{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T14:48:45Z","timestamp":1785336525841,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":32,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,11,12]],"date-time":"2021-11-12T00:00:00Z","timestamp":1636675200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Science Foundation","award":["1652954"],"award-info":[{"award-number":["1652954"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,11,12]]},"DOI":"10.1145\/3460120.3484564","type":"proceedings-article","created":{"date-parts":[[2021,11,13]],"date-time":"2021-11-13T12:05:34Z","timestamp":1636805134000},"page":"749-763","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":26,"title":["SyzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers"],"prefix":"10.1145","author":[{"given":"Weiteng","family":"Chen","sequence":"first","affiliation":[{"name":"University of California, Riverside, Riverside, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yu","family":"Wang","sequence":"additional","affiliation":[{"name":"Didi Research America, Mountain View, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zheng","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of California, Riverside, Riverside, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiyun","family":"Qian","sequence":"additional","affiliation":[{"name":"University of California, Riverside, Riverside, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,11,13]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2021. Apple Open Source. https:\/\/opensource.apple.com\/source."},{"key":"e_1_3_2_1_2_1","unstructured":"2021. IDA Pro. https:\/\/www.hex-rays.com\/ida-pro\/."},{"key":"e_1_3_2_1_3_1","unstructured":"2021. p-joker. https:\/\/github.com\/lilang-wu\/p-joker."},{"key":"e_1_3_2_1_4_1","unstructured":"2021. Symbolic lengths. https:\/\/docs.angr.io\/advanced-topics\/gotchas."},{"key":"e_1_3_2_1_5_1","unstructured":"2021. Syzbot. https:\/\/syzkaller.appspot.com\/upstream."},{"key":"e_1_3_2_1_6_1","unstructured":"2021. Syzkaller. https:\/\/github.com\/google\/syzkaller."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423357"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1961296.1950396"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134069"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455820"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF01890115"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3385412.3385972"},{"key":"e_1_3_2_1_13_1","volume-title":"Daniele Cono D'Elia, and Leonardo Querzoni","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Daniele Cono D'Elia, and Leonardo Querzoni. 2020. Fuzzing binaries for memory safety errors with QASan. In 2020 IEEE Secure Development (SecDev). IEEE, 23--30."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134103"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00017"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24018"},{"key":"e_1_3_2_1_17_1","volume-title":"TIE: Principled reverse engineering of types in binary programs.","author":"Lee JongHyup","year":"2011","unstructured":"JongHyup Lee, Thanassis Avgerinos, and David Brumley. 2011. TIE: Principled reverse engineering of types in binary programs. (2011)."},{"key":"e_1_3_2_1_18_1","volume-title":"2019 HITB Security Conference.","author":"Lin Juwei","year":"2019","unstructured":"Juwei Lin and Junzhi Lu. 2019. Panic on the Streets of Amsterdam: PanicXNU 3.0. 2019 HITB Security Conference."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.5555\/2788959.2788964"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00069"},{"key":"e_1_3_2_1_21_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Pailoor Shankara","year":"2018","unstructured":"Shankara Pailoor, Andrew Aday, and Suman Jana. 2018. Moonshine: Optimizing OS fuzzer seed selection with trace distillation. In 27th USENIX Security Symposium (USENIX Security 18). 729--743."},{"key":"e_1_3_2_1_22_1","volume-title":"26th USENIX Security Symposium (USENIX Security 17)","author":"Schumilo Sergej","year":"2017","unstructured":"Sergej Schumilo, Cornelius Aschermann, Robert Gawlik, Sebastian Schinzel, and Thorsten Holz. 2017. kafl: Hardware-assisted feedback fuzzing for OS kernels. In 26th USENIX Security Symposium (USENIX Security 17). 167--182."},{"key":"e_1_3_2_1_23_1","volume-title":"Periscope: An effective probing and fuzzing framework for the hardware-os boundary. In NDSS .","author":"Song Dokyung","year":"2019","unstructured":"Dokyung Song, Felicitas Hetzelt, Dipanjan Das, Chad Spensky, Yeoul Na, Stijn Volckaert, Giovanni Vigna, Christopher Kruegel, Jean-Pierre Seifert, and Michael Franz. 2019. Periscope: An effective probing and fuzzing framework for the hardware-os boundary. In NDSS ."},{"key":"e_1_3_2_1_24_1","series-title":"August 2016","volume-title":"Android: protecting the kernel. Linux Securit Summit","author":"Stoep JV","year":"2016","unstructured":"JV Stoep. 2016. Android: protecting the kernel. Linux Securit Summit (August 2016) (2016)."},{"key":"e_1_3_2_1_25_1","unstructured":"Dmitry Vyukov. 2019. Syzkaller: an unsupervised coverage-guided kernel fuzzer."},{"key":"e_1_3_2_1_26_1","unstructured":"Dmitry Vyukov. 2020. Syzkaller: adventures in continuous coverage-guided kernel fuzzing. Bluehat IL."},{"key":"e_1_3_2_1_27_1","volume-title":"Angr-the next generation of binary analysis. In 2017 IEEE Cybersecurity Development (SecDev)","author":"Wang Fish","unstructured":"Fish Wang and Yan Shoshitaishvili. 2017. Angr-the next generation of binary analysis. In 2017 IEEE Cybersecurity Development (SecDev). IEEE, 8--9."},{"key":"e_1_3_2_1_28_1","volume-title":"HITB Security Conference .","author":"Lilang","unstructured":"Lilang Wu and moony Li. 2019. Fresh Apples: Researching new attack interfaces on iOS and OSX. In HITB Security Conference ."},{"key":"e_1_3_2_1_29_1","volume-title":"Krace: Data Race Fuzzing for Kernel File Systems. In 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1643--1660","author":"Xu Meng","year":"2020","unstructured":"Meng Xu, Sanidhya Kashyap, Hanqing Zhao, and Taesoo Kim. 2020. Krace: Data Race Fuzzing for Kernel File Systems. In 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1643--1660."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00017"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00035"},{"key":"e_1_3_2_1_32_1","volume-title":"American fuzzy lop. URL http:\/\/lcamtuf.coredump.cx\/afl","author":"Zalewski Michal","year":"2015","unstructured":"Michal Zalewski. 2015. American fuzzy lop. URL http:\/\/lcamtuf.coredump.cx\/afl (2015)."}],"event":{"name":"CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event Republic of Korea","acronym":"CCS '21","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3484564","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3484564","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3484564","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T20:54:13Z","timestamp":1763499253000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3484564"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,12]]},"references-count":32,"alternative-id":["10.1145\/3460120.3484564","10.1145\/3460120"],"URL":"https:\/\/doi.org\/10.1145\/3460120.3484564","relation":{},"subject":[],"published":{"date-parts":[[2021,11,12]]},"assertion":[{"value":"2021-11-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}