Pith. sign in

REVIEW 3 major objections 5 minor 51 references

Teapot: Efficiently Uncovering Spectre Gadgets in COTS Binaries

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Teapot claims that Spectre-V1 gadgets can be found directly in closed-source x86-64 binaries, with no source code, at speeds comparable to compiler-based scanners, by rewriting each binary into a normal-execution copy and a…

desk verdict Teapot has a genuinely new design and solid engineering, but the paper leaves a load-bearing question about PC-relative data relocation in Shadow Copies open. read the letter →

arxiv 2411.11624 v2 pith:2GXOA67J submitted 2024-11-18 cs.CR cs.AR

Fangzheng Lin , Zhongfa Wang , Hiroshi Sasaki This is my paper · ORCID
classification cs.CRcs.AR
keywords SpectregadgetsstaticbinaryrewritingspeculativeexecutiondynamictaintanalysisfuzzingCOTSbinariessidechannelsinstrumentation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that Spectre-V1 gadgets — code that leaks data through mispredicted bounds checks — can be uncovered in commercial off-the-shelf binaries without access to source code, at run-time costs close to those of compiler-based detectors. To achieve this, Teapot statically rewrites each function into two copies: a Real Copy that runs normal execution and a Shadow Copy that simulates transient execution, so each copy carries only the instrumentation it needs and the guard branches around every check disappear. On top of this skeleton Teapot adds binary-level out-of-bounds checks and data-flow taint tracking, then fuzzes the instrumented binary to trigger and report gadgets through cache, microarchitectural data sampling, and port-contention channels. The paper reports that this design outperforms the previous binary-only approach by more than 20x in runtime and finds all reachable artificially injected gadgets with no false positives on the tested programs.

What carries the argument

Speculation Shadows is the named mechanism: a design that duplicates every function in the binary into a normal-execution copy and a speculation-simulation copy. Direct branches and calls are rewired to the matching copy, trampolines flip the branch condition to enter the wrong path and start transient simulation, and end_simulation restore points trigger rollback after a preset instruction window of 250 instructions, matching the reorder-buffer idea. To keep control flow inside the Shadow Copy, indirect returns, calls, and jumps get runtime checks plus special nop markers at Real-Copy targets. Teapot's detection layer reimplements AddressSanitizer-style shadow-memory bounds checks and DataFlowSanitizer-style byte-granular tag propagation directly on the binary, using the Kasper taint policy to classify attacker-controlled and secret data. The machinery's work is to make speculation simulation cheap enough that deep nested mispredictions can be fuzzed, which is what lets Teapot find gadgets previous binary scanners missed.

What would settle it

A concrete test: build a small stripped x86-64 binary whose only reachable Spectre-V1 gadget sits behind an indirect jump that the rewriting pass cannot resolve. If Teapot, fuzzed with inputs that trigger the misprediction, reports no gadget while a manual trace confirms the transient access, then its detection is limited by disassembly completeness rather than by speculation simulation.

Watch

Extended reading notes

Core claim

The central claim is that Spectre gadget detection no longer requires source code or full-system emulation: a static binary rewriter can instrument a deployed x86-64 Linux binary to simulate branch misprediction and detect gadgets at run time with practical efficiency. The load-bearing discovery is Speculation Shadows: instead of mixing normal execution, speculation simulation, ASan checks, and memory logging in one code stream guarded by in_simulation conditionals, every function is duplicated byte-for-byte. Normal execution stays in the Real Copy and speculation simulation runs in the Shadow Copy; trampolines on conditional branches send the program down the deliberately wrong path, and checkpoint/rollback plus indirect-branch integrity checks keep the simulation contained. Each copy is then instrumented with only what it needs — the Shadow Copy gets bounds checks, memory logging, and taint propagation, while the Real Copy gets lightweight asynchronous tag updates — which removes almost all guard branches. Evaluations on five real-world binaries show Teapot is 22–28x faster than the previous binary-based detector on the programs where that detector runs, performs within 0.5–2.0x of a compiler-based tool, and detects every reachable gadget in the artificial-injection benchmark with zero false positives.

Load-bearing premise

Teapot assumes the static disassembler correctly recovers every instruction, every function boundary, and every indirect branch target, because code it cannot see is never duplicated into the Shadow Copy and can never be checked.

