Mathias Josef Payer

Challenges to Using Large Language Models in Code Generation and Repair

Large language models (LLMs) hold great promise in solving many challenges arising from software complexity, including the possibility of automating code generation and repair. Although we cannot deny the groundbreaking nature of LLM-based code repair, we ...

Institute of Electrical and Electronics Engineers (IEEE)2025

Single-Address-Space FaaS with Jord

Babak Falsafi, Mathias Josef Payer, Sanidhya Kashyap, Yuanlong Li, Atri Bhattacharyya, Abhishek Bhattacharjee

Function-as-a-Service (FaaS) has emerged as a popular cloud paradigm that simplifies software development and deployment by providing scalable and event-driven function execution without the burden of managing servers. FaaS was originally created with a fu ...

ACM2025

SoK: Challenges and Paths Toward Memory Safety for eBPF

Mathias Josef Payer

The extended Berkeley Packet Filter (eBPF) subsystem in Linux enables the extension of kernel functionality without modifying kernel code. In addition to its use in networking, eBPF provides the flexibility to perform tracing, add security checks, etc. To ...

Institute of Electrical and Electronics Engineers Inc.2025

MendelFuzz: The Return of the Deterministic Stage

Mathias Josef Payer, Flavio Toffalini, Han Zheng

Can a fuzzer cover more code with minimal corruption of the initial seed? Before a seed is fuzzed, the early greybox fuzzers first systematically enumerated slightly corrupted inputs by applying every mutation operator to every part of the seed, once per g ...

Association for Computing Machinery (ACM)2025

Liberating Libraries through Automated Fuzz Driver Generation: Striking a Balance without Consumer Code

Mathias Josef Payer, Flavio Toffalini

Fuzz testing a software library requires developers to write fuzz drivers, specialized programs exercising the library. Given a driver, fuzzers generate interesting inputs that trigger the library’s bugs. Writing fuzz drivers manually is a cumbersome proce ...

Association for Computing Machinery (ACM)2025

Exploiting android’s hardened memory allocator

Mathias Josef Payer, Marcel Busch

Most memory corruptions occur on the heap. To harden userspace applications and prevent heap-based exploitation, Google has developed Scudo. Since Android 11, Scudo has replaced jemalloc as the default heap implementation for all native code on Android. Sc ...

USENIX Association2024

Fuzzing JavaScript Engines with a Graph-based IR

Mathias Josef Payer

Mutation-based fuzzing effectively discovers defects in JS engines. High-quality mutations are key for the performance of mutation-based fuzzers. The choice of the underlying representation (e.g., a sequence of tokens, an abstract syntax tree, or an interm ...

Association for Computing Machinery, Inc2024

SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation

Mathias Josef Payer, Marcel Busch, Florian Hofhammer

Dynamic analysis of microcontroller-based embedded firmware remains challenging. The general lack of source code availability for Commercial-off-the-shelf (COTS) firmware prevents powerful source-based instrumentation and prohibits compiling the firmware i ...

2024

EL3XIR: fuzzing COTS secure monitors

Mathias Josef Payer, Marcel Busch

ARM TrustZone forms the security backbone of mobile devices. TrustZone-based Trusted Execution Environments (TEEs) facilitate security-sensitive tasks like user authentication, disk encryption, and digital rights management (DRM). As such, bugs in the TEE ...

USENIX Association2024

Mathias Josef Payer

Graph Chatbot

Challenges to Using Large Language Models in Code Generation and Repair

Single-Address-Space FaaS with Jord

SoK: Challenges and Paths Toward Memory Safety for eBPF

MendelFuzz: The Return of the Deterministic Stage

REFLECTA: Reflection-based Scalable and Semantic Scripting Language Fuzzing

Liberating Libraries through Automated Fuzz Driver Generation: Striking a Balance without Consumer Code

Exploiting android’s hardened memory allocator

Fuzzing JavaScript Engines with a Graph-based IR

SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation

EL3XIR: fuzzing COTS secure monitors

Single-Address-Space FaaS with Jord

Challenges to Using Large Language Models in Code Generation and Repair

SoK: Challenges and Paths Toward Memory Safety for eBPF

MendelFuzz: The Return of the Deterministic Stage

REFLECTA: Reflection-based Scalable and Semantic Scripting Language Fuzzing

Liberating Libraries through Automated Fuzz Driver Generation: Striking a Balance without Consumer Code

Exploiting android’s hardened memory allocator

EL3XIR: fuzzing COTS secure monitors

Fuzzing JavaScript Engines with a Graph-based IR

SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation