Person

Mathias Josef Payer

Related publications (94)

Challenges to Using Large Language Models in Code Generation and Repair

Large language models (LLMs) hold great promise in solving many challenges arising from software complexity, including the possibility of automating code generation and repair. Although we cannot deny the groundbreaking nature of LLM-based code repair, we ...

Institute of Electrical and Electronics Engineers (IEEE)2025

Single-Address-Space FaaS with Jord

Babak Falsafi, Atri Bhattacharyya, Mathias Josef Payer, Yuanlong Li, Sanidhya Kashyap, Abhishek Bhattacharjee

Function-as-a-Service (FaaS) has emerged as a popular cloud paradigm that simplifies software development and deployment by providing scalable and event-driven function execution without the burden of managing servers. FaaS was originally created with a fu ...

ACM2025

SoK: Challenges and Paths Toward Memory Safety for eBPF

Mathias Josef Payer

The extended Berkeley Packet Filter (eBPF) subsystem in Linux enables the extension of kernel functionality without modifying kernel code. In addition to its use in networking, eBPF provides the flexibility to perform tracing, add security checks, etc. To ...

Institute of Electrical and Electronics Engineers Inc.2025

MendelFuzz: The Return of the Deterministic Stage

Mathias Josef Payer, Flavio Toffalini, Han Zheng

Can a fuzzer cover more code with minimal corruption of the initial seed? Before a seed is fuzzed, the early greybox fuzzers first systematically enumerated slightly corrupted inputs by applying every mutation operator to every part of the seed, once per g ...

Association for Computing Machinery (ACM)2025

REFLECTA: Reflection-based Scalable and Semantic Scripting Language Fuzzing

Mathias Josef Payer

Information & Contributors Bibliometrics & Citations References59

Share

Abstract Scripting languages such as Python and JavaScript have revolutionized modern software development thanks to their flexibility and rich functionalities. However, scr ...

ACM2025

Liberating Libraries through Automated Fuzz Driver Generation: Striking a Balance without Consumer Code

Mathias Josef Payer, Flavio Toffalini

Fuzz testing a software library requires developers to write fuzz drivers, specialized programs exercising the library. Given a driver, fuzzers generate interesting inputs that trigger the library’s bugs. Writing fuzz drivers manually is a cumbersome proce ...

Association for Computing Machinery (ACM)2025

Exploiting android’s hardened memory allocator

Mathias Josef Payer, Marcel Busch

Most memory corruptions occur on the heap. To harden userspace applications and prevent heap-based exploitation, Google has developed Scudo. Since Android 11, Scudo has replaced jemalloc as the default heap implementation for all native code on Android. Sc ...

USENIX Association2024

Fuzzing JavaScript Engines with a Graph-based IR

Mathias Josef Payer

Mutation-based fuzzing effectively discovers defects in JS engines. High-quality mutations are key for the performance of mutation-based fuzzers. The choice of the underlying representation (e.g., a sequence of tokens, an abstract syntax tree, or an interm ...

Association for Computing Machinery, Inc2024

SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation

Mathias Josef Payer, Marcel Busch, Florian Hofhammer

Dynamic analysis of microcontroller-based embedded firmware remains challenging. The general lack of source code availability for Commercial-off-the-shelf (COTS) firmware prevents powerful source-based instrumentation and prohibits compiling the firmware i ...

2024

EL3XIR: fuzzing COTS secure monitors

Mathias Josef Payer, Marcel Busch

ARM TrustZone forms the security backbone of mobile devices. TrustZone-based Trusted Execution Environments (TEEs) facilitate security-sensitive tasks like user authentication, disk encryption, and digital rights management (DRM). As such, bugs in the TEE ...

USENIX Association2024

Tango: Extracting Higher-Order Feedback through State Inference

Mathias Josef Payer

Fuzzing is the de facto standard for automated testing. However, while coverage-guided fuzzing excels at code discovery, its effectiveness falters when applied to complex systems. One such class entails persistent targets whose behavior depends on the stat ...

Association for Computing Machinery2024

HYPERPILL: fuzzing for hypervisor-bugs by leveraging the hardware virtualization interface

Mathias Josef Payer

The security guarantees of cloud computing depend on the isolation guarantees of the underlying hypervisors. Prior works have presented effective methods for automatically identifying vulnerabilities in hypervisors. However, these approaches are limited in ...

USENIX Association2024

DP-ACT: Decentralized Privacy-Preserving Asymmetric Digital Contact Tracing

Amir Aminifar, Mathias Josef Payer

Digital contact tracing substantially improves the identification of high-risk contacts during pandemics. Despite several attempts to encourage people to use digital contact-tracing applications by developing and rolling out decentralized privacy-preservin ...

2024

GlobalConfusion: TrustZone Trusted Application 0-Days by Design

Mathias Josef Payer, Marcel Busch

Trusted Execution Environments form the backbone of mobile device security architectures. The GlobalPlatform Internal Core API is the de-facto standard that unites the fragmented landscape of real-world implementations, providing compatibility between diff ...

USENIX Association2024

Gradient: Gradual Compartmentalization via Object Capabilities Tracked in Types

Mathias Josef Payer, Clément Pit-Claudel

Modern software needs fine-grained compartmentalization, i.e., intra-process isolation. A particularly important reason for it are supply-chain attacks, the need for which is aggravated by modern applications depending on hundreds or even thousands of libr ...

ASSOC COMPUTING MACHINERY2024

Spill the TeA: an empirical study of trusted application rollback prevention on android smartphones

Mathias Josef Payer, Marcel Busch

The number and complexity of Trusted Applications (TAs, applications running in Trusted Execution Environments— TEEs) deployed on mobile devices has exploded. A vulnerability in a single TA impacts the security of the entire device. Thus, vendors must rapi ...

USENIX Association2024

Everything is Good for Something: Counterexample-Guided Directed Fuzzing via Likely Invariant Inference

Mathias Josef Payer

Directed fuzzing demonstrates the potential to reproduce bug reports, verify patches, and debug vulnerabilities. State-of-the-art directed fuzzers prioritize inputs that are more likely to trigger the target vulnerability or filter irrelevant inputs unrela ...

Institute of Electrical and Electronics Engineers Inc.2024

Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects

Mathias Josef Payer

Heap memory errors remain a major source of software vulnerabilities. Existing memory safety defenses aim at protecting all objects, resulting in high performance cost and incomplete protection. Instead, we propose an approach that accurately identifies ob ...

Association for Computing Machinery, Inc2024

SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer

Mathias Josef Payer

Syzbot continuously fuzzes the full Linux kernel to discover latent bugs. Yet, around 75% of recent kernel bugs are caused by recent patches, dubbed regression bugs. Regression fuzzing prioritizes inputs that target recently or frequently patched code. How ...

Association for Computing Machinery, Inc2024

Comprehensive Memory Safety Validation: An Alternative Approach to Memory Safety

Mathias Josef Payer

Comprehensive memory safety validation identifies the memory objects whose accesses provably comply with all classes of memory safety, protecting them from memory errors elsewhere at low overhead. We assess the breadth and depth of comprehensive memory saf ...

Ieee Computer Soc2024