Editorial extensions

If this is right

  • Closed-source x86-64 Linux binaries can be scanned for Spectre-V1 gadgets without source code, at run-time overhead within about 0.5x–2.0x of compiler-based instrumentation.
  • Deeper speculation heuristics become affordable: Teapot simulates nested mispredictions beyond the five-simulation limit of the previous binary tool and reports more gadgets on unmodified binaries as a result.
  • The design removes most mode-check guard branches, giving a performance edge of 22x–28x over full-system emulation on the two programs where the emulator-based baseline completed.
  • Taint tracking plus binary bounds checks lets Teapot distinguish attacker-controlled out-of-bounds reads from benign ones, yielding no false positives on the injected-gadget benchmark where a compiler-based tool without taint produced many false positives.
  • Because the detector is decoupled from the fuzzer through a standard coverage interface, the same instrumented binaries can be reused with different coverage-guided fuzzers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Speculation Shadows is a general binary-rewriting pattern: any analysis that needs different instrumentation during a special mode could duplicate functions and drop guard checks, so the speedup is not limited to Spectre scanning.
  • The paper's switch-statement example (GCC generates branches while Clang generates a jump table) implies Teapot can serve as a deployment-time check: even source-owning teams could run it on release binaries to catch toolchain-induced gadgets that compiler-based scans miss.
  • Detection is bounded by fuzzing coverage and the fixed speculation window of 250 instructions and six branch levels; a CPU with a larger reorder buffer or a different fuzzer could reveal additional gadgets without changing Teapot's instrumentation.
  • Porting the design to AArch64 or Windows, which the paper lists as future work, would face its main challenge in disassembly accuracy rather than in the Shadow Copy mechanism itself.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. Teapot proposes Speculation Shadows, a static-binary-rewriting design that splits each function into a Real Copy for normal execution and a Shadow Copy for speculation simulation, removing most per-instrumentation guard branches. The instrumented binary is fuzzed with honggfuzz, and gadget detection follows the Kasper policy implemented with binary-level ASan and DIFT. The paper reports runtime results on five real-world binaries, artificial-gadget ground-truth experiments, and detection results on unmodified binaries, claiming that Teapot is the first static-rewriting-based Spectre-V1 detector for COTS binaries, is within 0.5x--2.0x of SpecFuzz's runtime, and is more than 20x faster than SpecTaint and finds more gadgets.

Significance. If the central claims hold, Teapot is a practically important contribution: it is the first Spectre-V1 gadget scanner based on static binary rewriting, it ships an open-source artifact with scripts for reproduction, it evaluates against external baselines (SpecFuzz and SpecTaint), and it uses a ground-truth artificial-gadget experiment. Speculation Shadows is a clean design insight that could benefit other binary instrumentation tools. However, the correctness of the Shadow Copy depends on an unspecified handling of PC-relative data references, and the headline performance advantage over SpecTaint is measured on only two of the five programs. These issues must be resolved before the paper's central claims can be accepted.

major comments (3)
  1. [§5.2, Figure 4] The description of the Shadow Copy is incomplete for x86-64 code. Section 5.2 says Teapot makes a 'complete, byte-to-byte copy' of each function and updates only direct branches and calls. In x86-64, PC-relative data operands are pervasive: memory operands such as [rip+disp32] and LEA instructions compute addresses relative to the instruction pointer. A byte-identical copy placed at a different virtual address will silently compute different effective addresses for every unrelocated RIP-relative operand, including jump-table bases of the kind shown in Figure 2 (lea rcx, [rip+.LJT]). The paper never states how these displacements are adjusted or how jump-table bases are relocated. The failure would not be visible as a crash: the exception handler and the indirect-branch guards in Section 5.3 conservatively roll back, so a mis-relocated access would simply cut off the simulated transient path and suppress any gadget whose secret load or transmitter depends on the wrong address. This is not covered by the Section 8 disassembler caveat because even with perfect disassembly the described copy procedure is incomplete. The authors must either describe the relocation procedure or demonstrate, with concrete examples or artifact inspection, that all RIP-relative data references in Shadow Copies are re-emitted with corrected displacements.
  2. [§7.1, Figure 7] The abstract's general claim that Teapot is 'more than 20x performant' than SpecTaint is supported by only two of the five benchmark programs. For libhtp, brotli, and openssl, SpecTaint crashes the emulator and no SpecTaint times are reported. This makes the headline comparison partial, and the conclusion that Teapot outperforms 'the previously proposed binary-based approach' is broader than the evidence. The authors should qualify the claim to the two programs where SpecTaint runs, or provide SpecTaint measurements on the remaining programs, or present the comparison as a best-effort case study rather than a general performance result.
  3. [§7.2, Table 3] The artificial-gadget comparison against SpecTaint relies on numbers reported in the SpecTaint paper rather than on a reproduced run, while the reproduced SpecFuzz results differ substantially from the reported ones (e.g., libyaml recall rises from 40% to 80% and brotli recall from 54% to 100%). This asymmetry weakens the claim that Teapot's detection ability is superior to SpecTaint. The authors do acknowledge the difficulty of reproducing SpecTaint, but the evaluation section should state explicitly which SpecTaint rows are not independently verified and treat the comparison as indicative rather than definitive.
minor comments (5)
  1. [Abstract] The phrase 'more than 20x performant than a previously proposed binary-based approach' is grammatically awkward; replacing it with 'more than 20x faster' would improve readability.
  2. [§5.1] There is a typo in the first paragraph: 'detect Specter gadgets' should be 'detect Spectre gadgets'.
  3. [Figure 7] The y-axis of Figure 7 is difficult to read: the tick labels appear to be duplicated and the scale is not clearly described. A logarithmic axis or a table of the underlying normalized times would make the comparison easier to verify.
  4. [§6.1] The rationale for the nested-speculation heuristic (sixth-order depth for the first five runs of a branch, then SpecFuzz heuristics) is stated but not justified with sensitivity experiments; a brief discussion of why these constants were chosen, or a sensitivity comparison, would strengthen the evaluation.
  5. [§B.8.2] The artifact appendix does not reproduce the artificial-gadget experiment (Table 3), which is the only ground-truth evaluation of detection ability. Since the artifact is a stated contribution, adding a scripted or documented procedure for that experiment would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Teapot's claims rest on an external detection policy, external baselines, and an implementation design with no fitted parameters or self-referential derivation.

full rationale

Teapot's central contribution is an engineering design (Speculation Shadows) plus an experimental evaluation. The gadget-detection policy is explicitly imported from external prior work: Section 2.2.3 says 'We adopt the Kasper policy to Teapot in this work for its prominent detection coverage and accuracy,' citing Johannesmeyer et al. (NDSS '22), not the present authors. The comparison baselines SpecTaint and SpecFuzz are external systems (Qi et al. NDSS '21; Oleksenko et al. USENIX Sec '20). No model parameter is fitted to a subset of the output and then reported as a prediction; the 250-instruction window, six-branch depth, and fuzzing heuristics are taken from prior studies (Sections 2.3 and 6.1). The only self-citations are the artifact DOI [24] and the author list; neither is load-bearing. The paper's own stated limitations (Section 8 on heuristic disassembly, Appendix B.8.2 on not reproducing the Table 3 artifact experiment and on SpecTaint's unreliability) are empirical reproducibility caveats, not circular reductions. Table 4 even warns that 'Numbers between different implementations are not directly comparable as gadget detection policies differ,' which preempts any self-definitional reading of the gadget counts. Accordingly there is no step in the derivation chain that reduces, by construction or by self-citation, to its own inputs.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

All parameters and axioms are engineering choices made to define what counts as speculation and what can be detected; none are fitted to the outcome metrics, but they directly bound gadget coverage and performance.

