Code Sanitization for Vulnerability Pruning and Exploitation Mitigation

Deliverables

To create and submit a Data Management Plan

Publications

Author(s): Adrian Herrera, Hendra Gunadi, Shane Magrath, Michael Norrish, Mathias Payer, Antony L. Hosking
Published in: Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2021, Page(s) 230-243, ISBN 9781450384599
Publisher: ACM
DOI: 10.1145/3460319.3464795

Principal Kernel Analysis: A Tractable Methodology to Simulate Scaled GPU Workloads

Author(s): Cesar Avalos Baddouh, Mahmoud Khairy, Roland N. Green, Mathias Payer, and Timothy G. Rogers.
Published in: International Symposium on Microarchitecture, 2021
Publisher: ACM
DOI: 10.1145/3466752.3480100

SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer

Author(s): Gwangmu Lee, Duo Xu, Solmaz Salimi, Byoungyoung Lee, Mathias Payer
Published in: Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, Issue 38, 2024, Page(s) 1480-1494
Publisher: ACM
DOI: 10.1145/3634737.3637642

Midas: Systematic Kernel TOCTTOU Protection

Author(s): Atri Bhattacharyya, Uros Tesic, Mathias Payer
Published in: 2022
Publisher: Usenix

BLURtooth: Exploiting Cross-Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy

Author(s): Daniele Antonioli, Nils Tippenhauer, Kasper Rasmussen, and Mathias Payer
Published in: AsiaCCS - Asia Computer and Communication Security, 2022
Publisher: ACM
DOI: 10.1145/3488932.3523258

ProFactory: Improving IoT Security via Formalized Protocol Customization

Author(s): Fei Wang, Jianliang Wu, Yuhong Nan, Yousra Aafer, Xiangyu Zhang, Dongyan Xu, Mathias Payer
Published in: Security Symposium, 2022
Publisher: Usenix

Too Quiet in the Library: An Empirical Study of Security Updates in Android Apps' Native Code

Author(s): Sumaya Almanee, Arda Unal, Mathias Payer, Joshua Garcia
Published in: 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE), 2021, Page(s) 1347-1359, ISBN 978-1-6654-0296-5
Publisher: IEEE/ACM
DOI: 10.1109/icse43902.2021.00122

FuZZan: Efficient Sanitizer Metadata Design for Fuzzing

Author(s): Yuseok Jeon, WookHyun Han, Nathan Burow, Mathias Payer
Published in: 2020
Publisher: Usenix

Exploiting Android's Hardened Memory Allocator

Author(s): Philipp Mao, Elias Valentin Boschung, Marcel Busch, and Mathias Payer
Published in: Usenix Conference on Offensive Technologies, 2024
Publisher: Usenix

TEEzz: Fuzzing Trusted Applications on COTS Android Devices

Author(s): Marcel Busch, Mathias Payer, Aravind Machiry, Christopher Kruegel, Giovanni Vigna, Chad Spensky
Published in: IEEE Symposium on Security and Privacy, 2023
Publisher: IEEE

HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation

Author(s): Abraham A. Clements, Eric Gustafson, Tobias Scharnowski, David Fritz, Christopher Kruegel, Giovanni Vigna, Saurabh Bagchi, Mathias Payer
Published in: 2020
Publisher: Usenix

Fuzzing JavaScript Engines with a Graph-based IR

Author(s): Haoran Xu, Zhiyuan Jiang, Yongjun Wang, Shuhui Fan, Shenglin Xu, Peidai Xie, Shaojing Fu, Mathias Payer
Published in: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2025, Page(s) 3734-3748
Publisher: ACM
DOI: 10.1145/3658644.3690336

Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs

Author(s): ianhao Xu, Kangjie Lu, Zhengjie Du, Zhu Ding, Linke Li, Qiushi Wu, Mathias Payer, and Bing Mao
Published in: Usenix Security, 2023
Publisher: Usenix

SoK: Challenges and Paths Toward Memory Safety for eBPF

Author(s): Kaiming Huang, Mathias Payer, Zhiyun Qian, Jack Sampson, Gang Tan, Trent Jaeger
Published in: 2025 IEEE Symposium on Security and Privacy (SP), 2025, Page(s) 848-866
Publisher: IEEE
DOI: 10.1109/sp61157.2025.00134

