The Curious Engineer

All blogs / Security

Sean Heelan's Blog

sean.heelan.io

If you'd like to get in contact you can find me on Twitter or LinkedIn. Recent Posts Other Popular Posts A full list of all posts, organized by category and year, can be found here.

SecurityPerformance / optimizationAI / ML

’10’15’20’25
Posts
53 from 6 May 2009 to 18 Jan 2026
Posting
now and then (1 in the last year)
Kind
personal blog
Feed
https://sean.heelan.io/feed/

2026 1

  1. On the Coming Industrialisation of Exploit Generation with LLMs

2025 1

  1. How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation

2023 4

  1. Application optimisation with LLMs: Finding faster, equivalent, software libraries.
  2. Finding 10x+ Performance Improvements in C++ with CodeQL – Part 2/2 on Combining Dynamic and Static Analysis for Performance Optimisation
  3. 60%+ Performance Improvements with Continuous Profiling and Library Matching – Part 1/2 on Combining Dynamic and Static Analysis for Performance Optimisation
  4. Optimising an eBPF Optimiser with Prodfiler (Repost)

2020 1

  1. PhD Thesis: Greybox Automatic Exploit Generation for Heap Overflows in Language Interpreters

2019 3

  1. Gollum: Modular and Greybox Exploit Generation for Heap Overflows in Interpreters
  2. Automation in Exploit Generation with Exploit Templates
  3. Some Cool Projects from a Dagstuhl Seminar on SAT, SMT and CP

2017 2

  1. Fuzzing PHP’s unserialize Function
  2. Upcoming Public Training: 4 Days of Advanced Tool Development with SMT Solvers (London, Nov ’17)

2016 5

  1. Tracking Down Heap Overflows with rr
  2. Fuzzing Language Interpreters Using Regression Tests
  3. Some Early-Stage Work on Statistical Crash Triage
  4. Training Dates Confirmed (Plus a Contest for Students)
  5. Public Edition of “Advanced Tool Development with SMT Solvers” Coming Soon!

2015 1

  1. Rust Compiler Plugins: A Simple Example

2012 6

  1. Moving location!
  2. SMT Solvers for Software Security (USENIX WOOT’12)
  3. Better Interpreter Fuzzing with Clang
  4. Anatomy of a Symbolic Emulator, Part 3: Processing Symbolic Data & Generating New Inputs
  5. Anatomy of a Symbolic Emulator, Part 2: Introducing Symbolic Data
  6. Anatomy of a Symbolic Emulator, Part 1: Trace Generation

2011 8

  1. SAT/SMT Summer School 2011 Summary (Days 5 & 6)
  2. SAT/SMT Summer School 2011 Summary (Days 3 & 4)
  3. SAT/SMT Summer School 2011 Summary (Day 2)
  4. SAT/SMT Summer School 2011 Summary (Day 1)
  5. Infiltrate 2011 Slides
  6. Finding Optimal Solutions to Arithmetic Constraints
  7. Exploit Necromancy in TCMalloc – Reviving the 4-to-N Byte Overflow Primitive with Insert to FreeList[X]
  8. Heap Scripts for TCMalloc with GDB’s Python API

2010 6

  1. Misleading the Public for Fun and Profit
  2. Augment your Auditing with a Theorem Prover
  3. Code Analysis Carpentry (Ruxcon 2010)
  4. Determining variable ranges (Part I)
  5. Validity, Satisfiability and Code Semantics
  6. Applying Taint Analysis and Theorem Proving to Exploit Development

2009 15

  1. Finding use-after-free bugs with static analysis
  2. Game Over! Thank you for playing Academia
  3. Exploit generation, a specialisation of testing?
  4. Automatic exploit generation: Lessons learned so far
  5. Extending to new vulnerability classes
  6. Gathering constraints from conditional branches
  7. Morphing shellcode using CFGs and SAT
  8. Fun uses for an SMT solver
  9. Pin problem solved!
  10. The romance is over…
  11. Not all shellcode locations are made equal
  12. Difficulties in taint data propagation without an IR
  13. Granular instrumentation with Pin
  14. Blackhat USA paper
  15. ISSA Ireland seminar