free parameters (3)
  • Speculation window instruction limit = 250
    Section 6.1 states the simulation stops after 250 transiently executed instructions, chosen 'as in prior studies'. It directly sets how deep each shadow path is explored and therefore what counts as a gadget; larger windows would catch more hypothetical gadgets, smaller ones would miss deeper speculation.
  • Nested speculation depth and per-branch repeat limits = depth 6, first 5 runs per branch
    Section 6.1 adopts a mixture of SpecFuzz and SpecTaint heuristics: branch depth is simulated up to the sixth order for the first five runs of a branch. These hand-set limits control the exponentially growing search space and bound gadget detection coverage.
  • Coverage counter insertion interval = every 50 instructions
    Section 6.1 places counting instrumentation near the end of each basic block and between every 50 instructions to bound speculation windows. This is a chosen heuristic that affects overhead and the accuracy of enforcing the 250-instruction budget.
assumptions (4)
  • domain assumption Datalog Disassembly and GTIRB correctly disassemble and reassemble unobfuscated x86-64 Linux ELF binaries, including control-flow graph recovery; any missed instruction or misidentified branch invalidates instrumentation or gadget coverage.
    Section 8 acknowledges static binary rewriting is heuristic-based and can fail on missing type and global boundary information; the entire pipeline assumes the rewriting platform is correct 'in most cases'.
  • ad hoc to paper A fixed 250-instruction speculation window and the branch-depth heuristics faithfully represent real transient execution for Spectre-V1 detection purposes.
    Section 6.1 sets the reorder-buffer-equivalent threshold and nested depths by hand, based on prior work; if real speculation windows or misprediction patterns differ on target CPUs, detection coverage changes.
  • domain assumption Gadgets guarded by more than six branches, including the first misprediction, are unlikely exploitable and are excluded from scope.
    Section 2.3 adopts this limit 'following a previous study'; it bounds the search space but also defines what Teapot will not find.
  • domain assumption The software address-sanity and data-flow taint approximation of secrets is sufficient: attacker-direct and attacker-indirect taint plus out-of-bounds detection identifies all secrets relevant to Spectre-V1; global-object out-of-bounds leaks are out of scope because binary-level globals are…
    Section 6.2.1 admits global objects are left unprotected, and Section 6.2.2 maps secret-ness through ASan and taint; any secret that is not tainted or not flagged out-of-bounds will not be reported as a gadget.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Teapot: Efficiently Uncovering Spectre Gadgets in COTS Binaries." pith.science (2026). https://pith.science/paper/2GXOA67J

@misc{pith2026241111624,
  author       = {Pith},
  title        = {Pith review of: Teapot: Efficiently Uncovering Spectre Gadgets in COTS Binaries},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2GXOA67J}},
  note         = {Machine review of arXiv:2411.11624}
}
read the original abstract

Speculative execution is crucial in enhancing modern processor performance but can introduce Spectre-type vulnerabilities that may leak sensitive information. Detecting Spectre gadgets from programs has been a research focus to enhance the analysis and understanding of Spectre attacks. However, one of the problems of existing approaches is that they rely on the presence of source code (or are impractical in terms of run-time performance and gadget detection ability). This paper presents Teapot, the first Spectre gadget scanner that works on COTS binaries with comparable performance to compiler-based alternatives. As its core principle, we introduce Speculation Shadows, a novel approach that separates the binary code for normal execution and speculation simulation in order to improve run-time efficiency. Teapot is based on static binary rewriting. It instruments the program to simulate the effects of speculative execution and also adds integrity checks to detect Spectre gadgets at run time. By leveraging fuzzing, Teapot succeeds in efficiently detecting Spectre gadgets. Evaluations show that Teapot outperforms both performance (more than 20x performant) and gadget detection ability than a previously proposed binary-based approach.

Figures

Figures reproduced from arXiv: 2411.11624 by the authors.

Figure 1
Figure 1. Comparison of the execution time of two pro￾grams instrumented with SpecTaint and SpecFuzz, with large crafted inputs, normalized to the execution time of the native versions. Shorter is better. Averaged over 10 runs. 2.3 Threat Model We assume the source code of the target program is miss￾ing. Except for this assumption, we share a similar threat model with various other Spectre gadget detection stud￾ies [21, 30, 3… view at source ↗
Figure 2
Figure 2. Assembly instructions of a switch statement compiled with GCC and Clang, respectively, with -O2 optimization. The different structures of the generated code affect the existence of Spectre-V1 gadgets. Binary Program Assembly Real Copy Shadow Copy Instrumented Real Copy Instrumented Shadow Copy Instrumented Program Real Copy Shadow Copy Gadgets Disassemble Make Copies Instrument Instrument Reassemble Fuzz Static Rewr… view at source ↗
Figure 3
Figure 3. Workflow of detecting Spectre gadgets in binaries with Teapot. each branch up to five times. This leaves many potential false negatives on the table (details in Section 7.2). In addition, being based on a system emulator, SpecTaint lacks knowl￾edge of critical program data structures such as the heap and stack. It also cannot differentiate out-of-bounds and legal access. Therefore, it has to be overly restrictive an… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Flow of program execution and misspeculation simulation with Speculation Shadows. fib$spec+0x114 run_fib+0x514 main+0x810 Call Stack (a) Function Return fn * bar = & nonspec_fn ; void foo$spec ( fn * baz ) { baz () ; } int main$spec () { foo$spec ( bar ) ; } (b) Explic…
Figure 5
Figure 5. Figure 5: Examples of control flow escaping into Real Copy. the program to the state before the simulation was started, and continues normal execution. In the example depicted in [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Illustration of Kasper’s policy on detecting Spectre￾V1 gadgets (based on [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Execution time of the instrumented programs with large crafted inputs, normalized to the execution time of the native versions. Lower is better. Averaged over 10 runs. Due to the lack of documentation and many hard-coded constants, we could not fully reproduce SpecTain…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 50 canonical work pages

