{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T14:39:50Z","timestamp":1775745590824,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,11,22]],"date-time":"2026-11-22T00:00:00Z","timestamp":1795305600000},"content-version":"vor","delay-in-days":368,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62302181, 62572209"],"award-info":[{"award-number":["62302181, 62572209"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Key R\\&D Program of Hubei Province","award":["2023BAB079, 2023BAB017"],"award-info":[{"award-number":["2023BAB079, 2023BAB017"]}]},{"name":"Huawei Research Fund"},{"name":"National Key Laboratory of Data Space Technology and System","award":["QZQC2024006"],"award-info":[{"award-number":["QZQC2024006"]}]},{"name":"HUSTCSE-FiberHome Joint Research Center for Network Security"},{"DOI":"10.13039\/100000001","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["OAC-2115167"],"award-info":[{"award-number":["OAC-2115167"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Battelle Energy Alliance, LLC","award":["No.313367"],"award-info":[{"award-number":["No.313367"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765180","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:37:25Z","timestamp":1763854645000},"page":"2054-2068","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Needle in a Haystack: Automated and Scalable Vulnerability Hunting in the Windows ALPC Sea"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-4907-7337","authenticated-orcid":false,"given":"Haoyi","family":"Liu","sequence":"first","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7091-2169","authenticated-orcid":false,"given":"Feng","family":"Dong","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-3866-4070","authenticated-orcid":false,"given":"Yunpeng","family":"Tian","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5905-9515","authenticated-orcid":false,"given":"Mu","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of Utah, Salt Lake City, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-1874-9006","authenticated-orcid":false,"given":"Xuefeng","family":"Li","sequence":"additional","affiliation":[{"name":"Beijing CyberKunlun Technology Co., Ltd, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2531-4642","authenticated-orcid":false,"given":"Fangming","family":"Gu","sequence":"additional","affiliation":[{"name":"Institute of Information and Engineering, CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8463-1971","authenticated-orcid":false,"given":"Zhiniang","family":"Peng","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1100-8633","authenticated-orcid":false,"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Aki Helin. 2015. Radamsa - a test case generator for robustness testing. https:\/\/gitlab.com\/akihe\/radamsa."},{"key":"e_1_3_2_1_2_1","volume-title":"Monitoring of RPC Messages with ALPC-Level API Hooking. In 2024 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR). 1-6.","author":"Andrei-Marius Muntea","year":"2024","unstructured":"Muntea Andrei-Marius, Portase Radu-Marian, and Sebestyen-Pal Gheorghe. 2024. Monitoring of RPC Messages with ALPC-Level API Hooking. In 2024 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR). 1-6."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534376"},{"key":"e_1_3_2_1_4_1","volume-title":"NAUTILUS: Fishing for deep bugs with grammars.. In NDSS.","author":"Aschermann Cornelius","year":"2019","unstructured":"Cornelius Aschermann, Tommaso Frassetto, Thorsten Holz, Patrick Jauernig, Ahmad-Reza Sadeghi, and Daniel Teuchert. 2019. NAUTILUS: Fishing for deep bugs with grammars.. In NDSS."},{"key":"e_1_3_2_1_5_1","unstructured":"Ben Barnea. 2023. Exploring Three Remote Code Execution Vulnerabilities in RPC Runtime. https:\/\/www.akamai.com\/blog\/security-research\/rpc-runtime-exploring-three-vulnerabilities."},{"key":"e_1_3_2_1_6_1","unstructured":"Blackduck. 2025. The Heartbleed Bug. https:\/\/www.heartbleed.com\/."},{"key":"e_1_3_2_1_7_1","first-page":"1985","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Blazytko Tim","year":"2019","unstructured":"Tim Blazytko, Cornelius Aschermann, Moritz Schl\u00f6gel, Ali Abbasi, Sergej Schumilo, Simon W\u00f6rner, and Thorsten Holz. 2019. GRIMOIRE: Synthesizing Structure while Fuzzing. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 1985-2002. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/blazytko"},{"key":"e_1_3_2_1_8_1","volume-title":"NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis. In 2021 IEEE Symposium on Security and Privacy (SP). 677-693","author":"Choi Jaeseung","year":"2021","unstructured":"Jaeseung Choi, Kangsu Kim, Daejin Lee, and Sang Kil Cha. 2021. NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis. In 2021 IEEE Symposium on Security and Privacy (SP). 677-693."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICACT.2008.4494042"},{"key":"e_1_3_2_1_10_1","unstructured":"Thomas Imbert Cl\u00e9ment Rouault. 