My last CTF has come to an end. I’m very proud that our team, 0x4b52, finished in second place at DEF CON CTF. On the final day, I was a little upset—not only as a CTF player, but also as a professor. As a professor, I always want to tell my students that we should try to live and compete with integrity. As a CTF player, I deeply respect a community where each of us voluntarily chooses to uphold the spirit of the game. I believe we should hack systems, not the rules. Of course, I understand that not everyone may see things the same way. And to be fair, I probably didn’t think this way myself when I was younger. Maybe I’ve just gotten a little older and come to believe that this is the way things should be. Anyway, a huge thank you to BBB for organizing this competition. It is impossible to imagine how much time, effort, and volunteer work it takes to make an event like this possible. If I came across as too aggressive during the game, I’m really sorry. As a team leader, every single tick felt incredibly precious to me. Congratulations to Blue Water. They definitely outperformed us. Some of the team members are my old friends. I really want to congratulate them. Most of all, I’m grateful to my teammates and students. It was truly a pleasure playing together. I had a great time. Thank you, everyone.

Everyone wants to fuzz complex optimizations of WebAssembly compilers, but most approaches are simply considering grammars and types. Why can't we fuzz optimizations directly? We will share how we can do if we have systematically written optimization rules in S&P 2025 :)

I am happy to announce that "BaseComp: A Comparative Analysis for Integrity Protection in Cellular Baseband Software" is accepted to Usenix Security '23. This work is related to static analysis to find logical bugs in baseband firmware.