  1. [1]

    Bilal Ali Ahmad. 2020. Real time Detection of Spectre and Meltdown Attacks Using Machine Learning. arXiv preprint arXiv:2006.01442 (2020)

    work page Pith review arXiv 2020

  2. [2]

    Fabrice Bellard. 2005. QEMU, A Fast and Portable Dynamic Translator. In Proceedings of the 2005 USENIX Annual Technical Conference (USENIX ATC ’05)

    work page 2005

  3. [3]

    Bernat and Barton P

    Andrew R. Bernat and Barton P. Miller. 2011. Anywhere, Any-Time Binary Instrumentation. In Proceedings of the 10th ACM SIGPLAN- SIGSOFT Workshop on Program Analysis for Software Tools (PASTE ’11)

    work page 2011

  4. [4]

    Marcel Böhme, Van-Thuan Pham, and Abhik Roychoudhury. 2016. Coverage-Based Greybox Fuzzing as Markov Chain. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS ’16)

    work page 2016

  5. [5]

    Juan Caballero and Zhiqiang Lin. 2016. Type inference on executables. ACM Computing Surveys (CSUR) 48, 4 (2016), 1–35

    work page 2016

  6. [6]

    Claudio Canella, Daniel Genkin, Lukas Giner, Daniel Gruss, Moritz Lipp, Marina Minkin, Daniel Moghimi, Frank Piessens, Michael Schwarz, Berk Sunar, Jo Van Bulck, and Yuval Yarom. 2019. Fall- out: Leaking Data on Meltdown-resistant CPUs. In Proceedings of the CGO ’25, March 01–05, 2025, Las Vegas, NV, USA Fangzheng Lin, Zhongfa Wang, and Hiroshi Sasaki ACM...

    work page 2019

  7. [7]

    Ligeng Chen, Zhongling He, and Bing Mao. 2020. Cati: Context- assisted Type Inference from Stripped Binaries. In Proceedings of the 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN ’20)

    work page 2020

  8. [8]

    Peng Chen and Hao Chen. 2018. Angora: Efficient Fuzzing by Prin- cipled Search. In Proceedings of the 2018 IEEE Symposium on Security and Privacy (IEEE S&P ’18)

    work page 2018

Show all 51 references
  1. [9]

    Nick Clifton. 2018. SPECTRE Variant 1 Scanning Tool. Retrieved 2023- 11-29 from https://access.redhat.com/blogs/766093/posts/3510331

    2018

  2. [10]

    Sushant Dinesh, Nathan Burow, Dongyan Xu, and Mathias Payer. 2020. Retrowrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization. In Proceedings of the 2020 IEEE Symposium on Security and Privacy (IEEE S&P ’20)

    2020

  3. [11]

    Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse

  4. [12]

    Antonio Flores-Montoya and Eric Schulte. 2020. Datalog Disassem- bly. In Proceedings of the 29th USENIX Security Symposium (USENIX Security ’20)

    2020

  5. [13]

    Open Information Security Foundation. 2023. libhtp: LibHTP is A Security-Aware Parser for the HTTP Protocol and the Related Bits and Pieces. Retrieved 2023-11-29 from https://github.com/OISF/libhtp

    2023

  6. [14]

    Google. 2023. brotli: Brotli Compression Format. Retrieved 2023-11-29 from https://github.com/google/brotli

    2023

  7. [15]

    Google. 2023. Honggfuzz: Security Oriented Software Fuzzer. Re- trieved 2023-11-29 from https://github.com/google/honggfuzz

    2023

  8. [16]

    Marco Guarnieri, Boris Köpf, José F Morales, Jan Reineke, and Andrés Sánchez. 2020. Spectector: Principled Detection of Speculative Infor- mation Flows. In Proceedings of the 2020 IEEE Symposium on Security and Privacy (IEEE S&P ’20)