2017. A view into ALPC RPC. https:\/\/hakril.net\/slides\/A_view_into_ALPC_RPC_pacsec_2017.pdf."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2010.83"},{"key":"e_1_3_2_1_12_1","volume-title":"Fuzzing Image Parsing in Windows","author":"Kizhakkinan Dhanesh","unstructured":"Dhanesh Kizhakkinan. 2021. Fuzzing Image Parsing in Windows, Part Two: Uninitialized Memory. https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/fuzzing-image-parsing-in-windows-uninitialized-memory\/."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER53432.2022.00042"},{"key":"e_1_3_2_1_14_1","unstructured":"EvoMaster. 2016. EvoMaster. https:\/\/github.com\/WebFuzzing\/EvoMaster."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2016.7783743"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397372"},{"key":"e_1_3_2_1_17_1","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00dffeldt, and Marc Heuse. 2020b. AFL: Combining incremental steps of fuzzing research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20)."},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of the 4th Conference on USENIX Windows Systems Symposium -","volume":"4","author":"Justin","unstructured":"Justin E. Forrester and Barton P. Miller. 2000. An Empirical Study of the Robustness of Windows NT Applications Using Random Testing. In Proceedings of the 4th Conference on USENIX Windows Systems Symposium - Volume 4 (Seattle, Washington) (WSS'00). USENIX Association, USA, 6."},{"key":"e_1_3_2_1_19_1","unstructured":"Google. 2010. Honggfuzz. https:\/\/github.com\/google\/honggfuzz."},{"key":"e_1_3_2_1_20_1","unstructured":"Google Project Zero. 2016. WinAFL. https:\/\/github.com\/googleprojectzero\/winafl."},{"key":"e_1_3_2_1_21_1","unstructured":"Google Project Zero. 2020. Jackalope. https:\/\/github.com\/googleprojectzero\/Jackalope."},{"key":"e_1_3_2_1_22_1","unstructured":"Google Project Zero. 2022. TinyInst. https:\/\/github.com\/googleprojectzero\/TinyInst."},{"key":"e_1_3_2_1_23_1","first-page":"3019","volume-title":"COMRace: Detecting Data Race Vulnerabilities in COM Objects. In 31st USENIX Security Symposium (USENIX Security 22)","author":"Gu Fangming","year":"2022","unstructured":"Fangming Gu, Qingli Guo, Lian Li, Zhiniang Peng, Wei Lin, Xiaobo Yang, and Xiaorui Gong. 2022. COMRace: Detecting Data Race Vulnerabilities in COM Objects. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 3019-3036. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/gu-fangming"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24334"},{"key":"e_1_3_2_1_25_1","unstructured":"L. H. Q. Linh. 2022. TinyAFL. https:\/\/github.com\/linhlhq\/TinyAFL."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3056505"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3192991"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453076"},{"key":"e_1_3_2_1_29_1","unstructured":"LLVM Project. 2003. LibFuzzer. https:\/\/llvm.org\/docs\/LibFuzzer.html."},{"key":"e_1_3_2_1_30_1","volume-title":"Vijay Janapa Reddi, and Kim Hazelwood","author":"Luk Chi-Keung","year":"2005","unstructured":"Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazelwood. 2005. Pin: building customized program analysis tools with dynamic instrumentation. Acm sigplan notices, Vol. 40, 6 (2005), 190-200."},{"key":"e_1_3_2_1_31_1","unstructured":"M. Zalewski. 2017. AFL. https:\/\/lcamtuf.coredump.cx\/afl."},{"key":"e_1_3_2_1_32_1","volume-title":"Fuzzing Image Parsing in Windows","unstructured":"Mandiant. 2021. Fuzzing Image Parsing in Windows, Part Two: Uninitialized Memory. https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/fuzzing-image-parsing-in-windows-uninitialized-memory\/."},{"key":"e_1_3_2_1_33_1","unstructured":"McAfee. 2020. An Inside Look into Microsoft Rich Text Format and OLE Exploits. https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/an-inside-look-into-microsoft-rich-text-format-and-ole-exploits\/."},{"key":"e_1_3_2_1_34_1","unstructured":"Microsoft. [n.d.]. Windows Classic Samples. GitHub https:\/\/github.com\/microsoft\/Windows-classic-samples."},{"key":"e_1_3_2_1_35_1","unstructured":"microsoft. 2017. CVE-2017-11783 Windows ALPC Elevation of Privilege Vulnerability. https:\/\/msrc.microsoft.com\/update-guide\/en-US\/advisory\/CVE-2017-11783."},{"key":"e_1_3_2_1_36_1","unstructured":"Microsoft. 2020a. Component Object Model (COM) | Microsoft Learn. https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/com\/component-object-model-com-portal."},{"key":"e_1_3_2_1_37_1","unstructured":"Microsoft. 2020b. RPC NDR Engine. https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/rpc\/rpc-ndr-engine."},{"key":"e_1_3_2_1_38_1","unstructured":"microsoft. 2021. About Event Tracing for Drivers. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/devtest\/about-event-tracing-for-drivers."},{"key":"e_1_3_2_1_39_1","unstructured":"Microsoft. 2022a. Example 12: Using Page Heap Verification to Find a Bug. GitHub (MicrosoftDocs) https:\/\/github.com\/MicrosoftDocs\/windows-driver-docs\/blob\/staging\/windows-driver-docs-pr\/debugger\/example-12--using-page-heap-verification-to-find-a-bug.md."