This paper presents SAILFISH, a scalable system for automatically finding state-
inconsistency bugs in smart contracts. To make the analysis tractable, we introduce a hybrid …

This paper analyzes the vulnerability space arising in Trusted Execution Environments
(TEEs) when interfacing a trusted enclave application with untrusted, potentially malicious …

Hybrid fuzzing, combining symbolic execution and fuzzing, is a promising approach for
vulnerability discovery because each approach can complement the other. However, we …

System software commonly uses indirect calls to realize dynamic program behaviors.
However, indirect-calls also bring challenges to constructing a precise control-flow graph …

Firefox and other major browsers rely on dozens of third-party libraries to render audio,
video, images, and other content. These libraries are a frequent source of vulnerabilities. To …

This paper presents an in-kernel, hardware-based control-flow integrity (CFI) protection,
called PAL, that utilizes ARM's Pointer Authentication (PA). It provides three important …

Kernel concurrency bugs are challenging to find because they depend on very specific
thread interleavings and test inputs. While separately exploring kernel thread interleavings …

Address Sanitizer (ASan) is a powerful memory error detector. It can detect various errors
ranging from spatial issues like out-of-bound accesses to temporal issues like use-after-free …

Although it is common practice for kernel fuzzers to leverage type information of system
calls, current Windows kernel fuzzers do not follow the practice as most system calls are …

When dealing with millions of lines of C code, we still cannot have the cake and eat it: type
analysis for call graph construction is scalable yet highly imprecise. We address this …