Muhammad Hammad Bashir

PSec Lab

Penn State University

I am a PhD student in Computer Science at Penn State University and a member of PSec Lab, advised by Prof. Arslan Khan.

My research is on firmware and embedded-system security — firmware rehosting, binary analysis, and side-channel attacks. My work on BoardRunner will appear at ACM CCS 2026.

Before the PhD I spent two years at 10xEngineers on RISC-V compliance verification and open-source ISA tooling, contributing to RISCOF, RISC-V ISAC, the RISC-V Sail model, and the official RISC-V Architecture Tests.

I am currently looking for cybersecurity research internships in systems security, firmware security, hardware/software interface security, and microarchitectural attacks.

research interests

Firmware rehosting, emulation, and peripheral/MMIO modeling
Binary analysis and reverse engineering of embedded firmware
Side-channel and microarchitectural attacks
Security at the hardware/software interface
RISC-V architecture, privileged specification, and compliance verification

security competitions

DARPA FIRE Hackathon (2026) — reverse-engineered 100 corrupted and obfuscated embedded binaries to recover architecture, vendor/platform, and firmware family; part of the winning team.
MITRE embedded Capture the Flag (eCTF) (2026) — led Penn State’s team and designed the security architecture for a hardware security module; placed 22nd of 119 teams.
CyberAuto Challenge (2026) — authorized security analysis of EV charging infrastructure, reported under NDA.

academic service

Artifact Evaluation Committee, USENIX WOOT 2026

education

PhD in Computer Science, The Pennsylvania State University, 2025–present
BSc in Electrical Engineering, University of Engineering and Technology (UET), Lahore, 2020–2024

news

Sep 04, 2026	BoardRunner: Automatic Firmware Rehosting using High-Fidelity Compositional Device Models was accepted at ACM CCS 2026.
Jul 01, 2026	Serving on the Artifact Evaluation Committee for USENIX WOOT 2026.
Jun 01, 2026	Our team won the DARPA FIRE Hackathon, reverse-engineering 100 corrupted and obfuscated embedded binaries to recover architecture, vendor/platform, and firmware family.

selected publications

BoardRunner: Automatic Firmware Rehosting using High-Fidelity Compositional Device Models

Muhammad Hammad Bashir, Michael Rooney, Colin Smith, Dongyan Xu, and Arslan Khan

In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS). Accepted; to appear. , 2026

Bib

@inproceedings{ccs_2026_boardrunner,
  author = {Bashir, Muhammad Hammad and Rooney, Michael and Smith, Colin and Xu, Dongyan and Khan, Arslan},
  booktitle = {Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS)},
  title = {BoardRunner: Automatic Firmware Rehosting using High-Fidelity Compositional Device Models},
  year = {2026},
}

µLEAK: Bypassing MPU Isolation on Cortex-M7 via Cache-Timing Attacks

Muhammad Hammad Bashir, Taegyu Kim, Arslan Khan, and Kyungtae Kim

In Non-Volatile Memories Workshop (NVMW) 2026, 2026

Bib PDF Website

@inproceedings{nvmw_2026_uleak,
  author = {Bashir, Muhammad Hammad and Kim, Taegyu and Khan, Arslan and Kim, Kyungtae},
  booktitle = {Non-Volatile Memories Workshop (NVMW) 2026},
  title = {µLEAK: Bypassing MPU Isolation on Cortex-M7 via Cache-Timing Attacks},
  year = {2026},
  url = {https://nvmw.ucsd.edu/program-3/#paper-33},
}

Verification of CoreSwap: Replacing ARM Cortex-A5 with RISC-V CVA6 in ARM SoC Environment

Muhammad Hammad Bashir, Umer Shahid, Muhammad Tahir, Yazan Hussnain, and Fatima Saleem

