Meet in the Middle: Refining Taint Boundaries for IoT Firmware Vulnerability Discovery

Qingguan Gao, Kaizheng Liu, Jiayang Zhou, Jiacheng Yao, Huaiyu Yan, Qiguang Zhang, Xinhui Shao, Chongqing Lei, and Zhen Ling. Proceedings of the Network and Distributed System Security Symposium (NDSS), 2027.

The SLIP Problem: Detecting Shared Legacy Isolation-breaking Pointers in MCU-Oriented Real-Time Operating Systems

Xinhui Shao, Zhen Ling, Yue Zhang, Yumeng Wei, Huaiyu Yan, Junzhou Luo, Jianping Wang, and Xinwen Fu. Proceedings of the Network and Distributed System Security Symposium (NDSS), 2027.

Towards Secure and Efficient Driver Support for Embedded TEE Systems

Huaiyu Yan, Zhen Ling, Xinhui Shao, Ping Jiang, Ming Yang, Junzhou Luo, and Xinwen Fu. IEEE Transactions on Dependable and Secure Computing (TDSC), 23(4):9517-9534, 2026.

Paper ↗

UIEE: Secure and Efficient User-space Isolated Execution Environment for Embedded TEE Systems

Huaiyu Yan, Zhen Ling, Xuandong Chen, Xinhui Shao, Yier Jin, Haobo Li, Ming Yang, Ping Jiang, and Junzhou Luo. Proceedings of the Network and Distributed System Security Symposium (NDSS), 2026.

PDF ↗Code

The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading Attacks

Xinhui Shao, Zhen Ling, Yue Zhang, Huaiyu Yan, Yumeng Wei, Lan Luo, Zixia Liu, Junzhou Luo, and Xinwen Fu. Proceedings of the USENIX Security Symposium (USENIX Security), 2025.

PDF ↗Code

LDR: Secure and Efficient Linux Driver Runtime for Embedded TEE Systems

Huaiyu Yan, Zhen Ling, Haobo Li, Lan Luo, Xinhui Shao, Kai Dong, Ping Jiang, Ming Yang, Junzhou Luo, and Xinwen Fu. Proceedings of the Network and Distributed System Security Symposium (NDSS), 2024.

PDF ↗Code

fASLR: Function-Based ASLR for Resource-Constrained IoT Systems

Xinhui Shao#, Lan Luo#, Zhen Ling, Huaiyu Yan, Yumeng Wei, and Xinwen Fu. Proceedings of the European Symposium on Research in Computer Security (ESORICS), pp. 531-548, 2022.

Paper ↗

fASLR: Function-Based ASLR via TrustZone-M and MPU for Resource-Constrained IoT Systems

Lan Luo, Xinhui Shao, Zhen Ling, Huaiyu Yan, Yumeng Wei, and Xinwen Fu. IEEE Internet of Things Journal (IoT-J), 2022.

PDF ↗

Secure Boot, Trusted Boot and Remote Attestation for ARM TrustZone-based IoT Nodes

Zhen Ling, Huaiyu Yan, Xinhui Shao, Junzhou Luo, Yiling Xu, Bryan Pearson, and Xinwen Fu. Journal of Systems Architecture (JSA), 119, 2021.

Paper ↗

On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems

Kaizheng Liu, Ming Yang, Zhen Ling, Huaiyu Yan, Yue Zhang, Xinwen Fu, and Wei Zhao. IEEE Internet of Things Journal (IoT-J), 8(8):6815-6827, 2021.

PDF ↗