Papers and posters accepted for SURE 2025

Apple Hypervisor.framework bindings for Golang. Contribute to blacktop/go-hypervisor development by creating an account on GitHub.

All sessions will be held in Room 611-612 unless otherwise noted.

Introduction In October 2024, InfoSect participated in Pwn2Own – a bug bounty competition against embedded devices such as cameras, NAS’, and smart speakers. In this blog, I’ll di…

This is a basic fuzzer for the V8 Sandbox. It uses the memory corruption API to implement a random-but-deterministic (given a seed) traversal through the V8 heap object graph and corrupts some obje...

Table of Contents I. Introduction II. Netfilter hooks, nf_tables, nf_conntrack, nf_nat and nf_queue 2.1 Netfilter hooks 2.2 nf_tables 2.3 nf_conntrack 2.4 nf_nat 2.5 nf_queue III. The Forgotten Syzkaller Report IV. Root Cause Analysis of a “no reproducer” Syzkaller UAF Report 4.1 Allocation Backtrace 4.2 Free Backtrace 4.3 UAF Backtrace 4.4 Root Cause V. Crafting a Reproducer to Trigger the KASAN UAF 5.1 Allocate a template nf_conn by calling nft_ct_set_zone_eval() 5.2 Setup nf_nat_setup_info() function 5.

CTADL is a static taint analysis tool. Contribute to sandialabs/ctadl development by creating an account on GitHub.

Generating code from natural language specifications is one of the most successful applications of Large Language Models (LLMs). Yet, they hallucinate: LLMs produce outputs that may be grammatically c...

During my internship I was tasked to analyze a Mali GPU exploit on Pixel 7/8 devices and adapt it to make it work on another device: the Pixel 6 Pro. While the exploit process itself is relatively straightforward to reproduce (in theory we just need to find the correct symbol offsets and signatures for our target device), what’s interesting about Pixel 6 Pro is that it uses a different Mali GPU from the Pixel 7/8, which lacked support for a feature that one of the two vulnerabilities within the exploit relied on:

This blog post introduces a new API in LIEF to create DWARF files

See how a vulnerability in the Arm Mali GPU can be exploited to gain kernel code execution even when Memory Tagging Extension (MTE) is enabled.

Idiomatic Rust bindings for the IDA SDK, enabling the development of standalone analysis tools using IDA v9.x’s idalib - binarly-io/idalib

This post explores attacking page tables as a Linux kernel exploitation technique for gaining powerful read/write primitives.

Using the AI decompiler.

The 6th ACM/IEEE International Conference on Automation of Software Test (AST 2025) Software pervasiveness in both industry and digital society, as well as the proliferation of Artificial Intelligenc...

The Workshop on Software Understanding and Reverse Engineering

Explore the current state of Linux snapshot fuzzing, its challenges, tools, and impact on kernel security.

In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related inf...

In the part 1 of my tutorial style blog post about fuzzing, I discussed how we can instrument the macOS KEXTs to collect code coverage at the basic block or edge level.

Introduction During a garage cleaning, we found a DVB receiver and thought it would be a great target for vulnerability research.

The 4th International Fuzzing Workshop (FUZZING) 2025 welcomes all researchers, scientists, engineers and practitioners to present their latest research findings, empirical analyses, t...

LibAFL # The LibAFL fuzzer implements features from AFL-based fuzzers like AFL++. Similarly to AFL++, LibAFL provides better fuzzing performance and more advanced features over libFuzzer. However, wit...

A repo for holding talk artifacts, including a summary, slides, and demo PoCs - mahaloz/talks

Hypervisors power not just the cloud but are becoming a commodity in mobile phones and desktops as well. They separate virtual machines from each...

Sanitizers serve as the primary bug detection Oracle during automated testing. They