I study how microarchitectural attacks affect the isolation guarantees of trusted execution environments (TEEs), with a focus on the hardware state used to enforce that isolation.
TEEs are designed to protect code and data even from privileged software, but their security still depends on shared hardware such as caches and memory. I examine where assumptions about that hardware leave gaps in the protection a TEE provides.
I evaluate how LLM agents perform reverse engineering and binary exploitation, tracing where they succeed, make mistakes, or stop. My aim is to understand the limits of automated attacks and what those limits mean for software protection.
CTF tasks let me follow the sequence from understanding a program to constructing an exploit. By examining execution logs and failure patterns, I study how different protections affect the agent’s reasoning and tool use. This provides a more detailed view of its capabilities than a success rate alone.
I develop Hisame, a fuzzing framework that automates vulnerability discovery in RISC-V firmware running at the highest privilege level. It targets implementations of the Supervisor Binary Interface (SBI), the interface between an operating system and machine-mode firmware.
This firmware underpins the operating system and other software above it, so defects can compromise the wider system. Hisame uses execution coverage to guide test generation and checks for memory errors within the firmware, making this layer amenable to systematic testing.
I develop methods for reducing test cases for stateful network protocols while preserving the behavior needed to reproduce a failure. The goal is to give developers smaller, faster test cases for debugging.
A message sequence does more than carry data: it moves the server through states. Removing a message can therefore remove the conditions needed to trigger the bug. I use responses from the target to infer a state machine and guide which messages and bytes can be removed.