publications | Gwendal Patat

2025

Worksop

Measuring While Playing Fair: An Empirical Analysis of Language and Framework Usage in the iOS App Store

Florian Magin, Fabian Scherf, Martin Renze, Cléo Fischer, and Gwendal Patat

In 1st Workshop on Software Understanding and Reverse Engineering (SURE), SURE 2025, Taipei, Taiwan, 2025

Bib

@inproceedings{MSRFPSURE25,
  author = {Magin, Florian and Scherf, Fabian and Renze, Martin and Fischer, Cléo and Patat, Gwendal},
  title = {{Measuring While Playing Fair: An Empirical Analysis of Language and Framework Usage in the iOS App Store}},
  booktitle = {1st Workshop on Software Understanding and Reverse Engineering (SURE), {SURE} 2025, Taipei, Taiwan},
  year = {2025},
  publisher = {ACM CCS},
}

Worksop

Heros in Action: Analyzing Objective-C Binaries through Decompilation and IFDS

Florian Magin, Gwendal Patat, and Fabian Scherf

In 1st International Workshop on Advancing Static Analysis for Researchers and Industry Practitioners in Software Engineering, STATIC 2025, Ottawa, Ontario, Canada, 2025

DOI Bib

@inproceedings{herosIFDS,
  author = {Magin, Florian and Patat, Gwendal and Scherf, Fabian},
  title = {Heros in Action: Analyzing Objective-C Binaries through Decompilation and {IFDS}},
  doi = {10.1109/STATIC66697.2025.00005},
  url = {https://doi.org/10.1109/STATIC66697.2025.00005},
  booktitle = {1st International Workshop on Advancing Static Analysis for Researchers and Industry Practitioners in Software Engineering, {STATIC} 2025, Ottawa, Ontario, Canada},
  year = {2025},
  publisher = {ICSE},
}

2024

Formal Security Analysis of Widevine through the W3C EME Standard

Stéphanie Delaune, Joseph Lallemand, Gwendal Patat, Florian Roudot, and Mohamed Sabt

In 33rd USENIX Security Symposium (USENIX Security 24), Aug 2024

Bib PDF Slides

@inproceedings{299820,
  author = {Delaune, St{\'e}phanie and Lallemand, Joseph and Patat, Gwendal and Roudot, Florian and Sabt, Mohamed},
  title = {Formal Security Analysis of Widevine through the {W3C} {EME} Standard},
  booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
  year = {2024},
  isbn = {978-1-939133-44-1},
  address = {Philadelphia, PA},
  pages = {6399--6415},
  url = {https://www.usenix.org/conference/usenixsecurity24/presentation/delaune},
  publisher = {USENIX Association},
  month = aug,
}

2023

Your DRM Can Watch You Too: Exploring the Privacy Implications of Browsers (mis)Implementations of Widevine EME

Gwendal Patat, Mohamed Sabt, and Pierre-Alain Fouque

In 23rd Proceedings on Privacy Enhancing Technologies, PETS 2023, Lausanne, Switzerland, July 10-15, Aug 2023

Mozilla Hall of Fame DOI Bib PDF Slides

We entered the Mozilla Security Bug Bounty Program Hall of Fame.

@inproceedings{conf/pets/PatatSF23,
  author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre{-}Alain},
  title = {Your DRM Can Watch You Too: Exploring the Privacy Implications of Browsers (mis)Implementations of Widevine EME},
  doi = {10.56553/popets-2023-0112},
  url = {https://doi.org/10.56553%2Fpopets-2023-0112},
  year = {2023},
  booktitle = {23rd Proceedings on Privacy Enhancing Technologies, {PETS} 2023, Lausanne, Switzerland, July 10-15},
  volume = {2023},
  number = {4},
  pages = {306--321},
}

2022

WideLeak: How Over-the-Top Platforms Fail in Android

Gwendal Patat, Mohamed Sabt, and Pierre-Alain Fouque

In 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2022, Baltimore, MD, USA, June 27-30, Aug 2022

Netflix Hall of Fame DOI Bib PDF Slides

We entered the Netflix, Inc., BugHunter Hall of Fame.

@inproceedings{DBLP:conf/dsn/PatatSF22,
  author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre{-}Alain},
  title = {WideLeak: How Over-the-Top Platforms Fail in Android},
  booktitle = {52nd Annual {IEEE/IFIP} International Conference on Dependable Systems
                 and Networks, {DSN} 2022, Baltimore, MD, USA, June 27-30},
  pages = {501--508},
  publisher = {{IEEE}},
  year = {2022},
  url = {https://doi.org/10.1109/DSN53405.2022.00056},
  doi = {10.1109/DSN53405.2022.00056},
  timestamp = {Fri, 29 Jul 2022 16:33:36 +0200},
  biburl = {https://dblp.org/rec/conf/dsn/PatatSF22.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org},
}

Workshop

Exploring Widevine for Fun and Profit

Gwendal Patat, Mohamed Sabt, and Pierre-Alain Fouque

In 43rd IEEE Security and Privacy, SP Workshops 2022, San Francisco, CA, USA, May 22-26, Aug 2022

CVE & Google Hall of Fame DOI Bib PDF Slides

We received CVE-2021-0639 and entered the Google Vulnerability Reward Program (VRP) Hall of Fame.

@inproceedings{DBLP:conf/sp/PatatSF22,
  author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre{-}Alain},
  title = {Exploring Widevine for Fun and Profit},
  booktitle = {43rd {IEEE} Security and Privacy, {SP} Workshops 2022, San Francisco,
                 CA, USA, May 22-26},
  pages = {277--288},
  publisher = {{IEEE}},
  year = {2022},
  url = {https://doi.org/10.1109/SPW54247.2022.9833867},
  doi = {10.1109/SPW54247.2022.9833867},
  timestamp = {Fri, 29 Jul 2022 10:34:36 +0200},
  biburl = {https://dblp.org/rec/conf/sp/PatatSF22.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org},
}

2020

National

Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild

Gwendal Patat and Mohamed Sabt

In Actes SSTIC 2020, 18ème Symposium sur la sécurité des technologies de l’information et des communications (SSTIC 2020), Aug 2020

Bib PDF

@inproceedings{patat:hal-02865105,
  title = {{Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild}},
  author = {Patat, Gwendal and Sabt, Mohamed},
  url = {https://hal.inria.fr/hal-02865105},
  booktitle = {{Actes SSTIC 2020, 18{\`e}me Symposium sur la s{\'e}curit{\'e} des technologies de l'information et des communications (SSTIC 2020)}},
  address = {Rennes, France},
  year = {2020},
  hal_id = {hal-02865105},
  hal_version = {v1},
}