Research

I study how microarchitectural attacks affect the isolation guarantees of trusted execution environments (TEEs), with a focus on the hardware state used to enforce that isolation.

TEEs are designed to protect code and data even from privileged software, but their security still depends on shared hardware such as caches and memory. I examine where assumptions about that hardware leave gaps in the protection a TEE provides.

I develop Hisame, a fuzzing framework that automates vulnerability discovery in RISC-V firmware running at the highest privilege level. It targets implementations of the Supervisor Binary Interface (SBI), the interface between an operating system and machine-mode firmware.

This firmware underpins the operating system and other software above it, so defects can compromise the wider system. Hisame uses execution coverage to guide test generation and checks for memory errors within the firmware, making this layer amenable to systematic testing.

I develop methods for reducing test cases for stateful network protocols while preserving the behavior needed to reproduce a failure. The goal is to give developers smaller, faster test cases for debugging.

A message sequence does more than carry data: it moves the server through states. Removing a message can therefore remove the conditions needed to trigger the bug. I use responses from the target to infer a state machine and guide which messages and bytes can be removed.