CrossFit: Demystifying VM Callback Bugs in Interpreters

Chibin Zhang, Qiang Liu, Mathias Payer

Proc. ACM Softw. Eng. · 2026 · pp. 2328-2349

Minoris: Practical Out-of-Emulator Kernel Module Fuzzing

Yangxi Xiang, Feng Wang, Yuan Chen, Qiang Liu, Haoyu Wang, Jiashui Wang, Lei Wu, Chaoyuan Chen, Yajin Zhou

IEEE Trans. Dependable Secur. Comput. · 2026 · pp. 1360-1372

SoK: Taxonomizing the Low-Level Attack Surface of Modern Web Browsers

Han Zheng, Qinying Wang, Qiang Liu, Mathias Payer

CoRR · 2026

Squeezing Juicy Variant Bugs Out of Modern Browsers

Han Zheng, Flavio Toffalini, Qiang Liu, Mathias Payer

WOOT · 2026 · pp. 131-151

The Impact of Magma: A Ground-Truth Fuzzing Benchmark

Ahmad Hazimeh, Adrian Herrera, Srividya Subramanian, Thaqiya Aman, Sara Vaccino, Qiang Liu, Mathias Payer

CoRR · 2026

Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel

Qiang Liu, Wenlong Zhang, Muhui Jiang, Lei Wu, Yajin Zhou

CoRR · 2025

REFLECTA: Reflection-based Scalable and Semantic Scripting Language Fuzzing

Chibin Zhang, Gwangmu Lee, Qiang Liu, Mathias Payer

AsiaCCS · 2025 · pp. 1772-1787

Truman: Constructing Device Behavior Models from OS Drivers to Fuzz Virtual Devices

Zheyu Ma, Qiang Liu, Zheming Li, Tingting Yin, Wende Tan, Chao Zhang, Mathias Payer

NDSS · 2025

HYPERPILL: Fuzzing for Hypervisor-bugs by leveraging the Hardware Virtualization Interface

Alexander Bulekov, Qiang Liu, Manuel Egele, Mathias Payer

USENIX Security Symposium · 2024

Tango: Extracting Higher-Order Feedback through State Inference

Ahmad Hazimeh, Duo Xu, Qiang Liu, Yan Wang, Mathias Payer

RAID · 2024 · pp. 403-418

TrapCog: An Anti-Noise, Transferable, and Privacy-Preserving Real-Time Mobile User Authentication System With High Accuracy

Jie Ying, Tiantian Zhu, Qiang Liu, Chunlin Xiong, Zhengqiu Weng, Tieming Chen, Lei Fu, Mingqi Lv, Han Wu, Ting Wang, Yan Chen

IEEE Trans. Mob. Comput. · 2024 · pp. 2832-2848

ViDeZZo: Dependency-aware Virtual Device Fuzzing

Qiang Liu, Flavio Toffalini, Yajin Zhou, Mathias Payer

SP · 2023 · pp. 3228-3245

EspialCog: General, Efficient and Robust Mobile User Implicit Authentication in Noisy Environment

Tiantian Zhu, Zhengqiu Weng, Qijie Song, Yuan Chen, Qiang Liu, Yan Chen, Mingqi Lv, Tieming Chen

IEEE Trans. Mob. Comput. · 2022 · pp. 555-572

ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels

Muhui Jiang, Lin Ma, Yajin Zhou, Qiang Liu, Cen Zhang, Zhi Wang, Xiapu Luo, Lei Wu, Kui Ren

CCS · 2021 · pp. 734-748

FirmGuide: Boosting the Capability of Rehosting Embedded Linux Kernels through Model-Guided Kernel Execution

Qiang Liu, Cen Zhang, Lin Ma, Muhui Jiang, Yajin Zhou, Lei Wu, Wenbo Shen, Xiapu Luo, Yang Liu, Kui Ren

ASE · 2021 · pp. 792-804

One Cycle Attack: Fool Sensor-Based Personal Gait Authentication With Clustering

Tiantian Zhu, Lei Fu, Qiang Liu, Zi Lin, Yan Chen, Tieming Chen

IEEE Trans. Inf. Forensics Secur. · 2021 · pp. 553-568