the same toot)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/555/442/885/596/460/original/d708e5b4009ceb20.png

2024-11-21 07:36:44 GMT

Naming conventions, always surprising me
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/519/794/623/414/121/original/243f1faa4ff66876.jpeg

2024-11-18 01:35:29 GMT

One more device to run @npub1xch…hhww #phosh #pmos
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/501/387/240/903/627/original/6b959ae5bcf7a587.jpeg

2024-11-17 08:37:22 GMT

Bluesky best feature is custom timelines and the ability to create and share them, [@threads](https://threads.net/@threads/ ) now have that thing too, @npub163h…mv0n now it’s your turn!

2024-11-07 11:55:21 GMT

In 2009, 3 years before starting with #radare2 I wrote an article for the #Phrack messing around with r1, still fun to read and see how command syntax didnt changed much in 15 years https://phrack.org/issues/66/14.html

2024-10-21 15:22:38 GMT

We can finally run Doom in Quake! https://www.youtube.com/watch?v=tVOYmYUWkmE #doom

2024-10-10 13:02:39 GMT

Can someone get this thing to work? Is there any other option to spot gaps in padded fields on structs in C programs? https://github.com/arvidn/struct_layout

2024-10-01 09:11:24 GMT

John Carmack on the value of simplicity over safetyness in C
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/231/389/080/542/714/original/0d13e33a29f3d14c.mp4

2024-09-25 14:28:23 GMT

I though having Slack eating 32.8GB of virtual memory was quite a lot, but then I find out that Discord was taking 1141.2GB... w t f
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/198/663/822/135/822/original/677baa3f841416e4.png

2024-09-21 07:32:50 GMT

The z/OS C/C++ runtime library
https://github.com/ibmruntimes/zoslib/tree/zopen2 #s390x #zOS

2024-09-08 07:29:37 GMT

Frida 16.5.0 adds native breakpoint and watchpoint APIs. There was some attempts to implement those in DWARF and #r2frida already, but having them in the stock SDK makes them way more comfortable to use and stable https://frida.re/news/2024/09/06/frida-16-5-0-released/ #frida
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/100/762/997/897/127/original/b8ccddfa26427399.jpeg

2024-09-03 09:26:46 GMT

- reply

sounds like lots of fun for r2wars :"D

2024-08-31 14:30:10 GMT

Did you ever found firmwares for Tricore or v850 architectures accessing addresses starting with 0xa.. instead of the 0x80.. one? after so much research I end up learning that this is handled by the mmu which applies a cache layer on top of the same memory range. In other words: IDA lies by fake the references by dropping the 3rd bit, ghidra can't handle this, and r2 is again the only tool able to properly define this memory layout.
https://community.infineon.com/t5/AURIX/About-the-issue-with-lsl-files/td-p/676113#.

2024-08-26 17:10:37 GMT

Do you have IPv6 at home/phone?

2023-01-24 11:35:36 GMT

- reply

Some pointers for beginners (like me). The hardware is still not fully supported, there are many changes every day in the kernel, bootloader and drivers. My board comes with an old uboot and spiboot firmware, so i can only boot the old 55 image (the 69 requires to update that stuff to run), took me a bit to find the right information and sdcard images to run. So here are some links to ease your life:
Documentation:
* Quick Start Guide (PDF) https://doc-en.rvspace.org/VisionFive2/PDF/VisionFive2_QSG.pdf
* Technical reference manual https://doc-en.rvspace.org/VisionFive2/SWTRM/index.html
Bootable Images:
* Ubuntu WIP image https://ubuntu.com/download/risc-v
* Official Debian images: (pick the 55) https://debian.starfivetech.com
* GitHub releases https://github.com/starfive-tech/VisionFive2/releases/
Note. the credentials for the debian image are: "root" / "starfive"

2023-01-24 10:06:48 GMT

Here we go RISCV all the way!!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/109/743/618/972/853/726/original/dd5b6c22639ece5b.png