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

Author(s): Yuan Li, Wende Tan, Zhizheng Lv, Songtao Yang, Mathias Payer, Ying Liu, Chao Zhang
Published in: ACM CCS, 2022
Publisher: CCS
DOI: 10.1145/3548606.3560598

Single-Address-Space FaaS with Jord

Author(s): Yuanlong Li, Atri Bhattacharyya, Madhur Kumar, Abhishek Bhattacharjee, Yoav Etsion, Babak Falsafi, Sanidhya Kashyap, Mathias Payer
Published in: Proceedings of the 52nd Annual International Symposium on Computer Architecture, 2025, Page(s) 694-707
Publisher: ACM
DOI: 10.1145/3695053.3731108

Spill the TeA: An Empirical Study of Trusted Application Rollback Prevention on Android

Author(s): Marcel Busch, Philipp Mao, and Mathias Payer
Published in: Usenix Security, 2024
Publisher: Usenix

Everything is Good for Something: Counterexample-Guided Directed Fuzzing via Likely Invariant Inference

Author(s): Heqing Huang, Anshunkang Zhou, Mathias Payer, Charles Zhang
Published in: 2024 IEEE Symposium on Security and Privacy (SP), Issue 8, 2024, Page(s) 1956-1973
Publisher: IEEE
DOI: 10.1109/sp54263.2024.00142

HyperPill: Fuzzing for Hypervisor-bugs by leveraging the Hardware Virtualization Interface

Author(s): Alexander Bulekov, Qiang Liu, Manuel Egele, and Mathias Payer
Published in: Usenix Security, 2024
Publisher: Usenix

Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects

Author(s): Kaiming Huang, Mathias Payer, Zhiyun Qian, Jack Sampson, Gang Tan, Trent Jaeger
Published in: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2025, Page(s) 1330-1344
Publisher: ACM
DOI: 10.1145/3658644.3690310

eBPF Misbehavior Detection: Fuzzing with a Specification-Based Oracle

Author(s): Tao Lyu, Kumar Kartikeya Dwivedi, Thomas Bourgeat, Mathias Payer, Meng Xu, Sanidhya Kashyap
Published in: Proceedings of the ACM SIGOPS 31st Symposium on Operating Systems Principles, 2025, Page(s) 701-718
Publisher: ACM
DOI: 10.1145/3731569.3764797

DUMPLING: Fine-grained Differential JavaScript Engine Fuzzing

Author(s): Liam Wachter, Julian Gremminger, Christian Wressnegger, Mathias Payer, Flavio Toffalini
Published in: Proceedings 2025 Network and Distributed System Security Symposium, 2025
Publisher: Internet Society
DOI: 10.14722/ndss.2025.241411

Evocatio: Conjuring Bug Capabilities from a Single PoC

Author(s): Zhiyuan Jiang, Shuitao Gan, Adrian Herrera, Flavio Toffalini, Lucio Romerio, Chaojing Tang, Manuel Egele, Chao Zhang, Mathias Payer
Published in: ACM CCS, 2022
Publisher: ACM
DOI: 10.1145/3548606.3560575

BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem

Author(s): Marco Casagrande, Eleonora Losiouk, Mauro Conti, Mathias Payer, Daniele Antonioli
Published in: IACR Transactions on Cryptographic Hardware and Embedded Systems, 2022
Publisher: IACR

GlobalConfusion: TrustZone Trusted Application 0-Days by Design

Author(s): Marcel Busch, Philipp Mao, and Mathias Payer
Published in: Usenix Security, 2024
Publisher: Usenix

WarpAttack: Bypassing CFI through Compiler-Introduced Double-Fetches

Author(s): Jianhao Xu, Luca Di Bartolomeo, Flavio Toffalini, Bing Mao, Mathias Payer
Published in: IEEE Symposium on Security and Privacy, 2023
Publisher: IEEE
DOI: 10.1109/sp46215.2023.00176

type++: Prohibiting Type Confusion with Inline Type Information

Author(s): Nicolas Badoux, Flavio Toffalini, Yuseok Jeon, Mathias Payer
Published in: Proceedings 2025 Network and Distributed System Security Symposium, 2025
Publisher: Internet Society
DOI: 10.14722/ndss.2025.230053

