Oussama Draissi

Bachelor’s thesis — Automated Advanced Information-Leak Exploitation

FAILT—runtime memory-disclosure exploitation built around one counterintuitive finding: the more defenses a system piles on, the more surface it exposes for pointer disclosure. With no offline phase it recovered most of a binary’s segments under state-of-the-art randomization, even locating the stack under an active Safe Stack, and told code from data pointers with >90% accuracy.

Supervised by Michael Rodler, I built FAILT (the Furious and Advanced Information Leakage Tool), fusing the memory-disclosure strategies of JIT-ROP and the Pathfinder framework. Unlike Pathfinder it needs no offline phase, filtering invalid addresses at runtime through heuristics; unlike JIT-ROP it follows arbitrary pointers of any type rather than only code pointers. The recurring lesson was structural: the very mechanisms meant to harden a binary—randomization metadata, shadow stacks, indirection tables—add pointers and bookkeeping that amplify memory disclosure rather than prevent it.

Its heuristics were deliberately simple and overfitted to the evaluation system, so I did not pursue the line further. Its real value was an early, hands-on grasp of memory disclosure and mitigation bypasses, which fed directly into our later RiscyROP work.

DataMed: Anomaly Detection in Medical Insurance Data

A graph-analysis prototype, built with the Barmenia insurance group, to surface organized insurance fraud—a problem worth an estimated €4–5 billion a year across the German industry.

We designed and implemented an analysis platform that builds graphs from Barmenia’s claims data and flags anomalous structures that may point to organized, band-like fraud. The prototype did uncover anomalies; whether each truly indicates fraud could not be settled within the project, since data-protection rules kept us from the real records and that judgement belongs to a claims adjuster. Even so, the results and Barmenia’s feedback suggested the approach is sound.

CompatAI: Comparative Training of AI Agents

A multi-agent reinforcement-learning study of emergent cooperation and competition: a hierarchical communication scheme measurably improved performance, and cooperation correlated clearly with winning.

We evaluated multi-agent learning in two demanding game environments, Pommerman and Food Collector, adapting both to competitive and non-competitive team play and building custom visualization tools to make the emergent collaboration legible. My contribution centered on the communication, collaboration, and competition between agents, and on the visualization that made it observable.

WAT: WebAssembly Analysis Toolkit

My first WebAssembly project: to our knowledge the first binary-only Wasm fuzzer, driven entirely by dynamic instrumentation of the binary inside its JavaScript host.

WAT builds on Wasabi, a dynamic-analysis framework that instruments a WebAssembly binary as it runs in its JavaScript host. From Wasabi’s taint instrumentation it locates pointers and automatically synthesizes fuzzing harnesses, crash oracles, and stubs for missing imports, then drives them with AFL++. Fuzzing the 100 smallest binaries from Marius Musch’s New Kid on the Web study of WebAssembly in the wild—a corpus dominated by cryptojacking modules—surfaced many crashes, but those modules came stripped of any surrounding context, so there was no way to faithfully reproduce their execution. (Musch later collaborated with us on Wemby.) Confronting that became the starting point for my thesis.

Master’s thesis — WaWebFuzz: A WebAssembly Fuzzer for the Web

Large-scale fuzzing of WebAssembly in the wild via ahead-of-time wasm2c translation: of 2,844,980 websites crawled, 9,526 used WebAssembly, and 34% of the in-production modules analyzed contained memory errors.

Where WAT instrumented binaries dynamically, WaWebFuzz took the opposite route. It lifts each module ahead-of-time to native code with wasm2c (WebAssembly → C → compiled binary) and fuzzes that native binary, modelled on the Ethereum EF/CF fuzzer of my former supervisor Michael Rodler. Compiling the module out of the browser bought the raw throughput to crawl and fuzz at web scale. The catch is structural: wasm2c lifts the code out of its host, discarding the surrounding page and the real threat model, so the memory errors it found were not reproducibly exploitable. Resolving that is exactly what led to Wemby, which does not run in the browser but faithfully reproduces its environment, so the bugs it finds are genuinely exploitable.