    2020

  9. [17]

    Shengjian Guo, Yueqi Chen, Peng Li, Yueqiang Cheng, Huibo Wang, Meng Wu, and Zhiqiang Zuo. 2020. SpecuSym: Speculative Sym- bolic Execution for Cache Timing Leak Detection. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering (ICSE ’20)

    2020

  10. [18]

    Andrew Henderson, Aravind Prakash, Lok Kwong Yan, Xunchao Hu, Xujiewen Wang, Rundong Zhou, and Heng Yin. 2014. Make It Work, Make It Right, Make It Fast: Building a Platform-Neutral Whole-System Dynamic Binary Analysis Platform. In Proceedings of the 2014 Interna- tional Sympo...

    2014

  11. [19]

    John L Hennessy and David A Patterson. 2017. Computer Architecture: A Quantitative Approach, Sixth Edition . Morgan Kaufmann

    2017

  12. [20]

    Intel. 2018. Speculative Execution Side Channel Mitigations. Retrieved 2024-07-08 from https://www.intel.com/content/dam/ develop/external/us/en/documents/336996-speculative-execution- side-channel-mitigations.pdf

    2018

  13. [21]

    Brian Johannesmeyer, Jakob Koschel, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2022. Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel. In Proceedings of the 29th Network and Distributed System Security Symposium (NDSS ’22)

    2022

  14. [22]

    Paul Kocher. 2018. Spectre Mitigations in Microsoft’s C/C++ Com- piler. Retrieved 2023-11-29 from https://www.paulkocher.com/doc/ MicrosoftCompilerSpectreMitigation.html

    2018

  15. [23]

    Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2019. Spectre Attacks: Exploiting Speculative Execution. In Proceedings of the 40th IEEE Sym- posium on ...

    2019

  16. [24]

    Teapot: Efficiently Uncovering Spectre Gadgets in COTS Binaries

    Fangzheng Lin, Zhongfa Wang, and Hiroshi Sasaki. 2024. Artifact of the paper "Teapot: Efficiently Uncovering Spectre Gadgets in COTS Binaries". https://doi.org/10.5281/zenodo.14507732

    2024 doi

  17. [25]

    LLVM. 2023. DataFlowSanitizer. Retrieved 2023-11-29 from https: //clang.llvm.org/docs/DataFlowSanitizer.html

    2023

  18. [26]

    LLVM. 2023. SanitizerCoverage. Retrieved 2023-11-29 from https: //clang.llvm.org/docs/SanitizerCoverage.html

    2023

  19. [27]

    Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazel- wood. 2005. Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. In Proceedings of the 26th ACM SIGPLAN Conference on...

    2005

  20. [28]

    Microsoft. 2021. MSVC Compiler Reference: /Qspectre. Re- trieved 2023-11-29 from https://learn.microsoft.com/en-us/cpp/build/ reference/qspectre?view=msvc-170

    2021

  21. [29]

    Nicholas Nethercote and Julian Seward. 2007. Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation. In Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’07)

    2007

  22. [30]

    Oleksii Oleksenko, Bohdan Trach, Mark Silberstein, and Christof Fet- zer. 2020. SpecFuzz: Bringing Spectre-Type Vulnerabilities to the Sur- face. In Proceedings of the 29th USENIX Security Symposium (USENIX Security ’20)

    2020

  23. [31]

    OpenSSL. 2023. openssl: TLS/SSL and Crypto Library. Retrieved 2023-11-29 from https://github.com/openssl/openssl

    2023

  24. [32]

    Dag Arne Osvik, Adi Shamir, and Eran Tromer. 2006. Cache Attacks and Countermeasures: The Case of AES. In Proceedings of the Cryptog- raphers’ Track at the RSA Conference (CT-RSA ’06)

    2006

  25. [33]

    Zhixin Pan and Prabhat Mishra. 2021. Automated Detection of Spec- tre and Meltdown Attacks Using Explainable Machine Learning. In Proceedings of the 2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST ’21)

    2021

  26. [34]

    Hernán Ponce-de León and Johannes Kinder. 2022. Cats vs. Spectre: An Axiomatic Approach to Modeling Speculative Execution Attacks. In Proceedings of the 2022 IEEE Symposium on Security and Privacy (IEEE S&P ’22)

    2022

  27. [35]