In RISC-V Summit Europe 2025 - Posters, Jun 2025

Abs Bib PDF Poster Website

This paper presents the verification methodology and results of the CoreSwap project, where the ARM Cortex-A5 core in ARM Educational Kit SoC was replaced with the open-source RISC-V OpenHW CVA6 core. The project demonstrates the feasibility of integrating a RISC-V core into an existing SoC ecosystem while maintaining functionality and system stability. We detail the comprehensive verification process, including core-level Architecture Compliance Tests (ACTs), manually written system-level tests, FPGA synthesis on a Kintex-7 platform, and running performance benchmarks. The verification strategy highlights the challenges and solutions to validate such a large-scale System on Chip (SoC). This seamless integration and verification of the CoreSwap underscores the potential of RISC-V in proprietary SoC environments.
@inproceedings{riscv_europe_2025_coreswap, author = {Bashir, Muhammad Hammad and Shahid, Umer and Tahir, Muhammad and Hussnain, Yazan and Saleem, Fatima}, booktitle = {RISC-V Summit Europe 2025 - Posters}, month = jun, title = {Verification of CoreSwap: Replacing ARM Cortex-A5 with RISC-V CVA6 in ARM SoC Environment}, url = {https://riscv-europe.org/summit/2025/posters#:~:text=Verification%20of%20CoreSwap%3A%20Replacing%20ARM%20Cortex%2DA5%20with%20RISC%2DV%20CVA6%20in%20ARM%20SoC%20Environment}, year = {2025}, }
Comprehensive Verification of the RISC-V Memory Management Unit: Challenges and Solutions

Huda Sajjad, Muhammad Hammad Bashir, Yazan Hussnain, and Fatima Saleem

In RISC-V Summit Europe 2025 - Posters, Apr 2025

Abs Bib PDF Poster Website

The Memory Management Unit (MMU), critical for virtual memory translation and protection, demands rigorous verification due to its inherent complexity. This work details a two-step methodology to ensure MMU compliance with the RISC-V Privileged ISA specification. First, a test suite was developed using the RISCOF framework, leveraging RISC-V ISAC for coverage analysis. Second, the suite was executed on the OpenHW Core-V Wally processor, employing ImperasDV as a reference model and riscvISACOV for functional coverage development. This approach identified a critical architectural bug in Core-V Wally’s MMU implementation, demonstrating the methodology’s effectiveness in validating memory management units.
@inproceedings{riscv_europe_2025_mmu_verification, author = {Sajjad, Huda and Bashir, Muhammad Hammad and Hussnain, Yazan and Saleem, Fatima}, booktitle = {RISC-V Summit Europe 2025 - Posters}, month = apr, title = {Comprehensive Verification of the RISC-V Memory Management Unit: Challenges and Solutions}, url = {https://riscv-europe.org/summit/2025/posters#:~:text=Comprehensive%20Verification%20of%20the%20RISC%2DV%20Memory%20Management%20Unit%3A%20Challenges%20and%20Solutions}, year = {2025}, }
Enhancing Privilege Architecture Support in RISC-V ISAC

Muhammad Hammad Bashir, Umer Shahid, Allen Baum, and Pawan Kumar Sanjaya

In RISC-V Summit Europe 2024 - Posters, Jun 2024

Abs Bib PDF Code Poster Website

RISCOF, a Python-based framework, ensures RISC-V processor implementations comply with instruction set simulators like Spike and Sail. It supports both manual and automated test suite generation via RISC-V CTG, with coverage analysis performed through RISC-V ISAC. However, the coverage analysis of privilege architectural tests has been limited due to incomplete support in RISC-V ISAC. To address this, we have introduced new features in RISC-V ISAC specifically for privileged architecture, along with a more efficient method for writing coverpoints. These enhancements aim to improve compliance testing comprehensively.
@inproceedings{riscv_europe_2024_privilege_isac, author = {Bashir, Muhammad Hammad and Shahid, Umer and Baum, Allen and Sanjaya, Pawan Kumar}, booktitle = {RISC-V Summit Europe 2024 - Posters}, month = jun, title = {Enhancing Privilege Architecture Support in RISC-V ISAC}, url = {https://riscv-europe.org/summit/2024/posters#:~:text=Enhancing%20Privileged%20Architecture%20Support%20in%20RISC%2DV%20ISAC}, year = {2024}, }