gabe sherman

Ph.D. Student at the University of Utah | Computer Security

[gabe sherman @gabe_sherman6]

SnakeCharmer takes inspiration from prior C/C++ harnessing work while addressing Python's unique challenges, including cross-language interactions, ambiguous crash oracles, and dynamic typing.

📄Paper: https://t.co/ljsVM7buvf
🔧Tool: https://t.co/sRqF0sB9k1

Happy hunting!

[gabe sherman @gabe_sherman6]

Love Python but loathe its libraries' bugs?

This Wednesday at @FSEconf, I’ll be presenting my latest work in collaboration with @snagycs, "SnakeCharmer: Automatic Fuzzing Harness Generation for Pure and Hybrid Python Libraries"!

[Stefan Nagy @snagycs]

Crashing calculators and CAD editors? GUIFuzz++ is finally here to help make them better! 🔥

Come see my undergraduate student @trowlett0's very first paper "GUIFuzz++" at #ASE25 this Wednesday.

Also now integrated in AFL++! 😃
https://t.co/JrJi7hbpzO

[gabe sherman @gabe_sherman6]

I’m excited to share that the project I developed during my internship this past summer has been released!

A huge thanks to @trailofbits for giving me the opportunity to work on impactful, security-focused tooling. Check out the blog post to learn more!

[Trail of Bits @trailofbits]

Quickly identify weak binaries in your browser by dragging files into Checksec Anywhere, which will then automatically create a color-coded security report.

[Tanner Rowlett @trowlett0]

Fuzzing GUIs shouldn’t be harder than fuzzing files.

That's why I am excited to share my first paper (w/ fellow undergrad Dillon Otto + @snagycs) "GUIFuzz++: Unleashing Grey-box Fuzzing on Desktop Graphical User Interfacing Applications" at #ASE25.

[gabe sherman @gabe_sherman6]

Curious about fuzzing but don't know where to start? I wrote my first blog post on how to choose your target, build an AFL++-compatible harness, and avoid common pitfalls.

Check it out: https://t.co/r1SG2qEndf

[Zao Yang @yangzaocn]

Happy to share my upcoming #ATC25 paper w/ @snagycs: "BIN2WRONG: a Unified Fuzzing Framework for Uncovering Semantic Errors in Binary-to-C Decompilers"!

Bin2Wrong creates binaries by mutating source, compiler, optimizations, and format—revealing 48 new bugs in 7 decompilers! 💪

[gabe sherman @gabe_sherman6]

@_neerajpal @trailofbits Good to know for future reference. Thanks for doing the digging💪

[Stefan Nagy @snagycs]

Awesome job by my PhD student @gabe_sherman6 presenting his work on Oracle-guided C Fuzzing Harness Generation! @ICSEconf

TLDR; 41 new bugs (40 now patched)... with 0 false positives!

Paper: https://t.co/dqCb3y9Cjy
Slides: https://t.co/ovZTXYIcyv
Code: https://t.co/IUASTjVkRo

[gabe sherman @gabe_sherman6]

@HacksAndHops OGHarn currently only supports C-based libraries, and monerod is quite heavy on C++. However the general approach and ideas can certainly be scaled to object-oriented software!

[gabe sherman @gabe_sherman6]

Need a fuzzing harness? No time to write one? Tired of false-positives? Let OGHarn lead the way to bug discovery!🐞

I'm excited to share my first paper(with @snagycs)"No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses" at @ICSEconf 2025!