Romain Thomas Security engineer

PUBLIC + PRIVATE TOOLING

Projects

Open-source projects, private components, and the systems behind an agentic reverse-engineering workflow.

LIEF cross-platform executable format architecture

Flagship project

LIEF

Parse, inspect, modify, and build ELF, PE, Mach-O, DEX, and more through one consistent C++, Python, Rust, Java, or C API.

  • ELF
  • PE
  • Mach-O
  • DEX
  • multi-language
Visit lief.re
Closed source LIEF Extended

MCStone

A clean, high-performance assembler and disassembler built on LLVM's MC layer for production reverse-engineering workloads.

  • LLVM MC
  • assembler
  • disassembler
View overview
Closed source LIEF Extended

Lypid

A user-friendly library for inspecting and generating DWARF and PDB debug information.

  • DWARF
  • PDB
  • debug information
View overview
Closed source

Hooky

A modern C++ hooking framework for x86-64, ARM64, and RISC-V64, with cross-platform detours and function replacement.

  • hooking
  • x86-64
  • ARM64
  • RISC-V64
View overview
Closed source

DynaMIR

A modern dynamic binary instrumentation engine for x86-64, ARM64, and RISC-V64, built around a custom MLIR-based IR.

  • DBI
  • MLIR
  • x86-64
  • ARM64
  • RISC-V64
View overview
Closed source

BinLift

A user-friendly binary lifter built on QBDL, with DWARF-aware types and native or instrumented function calls.

  • binary lifting
  • QBDL
  • QBDI
  • DWARF
View overview
Closed source

CLayout

A Clang-powered analyzer for C and C++ layouts that resolves target-specific records, field offsets, sizes, methods, and types.

  • Clang
  • C++
  • type layout
View overview
Closed source LIEF Extended

iCDump

A modern, cross-platform Objective-C class dump that reconstructs declarations from Mach-O metadata with LIEF and LLVM.

  • Objective-C
  • Mach-O
  • LIEF Extended
View overview

OPEN SOURCE

Public research tools

Source-available projects, proofs of concept, and reusable research infrastructure.