FUSE: Single-Pass Binary Co-Instrumentation for Accurate Vulnerability Detection
Overview
MS thesis · Virginia Tech · defended May 4, 2026 Systems Software Research Group, advised by Prof. Binoy Ravindran and Prof. Freek Verbeek Committee: Binoy Ravindran (Chair), Freek Verbeek, Kendall Giles Part of the LLRM project — the Low-Level Reasoning Machine
Research question
Compilers can detect memory-safety errors at build time using AddressSanitizer. Binary software shipped without source code gets none of that protection — and commercial, legacy, and third-party binaries are exactly the code most likely to go unaudited.
Existing binary-level ASAN tools depend on heuristic disassembly. On complex programs that disassembly is wrong, so the tools either fail to rewrite the binary at all or report memory errors that do not exist. Both failure modes make the tooling unusable in practice.
Can memory-safety instrumentation and fuzzing coverage be added to a stripped binary accurately enough to trust the results?
Approach
FUSE is a static binary instrumentation tool that inserts ASAN memory-safety checks and AFL++ coverage-guided fuzzing counters in a single pass, over the output of FoxDec — a formally verified disassembler.
Building on verified disassembly rather than heuristics is the central design decision: it is what makes the instrumentation sound, and it is what removes the false-positive problem at its root rather than filtering it afterwards.
Combining the two instrumentation types in one pass, rather than layering two tools, avoids paying the traversal and rewriting cost twice.
My contribution
As lead author and thesis author, I designed and implemented the instrumentation framework and ran the evaluation. The core technical contribution is a register liveness analysis for binary code: without source-level register information, naive instrumentation must conservatively save and restore registers at every instrumentation site. The analysis determines where those saves are actually unnecessary.
Evaluation
| Result | FUSE | RetroWrite |
|---|---|---|
| Spurious ASAN reports across 19,350 NIST Juliet test cases | zero | two genuine false positives |
| Binary rewriting success across 315 binaries, four benchmark suites | 89.5% | 46.3% |
| Throughput vs. native ASAN (zlib, libjpeg-turbo, libpng) | 99.3% | — |
| Coverage edges vs. source-level AFL instrumentation | 3.29× more | — |
Register liveness analysis eliminates push/pop pairs at 61% of instrumentation sites, which is what allows FUSE to stay within 1% of native ASAN throughput on real fuzzing targets.
Every ASAN-flagged error corresponds to a genuine memory-safety violation — the zero-false-positive result is what makes the output actionable rather than something a developer has to triage.
Artifacts
The implementation is not yet public — the manuscript is under review. Related work from the same project is available:
- Adding Compilation Metadata To Binaries To Make Disassembly Decidable — Engel, Verbeek, Kumar, Ravindran. IEEE QRS 2026 / EuroLLVM 2026.
- The LLRM Project — FoxDec, libLISA, and the wider binary-verification effort at SSRG.
The thesis will be available through the Virginia Tech ETD library.