Designing a Provenance Analysis for SGX Enclaves

Author(s): Flavio Toffalini, Mathias Payer, Jianying Zhou, and Lorenzo Cavallaro
Published in: Annual Computer Security Applications Conference, 2022
Publisher: ACM
DOI: 10.1145/3564625.3567994

μSCOPE: A Methodology for Analyzing Least-Privilege Compartmentalization in Large Software Artifacts

Author(s): Nick Roessler; Lucas Atayde; Imani Palmer; Derrick McKee; Jai Pandey; Vasileios P. Kemerlis; Mathias Payer; Adam Bates; Jonathan M. Smith; André DeHon; Nathan Dautenhahn
Published in: RAID, Issue 1, 2021
Publisher: ACM
DOI: 10.1145/3471621.3471839

GLeeFuzz: Fuzzing WebGL Through Error-Message-Guided Mutation

Author(s): Hui Peng, Zhihao Yao, Ardalan Amiri Sani, Dave (Jing) Tian, Mathias Payer
Published in: Usenix Security, 2023
Publisher: Usenix

Gramatron: effective grammar-aware fuzzing

Author(s): Prashast Srivastava, Mathias Payer
Published in: Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2021, Page(s) 244-256, ISBN 9781450384599
Publisher: ACM
DOI: 10.1145/3460319.3464814

Monarch: A Fuzzing Framework for Distributed File Systems

Author(s): Tao Lyu, Liyi Zhang, Zhiyao Feng, Yueyang Pan, Yujie Ren, Meng Xu, Mathias Payer, Sanidhya Kashyap
Published in: ATC'24: Usenix Annual Technical Conference, 2024
Publisher: Usenix

Igor: Crash Deduplication Through root-Cause Clustering

Author(s): Zhiyuan Jiang, Xiyue Jiang, Ahmad Hazimeh, Chaojing Tang, Chao Zhang, and Mathias Payer
Published in: 2021
Publisher: ACM
DOI: 10.1145/3460120.3485364

Code Specialization through Dynamic Feature Observation

Author(s): Priyam Biswas, Nathan Burow, Mathias Payer
Published in: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, 2021, Page(s) 257-268, ISBN 9781450381437
Publisher: ACM
DOI: 10.1145/3422337.3447844

ViDeZZo: Dependency-aware Virtual Device Fuzzing

Author(s): Qiang Liu, Flavio Toffalini, Yajin Zhou, Mathias Payer
Published in: IEEE International Symposium on Security and Privacy, 2023, 2023
Publisher: IEEE
DOI: 10.1109/sp46215.2023.00136

Tango: Extracting Higher-Order Feedback through State Inference

Author(s): Ahmad Hazimeh, Duo Xu, Qiang Liu, Yan Wang, Mathias Payer
Published in: The 27th International Symposium on Research in Attacks, Intrusions and Defenses, 2025, Page(s) 403-418
Publisher: ACM
DOI: 10.1145/3678890.3678908

The Taming of the Stack: Isolating Stack Data from Memory Errors

Author(s): Kaiming Huang, Yongzhe Huang, Mathias Payer, Zhiyun Qian, Jack Sampson, Gang Tan, Trent Jaeger
Published in: Network and Distributed Systems Symposium, 2022
Publisher: Internet Society
DOI: 10.14722/ndss.2022.23060

QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing

Author(s): Matteo Marini, Daniele Cono D'Elia, Mathias Payer, Leonardo Querzoni
Published in: Proceedings 2025 Network and Distributed System Security Symposium, 2025
Publisher: Internet Society
DOI: 10.14722/ndss.2025.241133

ARMore: Pushing Love Back Into Binaries

Author(s): Luca Di Bartolomeo, Hossein Moghaddas, and Mathias Payer
Published in: Usenix Security, 2023
Publisher: Usenix

SURGEON: Performant, Flexible and Accurate Re-Hosting via Transplantation

Author(s): Florian Hofhammer, Marcel Busch, Qinying Wang, Manuel Egele, Mathias Payer
Published in: Workshop on Binary Analysis Research, 2024
Publisher: ISOC
DOI: 10.14722/bar.2024.23011

USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation

Author(s): Hui Peng, Mathias Payer
Published in: 2020
Publisher: Usenix

LIGHTBLUE: Automatic Profile-Aware Debloating of Bluetooth

Author(s): Jianliang Wu, Ruoyu Wu, Daniele Antonioli, Mathias Payer, Nils Ole Tippenhauer, Dongyan Xu, Dave (Jing) Tian, Antonio Bianchi
Published in: 2021
Publisher: Usenix

Preventing Kernel Hacks with HAKCs

Author(s): Derrick McKee, Yianni Giannaris, Carolina Ortega Perez, Howard Shrobe, Mathias Payer, Hamed Okhravi, Nathan Burow
Published in: Network and Distributed Systems Symposium, 2022
Publisher: Internet Society
DOI: 10.14722/ndss.2022.24026

SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices

Author(s): Qinying Wang, Boyu Chang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Gaoning Pan, Chenyang Lyu, Mathias Payer, Wenhai Wang, Raheem Beyah
Published in: 2024 IEEE Symposium on Security and Privacy (SP), 2024, Page(s) 2310-2387
Publisher: IEEE
DOI: 10.1109/sp54263.2024.00070

On the Insecurity of Vehicles Against Protocol-Level Bluetooth Threats

Author(s): Daniele Antonioli, Mathias Payer
Published in: Workshop On Offensive Technologies, 2022
Publisher: IEEE

Minerva: Browser API Fuzzing with Dynamic Mod-Ref Analysis

Author(s): Chijin Zhou, Quan Zhang, Mingzhe Wang, Lihua Guo, Jie Liang, Zhe Liu, Mathias Payer, Yu Jiang
Published in: FSE Foundations of Software Engineering, 2022
Publisher: ACM

One Fuzz Doesn't Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction

Author(s): Prashast Srivastava, Stefan Nagy, Matthew Hicks, Antonio Bianchi, and Mathias Payer
Published in: Annual Computer Security Applications Conference, 2022
Publisher: ACM
DOI: 10.1145/3564625.3564643

Magma

Author(s): Ahmad Hazimeh, Adrian Herrera, Mathias Payer
Published in: Proceedings of the ACM on Measurement and Analysis of Computing Systems, Issue 4/3, 2020, Page(s) 1-29, ISSN 2476-1249
Publisher: ACM
DOI: 10.1145/3428334

Liberating Libraries through Automated Fuzz Driver Generation: Striking a Balance without Consumer Code

Author(s): Flavio Toffalini, Nicolas Badoux, Zurab Tsinadze, Mathias Payer
Published in: Proceedings of the ACM on Software Engineering, Issue 2, 2025, Page(s) 2123-2145, ISSN 2994-970X
Publisher: Association for Computing Machinery (ACM)
DOI: 10.1145/3729365

<scp>DatAFLow</scp> : Toward a Data-Flow-Guided Fuzzer

Author(s): Adrian Herrera, Mathias Payer, Antony L. Hosking
Published in: ACM Transactions on Software Engineering and Methodology, Issue 32, 2023, Page(s) 1-31, ISSN 1049-331X
Publisher: Association for Computing Machinary, Inc.
DOI: 10.1145/3587156

MendelFuzz: The Return of the Deterministic Stage

Author(s): Han Zheng, Flavio Toffalini, Marcel Böhme, Mathias Payer
Published in: Proceedings of the ACM on Software Engineering, Issue 2, 2025, Page(s) 44-64, ISSN 2994-970X
Publisher: Association for Computing Machinery (ACM)
DOI: 10.1145/3715713

Sourcerer: Channeling the void

Author(s): Nicolas Badoux, Flavio Toffalini, Mathias Payer
Published in: Lecture Notes in Computer Science, Detection of Intrusions and Malware, and Vulnerability Assessment, 2025, Page(s) 75-95
Publisher: Springer Nature Switzerland
DOI: 10.1007/978-3-031-97620-9_5

Deliverables

Publications

Share this page Share this page on social networks

Download Download the content of the page