},{"key":"e_1_3_2_1_40_1","unstructured":"Microsoft. 2022b. GFlags and PageHeap | Microsoft Learn. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/debugger\/gflags-and-pageheap."},{"key":"e_1_3_2_1_41_1","unstructured":"Microsoft. 2023. Alignment and memory addresses. https:\/\/learn.microsoft.com\/en-us\/cpp\/cpp\/alignment-cpp-declarations."},{"key":"e_1_3_2_1_42_1","unstructured":"Microsoft. 2025a. Force randomization for images (Mandatory ASLR). https:\/\/learn.microsoft.com\/en-us\/defender-endpoint\/exploit-protection-reference#force-randomization-for-images-mandatory-aslr."},{"key":"e_1_3_2_1_43_1","unstructured":"Microsoft. 2025b. Windows Server 2025 and Windows 11 PowerShell modules | Microsoft Learn. https:\/\/learn.microsoft.com\/en-us\/powershell\/windows\/get-started?view=windowsserver2025-ps."},{"key":"e_1_3_2_1_44_1","unstructured":"Microsoft. 2025. Windows Universal Samples. https:\/\/github.com\/microsoft\/Windows-universal-samples."},{"key":"e_1_3_2_1_45_1","unstructured":"Microsoft Security Response Center. 2020. Solving Uninitialized Stack Memory on Windows. https:\/\/msrc.microsoft.com\/blog\/2020\/05\/solving-uninitialized-stack-memory-on-windows\/."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10233-3"},{"key":"e_1_3_2_1_47_1","first-page":"149","volume-title":"Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities. In 26th USENIX Security Symposium (USENIX Security 17)","author":"Pan Jianfeng","year":"2017","unstructured":"Jianfeng Pan, Guanglu Yan, and Xiaocao Fan. 2017. Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 149-165. https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/pan"},{"key":"e_1_3_2_1_48_1","unstructured":"podalirius. 2023. Microsoft RPC Fuzzing Tools. https:\/\/github.com\/p0dalirius\/microsoft-rpc-fuzzing-tools."},{"key":"e_1_3_2_1_49_1","unstructured":"rantyben. 2014. RAF - Ruby ALPC Fuzzer. https:\/\/github.com\/bnagy\/raf."},{"key":"e_1_3_2_1_50_1","unstructured":"Carsten Sandker. 2022. Offensive Windows IPC Internals 3: ALPC. https:\/\/csandker.io\/2022\/05\/24\/Offensive-Windows-IPC-3-ALPC.html."},{"key":"e_1_3_2_1_51_1","unstructured":"Sandker Carsten. 2022. Debugging and Reversing ALPC. https:\/\/csandker.io\/2022\/05\/29\/Debugging-And-Reversing-ALPC.html."},{"key":"e_1_3_2_1_52_1","unstructured":"silverf0x. 2017. RpcView: Decompile Microsoft RPC interfaces. https:\/\/github.com\/silverf0x\/RpcView."},{"key":"e_1_3_2_1_53_1","unstructured":"socfortress. 2022. CVE-2022-26809 Remote Procedure Call Runtime Remote Code Execution Vulnerability. https:\/\/socfortress.medium.com\/cve-2022-26809-ms-rpc-vulnerability-f83dc4da5c06."},{"key":"e_1_3_2_1_54_1","unstructured":"Sogeti ESEC Lab. 2017. RPCForge. https:\/\/github.com\/sogeti-esec-lab\/RPCForge."},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464814"},{"key":"e_1_3_2_1_56_1","first-page":"4913","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Stone Leo","year":"2023","unstructured":"Leo Stone, Rishi Ranjan, Stefan Nagy, and Matthew Hicks. 2023. No Linux, No Problem: Fast and Correct Windows Binary Fuzzing via Target-embedded Snapshotting. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 4913-4929. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/stone"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230547"},{"key":"e_1_3_2_1_58_1","volume-title":"Abhik Roychoudhury.","author":"Pham Van-Thuan","year":"2019","unstructured":"Van-Thuan Pham, Marcel B\u00f6hme, Andrew E. Santosa, Alexandru R\u0103zvan C\u0103ciulescu, Abhik Roychoudhury. 2019. Smart Greybox Fuzzing."},{"key":"e_1_3_2_1_59_1","volume-title":"Superion: Grammar-Aware Greybox Fuzzing. In 2019 IEEE\/ACM 41st International Conference on Software Engineering (ICSE). 724-735","author":"Wang Junjie","year":"2019","unstructured":"Junjie Wang, Bihuan Chen, Lei Wei, and Yang Liu. 2019. Superion: Grammar-Aware Greybox Fuzzing. In 2019 IEEE\/ACM 41st International Conference on Software Engineering (ICSE). 724-735."},{"key":"e_1_3_2_1_60_1","unstructured":"zer0condition. 2023. Demystifying PatchGuard: An In-Depth Analysis Through Practical Engineering. https:\/\/web.archive.org\/web\/20230510133129\/https:\/\/zerocondition.com\/posts\/demystifying-patchguard\/."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3585009"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.5555\/3620237.3620476"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765180","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765180","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:23:48Z","timestamp":1766442228000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765180"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":62,"alternative-id":["10.1145\/3719027.3765180","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765180","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}