Open Topics

• Building an LLM agent that drives Ghidra/IDA/radare2 to answer reverse-engineering questions autonomously
• Task decomposition and tool-use strategies for multi-step binary analysis (unpacking, deobfuscation, semantic recovery)
• Benchmarking agent performance against human reverse engineers on curated…

• Analysing the Android implementation
• Bypassing the permission in iOS through webviews

Please contact Sebastian Schrittwieser.

• Designing LLVM passes that inject self-checking guards at compile time
• Automating placement of tamperproofing checks based on static analysis of sensitive code regions

Please contact Sebastian Schrittwieser.

• Using LLMs to recover semantic information (variable names, types, etc) from stripped or obfuscated binaries
• Prompting strategies and context-window management for whole-program reasoning
• Measuring hallucination rates

Please contact Sebastian Schrittwieser.

• Generating obfuscating transformations with LLMs
• LLM-driven diversification to defeat pattern-based attacks
• Using LLMs as a "red team" oracle to evaluate the strength of applied protections

Please contact Sebastian Schrittwieser.

• Extracting cloud storage URLs from mobile apps
• Extracting cloud authentication from mobile apps and testing for authorization issues (Cognito Identity Provider)
• Using LLMs to classify the purpose of app secrets
• Extracting and analyzing JWT and private keys

Please contact Sebastian Schrittwieser.

• Building an end-to-end pipeline: APK/IPA acquisition, static extraction, and dynamic instrumentation
• Automating Frida/objection scripting for common analysis tasks across heterogeneous apps
• Scaling secret extraction and classification (cloud URLs, JWTs, keys) to thousands of apps
• Continuous monitoring:…

• Surveying PUF candidates in commodity components (e.g., GPU components)
• Measuring entropy, reliability, and reproducibility of PUF responses across temperature and aging
• Evaluating resistance to cloning and machine-learning modeling attacks

Please contact Sebastian Schrittwieser.

• Curating a corpus of C source-code programs representative of real-world targets for software protection (DRM clients, license checkers, crypto routines, game anti-cheat stubs, embedded firmware)
• Annotating sensitive code regions within each program (e.g. license validation, key derivation, integrity…