HexHive PhD, MSc, BSc projects

This is a list of possible open, unassigned BSc or MSc research projects in the HexHive group for EPFL students.

Check out our list of completed projects to get an idea of past projects.

The projects are designed to be adjustable and scalable according to the type of BSc, MSc, or short PhD research project depending on the depth of the evaluation and exploration. For all projects we expect an open mind, good coding skills (especially in C/C++), and the willingness to learn. Previous experience with compilers (LLVM), build systems, and reverse engineering helps but is not required.

If you are interested in any of these topics then send an email to the supervisor. Note that we only process one application at a time, so please don't email five different supervisors at the same time. We will internally discuss all applications and then invite students for interviews. Apply early as spots are limited.

In the HexHive we welcome independent ideas from students as well, as long as they focus on the topics of system and software security, especially (but not exclusively) in sanitization of unsafe code, interactions between different components, mitigations, compiler-based security analyses, or fuzzing. So if you have an idea for your own project let us know and we can discuss! Reach out to the people most closest to your ideas and we'll let the ideas bubble up.

Adding Support for Trusty to TÄMU
  • Point of contact: Philipp Mao
  • Suitable for: MSc semester project or Bsc thesis
  • Keywords: systems security, TEE, vulnerability analysis

TÄMU[1] is an emulator for Trusted Applications, the applications running in the TEE. TÄMU already has support for almost all TEEs. The goal of this project is to add support for Google’s Trusty TEE[2], used on Pixel and Unisoc devices, to TÄMU. This includes modeling the runtime the Trusty TAs require and harnessing the TAs for fuzzing.

Requirements for this project are familiarity with ghidra, gdb, and python.

[1] https://nebelwelt.net/files/26Oakland.pdf

[2] https://source.android.com/docs/security/features/trusty?hl=de

Improving Coverage Reliability in Cortex-M Firmware Rehosting
  • Point of contact: Qinying Wang
  • Suitable for: MSc thesis
  • Keywords: firmware security, Cortex-M, rehosting, fuzzing, vulnerability analysis

Cortex-M firmware is widely used in embedded and IoT devices, including drones, medical devices, industrial controllers, and smart-home systems. Firmware rehosting enables scalable analysis by running firmware in an emulated environment instead of on physical hardware. This makes fuzzing easier, faster, and more observable.

However, rehosting systems approximate many aspects of the original execution environment, including MMIO behavior, interrupts, timers, DMA, memory layout, and initialization logic. These approximations may help firmware reach deeper code, but they may also affect the reliability of coverage-based fuzzing results.

This project studies the quality of coverage reported by Cortex-M firmware rehosting systems. The goal is to understand when reported coverage corresponds to meaningful firmware exploration and when it may be affected by artifacts of the rehosted execution environment. Based on this analysis, the project will explore techniques for improving coverage-guided firmware fuzzing.

For this project, the objectives are to:

  • Study how rehosting approximations affect coverage-guided firmware fuzzing.
  • Design a framework to record coverage together with relevant execution-context information.
  • Build controlled firmware examples for analyzing coverage reliability.
  • Develop and evaluate techniques for improving fuzzing effectiveness in rehosted Cortex-M firmware.

Requirements for this project are familiarity with Ghidra, GDB, Python, and C. Experience with QEMU/Unicorn, or fuzzing is a plus.

Ownership-Aware Bug Hunting in Rust Crates
  • Point of contact: Yiwen Xu
  • Suitable for: MSc semester project
  • Keywords: Rust, Program Analysis, Bug Detection

Background: Rust Ownership is its core design feature that enforces memory safety and prevents data races at compile time, without the need for garbage collection. However, to improve efficiency, expressiveness, and compatibility, Rust introduces unsafe blocks, which are often regarded as the Achilles’ heel of its safety guarantees. Unsafe blocks may lead to mismanagement of Rust’s ownership discipline by allowing programmers to bypass certain compile-time safety checks.

Description: This project aims to build an ownership-aware bug detection mechanism for Rust crates. Ideally, the mechanism should systematically model ownership transitions induced by unsafe APIs in Rust programs, including ownership acquisition, transfer, duplication, and destruction, particularly when such transitions cannot be tracked or enforced by the compiler.

Ownership modeling can become more challenging in the presence of nested or recursive types. For example, an unsafe invocation of std::ptr::copy_nonoverlapping<T> performs a bitwise copy of a value of type T. If T contains nested fields, such as Box, Vec, or String, this operation copies only their in-memory representations rather than duplicating the heap resources they own. As a result, the original value and the copied value may both appear to own the same nested allocation. When both values are subsequently dropped, Rust may attempt to free the same resource twice, leading to a double-free bug.

Requirements:

  • Strong understanding of Rust and its underlying mechanisms (such as compilation passes and representations)
  • Familiar with static or dynamic analysis tools (such as CodeQL, Semgrep, LLVM Analyzer)
  • Curiosity and self-motivation in exploring technical problems
  • CTF experience is a plus

Recommended readings:

Other projects

Several other projects are possible in the areas of software and system security. We are open to discussing possible projects around the development of security benchmarks, using machine learning to detect vulnerabilities, secure memory allocation, sanitizer-based coverage tracking, and others.