    The YAML Project. 2021. LibYAML - A C library for Parsing and Emitting YAML. Retrieved 2023-11-29 from https://github.com/yaml/ libyaml

    2021

  28. [36]

    Zhenxiao Qi, Qian Feng, Yueqiang Cheng, Mengjia Yan, Peng Li, Heng Yin, and Tao Wei. 2021. SpecTaint: Speculative Taint Analysis for Discovering Spectre Gadgets. In Proceedings of the 28th Network and Distributed System Security Symposium (NDSS ’21)

    2021

  29. [37]

    Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, and Herbert Bos. 2017. VUzzer: Application-Aware Evolu- tionary Fuzzing. In Proceedings of the 24th Network and Distributed System Security Symposium (NDSS ’17)

    2017

  30. [38]

    Brown, and Vlad Folts

    Eric Schulte, Michael D. Brown, and Vlad Folts. 2022. A Broad Com- parative Evaluation of x86-64 Binary Rewriters. In Proceedings of the 15th Workshop on Cyber Security Experimentation and Test (CSET ’22)

    2022

  31. [39]

    Eric Schulte, Jonathan Dorn, Antonio Flores-Montoya, Aaron Ballman, and Tom Johnson. 2019. GTIRB: Intermediate Representation for Binaries. arXiv preprint arXiv:1907.02859 (2019)

    2019 arXiv

  32. [40]

    Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A Fast Address Sanity Checker. In Proceedings of the 2012 USENIX Annual Technical Con- ference (USENIX ATC ’12)

    2012

  33. [41]

    Yan Shoshitaishvili, Ruoyu Wang, Christopher Salls, Nick Stephens, Mario Polino, Andrew Dutcher, John Grosen, Siji Feng, Christophe Hauser, Christopher Kruegel, and Giovanni Vigna. 2016. SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis. In Pro- ceedings ...

    2016

  34. [42]

    G Edward Suh, Jae W Lee, David Zhang, and Srinivas Devadas. 2004. Secure Program Execution via Dynamic Information Flow Tracking. In Proceedings of the 11th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’04) . Teapot:...

    2004

  35. [43]

    Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida

  36. [44]

    Guanhua Wang, Sudipta Chattopadhyay, Arnab Kumar Biswas, Tu- lika Mitra, and Abhik Roychoudhury. 2020. KLEESpectre: Detecting Information Leakage through Speculative Cache Attacks via Symbolic Execution. ACM Transactions on Software Engineering and Methodology (TOSEM) 29, 3 (2...

    2020

  37. [45]

    Guanhua Wang, Sudipta Chattopadhyay, Ivan Gotovchits, Tulika Mitra, and Abhik Roychoudhury. 2019. oo7: Low-Overhead Defense Against Spectre Attacks via Program Analysis. IEEE Transactions on Software Engineering 47, 11 (2019), 2504–2519

    2019

  38. [46]

    Shuai Wang, Pei Wang, and Dinghao Wu. 2016. UROBOROS: Instru- menting Stripped Binaries with Static Reassembling. In Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER ’16)

    2016

  39. [47]

    Bharadwaj Yadavalli and Aaron Smith

    S. Bharadwaj Yadavalli and Aaron Smith. 2019. Raising Binaries to LLVM IR with MCTOLL (WIP Paper). In Proceedings of the 20th ACM SIGPLAN/SIGBED International Conference on Languages, Compilers, and Tools for Embedded Systems (LCTES ’19)

    2019

  40. [48]

    Serge Zaitsev. 2021. jsmn: Jsmn is a World Fastest JSON Parser/Tok- enizer. Retrieved 2023-11-29 from https://github.com/zserge/jsmn

    2021

  41. [49]

    Yunjie Zhang and Yiorgos Makris. 2020. Hardware-Based Detection of Spectre Attacks: A Machine Learning Approach. In Proceedings of the 2020 Asian Hardware Oriented Security and Trust Symposium (AsianHOST ’20)

    2020

  42. [2019]

    In Proceedings of the 40th IEEE Symposium on Security and Privacy (IEEE S&P ’19)

    RIDL: Rogue In-flight Data Load. In Proceedings of the 40th IEEE Symposium on Security and Privacy (IEEE S&P ’19)

  43. [2020]

    In Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT ’20)

    AFL++: Combining Incremental Steps of Fuzzing Research. In Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT ’20)

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.