Seminar: Graduate Seminar
Enlighten the Black-box: Fuzzing Control Flow Speculation with μarch Simulation
Date:
July,15,2026
Start Time:
11:30 - 12:30
Location:
506, Zisapel Building
Add to:
Lecturer:
Ofir Shapira
Research Areas:
| Existing tools for automatic detection of speculative leakage in commercial CPUs cannot be used for fuzzing indirect control flow instructions such as indirect branches, function calls, and returns. This is a fundamental limitation: fuzzers require exhaustive exploration of all possible control paths, potentially encountered during (mis)speculation. This becomes infeasible when any address can be a branch target. We present Flowvizor, the first fuzzer that enables systematic investigation of Spectre-V2-type leakages in commercial CPUs. Our main insight is that the traditional black-box approach of existing tools can be augmented with the publicly available µarch knowledge of specific CPU components, such as branch predictors. By simulating these components when generating inputs to the fuzzer, Flowvizor achieves an exponential reduction of the fuzzing space down to hardware-reachable execution paths. Flowvizor’s coverage improves with the accuracy of the µarch simulation and remains strictly larger than that of Revizor, the state-of-the-art black-box CPU fuzzer. Flowvizor automatically unveils a new speculation trigger and a leak in Intel’s CPU indirect branch predictor, it independently rediscovers several known leaks, offers new insights into the branch predictor μarch, and corroborates recently published reverse-engineered details about its internals. It opens new opportunities for systematic refinement of the reverse-engineered microarchitectural structures, providing code examples that cannot be explained by the public knowledge of CPU internals. M.Sc. student under the supervision of Prof. Mark Silberstein.
|