Jayakrishna Menon Vadayath

I am a PhD student at School of Computing and Augmented Intelligence lab at Arizona State University.

I currently work at SEFCOM with some really amazing people and my primary advisor is Dr. Yan Shoshitaishvili. I also actively work with Dr. Ruoyu (Fish) Wang, Dr. Tiffany Bao and Dr. Adam Doupé.

My research focuses on automated vulnerability analysis on application software. My areas of interest are static analysis, symbolic execution and fuzzing.

Prior to starting my PhD in Fall 2019, I had interned at the Information Sciences Institute at University of Southern California under the supervision of Dr. Christophe Hauser and at SEFCOM where I currently work as a Research Assistant.

I have also interned at ForAllSecure Inc during the Summer 2022 where I worked with Thanassis Avgerinos and many other amazing people.

I started playing CTF’s as a part of Team bi0s in 2014 and I currently play with Shellphish. I primarily focus on Pwning/Exploitation challenges, but I occasionally try out some Reverse Engineering challenges as well.

selected publications

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

Jayakrishna Vadayath, Moritz Eckert, Kyle Zeng, and 9 more authors

In 31st USENIX Security Symposium (USENIX Security 22), Aug 2022

Abs PDF Slides

In spite of their effectiveness in the context of vulnerability discovery, current state-of-the-art binary program analysis approaches are limited by inherent trade-offs between accuracy and scalability. In this paper, we identify a set of vulnerability properties that can aid both static and dynamic vulnerability detection techniques, improving the precision of the former and the scalability of the latter. By carefully integrating static and dynamic techniques, we detect vulnerabilities that exhibit these properties in real-world programs at a large scale. We implemented our technique, making several advancements in the analysis of binary code, and created a prototype called ARBITER. We demonstrate the effectiveness of our approach with a large-scale evaluation on four common vulnerability classes: CWE-131 (Incorrect Calculation of Buffer Size), CWE-252 (Unchecked Return Value), CWE-134 (Uncontrolled Format String), and CWE-337 (Predictable Seed in Pseudo-Random Number Generator). We evaluated our approach on more than 76,516 x86-64 binaries in the Ubuntu repositories and discovered new vulnerabilities, including a flaw inserted into programs during compilation.
Greenhouse: Single-Service Rehosting of Linux-Based Firmware Binaries in User-Space Emulation

Hui Jun Tay, Kyle Zeng, Jayakrishna Menon Vadayath, and 11 more authors

In 32nd USENIX Security Symposium (USENIX Security 23), Aug 2023
Sleak: Automating Address Space Layout Derandomization

Christophe Hauser, Jayakrishna Vadayath, Yan Shoshitaishvili, and 3 more authors

In Proceedings of the 35th Annual Computer Security Applications Conference, Aug 2019

Abs

We present a novel approach to automatically recover information about the address space layout of remote processes in the presence of Address Space Layout Randomization (ASLR). Our system, dubbed Sleak, performs static analysis and symbolic execution of binary executable programs, and identifies program paths and input parameters leading to partial (i.e., only a few bits) or complete (i.e., the whole address) information disclosure vulnerabilities, revealing addresses of known objects of the target service or application. Sleak takes, as input, the binary executable program, and generates a symbolic expression for each program output that leaks information about the addresses of objects, such as stack variables, heap structures, or function pointers. By comparing these expressions with the concrete output of a remote process executing the same binary program image, our system is able to recover from a few bits to whole addresses of objects of the target application or service. Discovering the address of a single object in the target application is often enough to guess the layout of entire sections of the address space, which can be leveraged by attackers to bypass ASLR.