trailofbits

Set up a personal VPN in the cloud

Trail of Bits skills for security research, vulnerability detection, and audit workflows

Symbolic execution tool

A semantic diff utility and library for tree-like files such as JSON, JSON5, XML, HTML, YAML, and CSV.

Opinionated defaults, documentation, and workflows for Claude Code at Trail of Bits

Publications from Trail of Bits

Buttercup finds and patches software vulnerabilities

CTF Field Guide

image scaling attacks for multi-modal prompt injection

Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.

Principled, lightweight C/C++ PE parser

A unit test-like interface for fuzzing and symbolic execution

Isolated VM environment for running Claude Code and Codex

Fast SNMP Scanner

A Docker container preconfigured with all of the Trail of Bits Ethereum security tools.

Run Rust lints from dynamic libraries

A Python pickling decompiler and static analyzer

Open-source symbolic execution framework: https://maat.re

Checksec, but for Windows: static detection of security mitigations in executables

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

A tiny web auditor with strong opinions.

DARPA Challenges Sets for Linux, Windows, and macOS

Semgrep queries developed by Trail of Bits.

Curated, community-vetted Claude Code plugin marketplace

Build and query a graph database representation of source code

Code auditing productivity multiplier.

VAST is an experimental compiler pipeline designed for program analysis of C and C++. It provides a tower of IRs as MLIR dialects to choose the best fit representations for a program analysis or...

A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

A pure Python cleanroom implementation of libmagic, with instrumented parsing from Kaitai struct and an interactive hex viewer

Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation

Exploring RPC interfaces on Windows

A kernelspace syscall interceptor and randomized faulter

Peer-to-Peer Video Chat for Corporate LANs

A user-mode application authorization system for MacOS written in Swift

Demonstration library for using the Secure Enclave on iOS

Google Protocol Buffers message generator

A differential fuzzer for x86 decoders

osquery extensions by Trail of Bits

A static analyzer and linter for the Circom zero-knowledge DSL

Scripts for Binary Ninja

Create code bookmarks and code highlights with a click.

Rewrite C++ code to automatically apply `constexpr` where possible

k8s audit repo

Find the ideal fuzz targets in a Rust codebase

MCP security wrapper

To make fuzzing Rust easy

Privacy Testing for Deep Learning

An LLVM sanitizer tutorial

Zero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.

Interactive documentation on zero-knowledge proof systems and related primitives.

Sandboxed, Rust-based, Windows Defender Client

Binary Type Inference Ghidra Plugin

CodeQL queries developed by Trail of Bits

A set of vulnerable Golang programs

A mutation-based tool for finding bugs in tests

A cross-platform library for verifying Authenticode signatures

CTF Challenge Framework for Windows 8 and above

BinRec: Dynamic Binary Lifting and Recompilation

CTF Challenges

Trail of Bits Testing Handbook - appsec.guide

Peter's Amazing Syntax Tree Analyzer

Deptective automatically determines the native dependencies required to run any arbitrary program or command.

A user-friendly fuzzing and crash triage tool for Windows

An experimental high performance, fuzzing oriented Intel Processor Trace capture and analysis suite

A CLI tool for managing DigitalOcean droplets with automated setup, SSH configuration, and lifecycle management.

A graph view plugin for Binary Ninja to visualize Objective-C

ebpfpub is a generic function tracing library for Linux that supports tracepoints, kprobes and uprobes.

A coverage-guided fuzzer for pure Ruby code and Ruby C extensions

An easy-to-use, extensible and lightweight C++17 wrapper for SQLite

A BPF-based syscall fault injector

AppJailLauncher in Rust

Sample programs that illustrate how to use control flow integrity with the clang compiler

Find unmaintained packages in Rust projects

Integrity validator for iOS devices

MCP server for Slither static analysis of Solidity smart contracts

A library for detecting certain improper uses of the "Defer, Panic, and Recover" pattern in Go programs

Buttercup CRS as submitted to the AIxCC Final Competition

A framework for instrumenting build tools

A tool to automatically detect copy+pasted and vendored code between repositories

Experimental version of Algo built on Terraform

The Manticore User Interface with plugins for Binary Ninja and Ghidra

The public release of LeftoverLocals code

Borrowed Instructions Synthetic Computation

Detecting Inconsistencies in Feature or Function Evaluations of Requirements

List of ML file formats

Example Manticore scripts

Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497.

gcov for what lines of code agents read

An efficient and generalized implementation of the IKOS-style KKW proof system (https://eprint.iacr.org/2018/475) for arbitrary rings.

mewt is a mutation testing framework

Use computer vision to determine if an IDN can be interpreted as something it's not

Security scanner for VS Code extensions

Mapping the NYC Infosec Community

idac - IDA Pro command line tool for agents and humans

SARIF Explorer: A VSCode extension that helps you visualize and triage static analysis results

A small script for running programs with (minimal) network sandboxing