Wen Xu

Background

Wen Xu is a computer security researcher who has worked across both offensive security competitions and academic vulnerability research. Early in his career he used the handle "Memeda" and was affiliated with Keen Team (also known as Keen Security Lab), a Chinese security research team well known for browser and mobile operating system exploitation. From 2016 to 2021 he pursued a PhD at the Georgia Institute of Technology, where he worked in the Systems Software and Security Lab (SSLab) under Professor Taesoo Kim, focusing on automated bug-finding techniques such as kernel and file-system fuzzing.

Android Rooting and Black Hat Research

While at Keen Team, Wen Xu focused on Linux and Android kernel bug-finding and Android root exploitation. Together with colleague Yubin Fu, he presented research on universal Android rooting techniques at Black Hat USA 2015, in a talk and accompanying whitepaper describing methods for gaining root access across a wide range of Android devices by chaining kernel vulnerabilities rather than relying on device-specific bugs. This class of research was significant because it demonstrated exploitation techniques that could generalize across many Android kernel versions and vendors, rather than being tied to a single device.

Competitive Exploitation: Pwn2Own and DEF CON CTF

Wen Xu also competed in high-profile exploitation contests. He is credited with a result in the Adobe Reader category at Pwn2Own 2015 and a result in the Microsoft Edge browser category at Pwn2Own 2016, contests run by Trend Micro's Zero Day Initiative that reward researchers for demonstrating working exploit chains against widely used software. He was later part of Team DEFKOR00T, which won the DEF CON CTF 2018 championship, one of the most prestigious capture-the-flag competitions in the security community.

Academic Fuzzing Research

During his doctoral studies at Georgia Tech, Wen Xu shifted toward academic systems-security research centered on fuzzing, publishing at top venues including IEEE Symposium on Security and Privacy (Oakland), ACM CCS, and USENIX ATC. With co-authors Hyungon Moon, Sanidhya Kashyap, Po-Ning Tseng, and Taesoo Kim, he created Janus, described as the first feedback-driven fuzzer to explore the two-dimensional input space of a file system by simultaneously mutating on-disk image metadata and file-system syscalls; the tool was reported to have found around 100 unique crashes and 32 assigned CVEs across mainstream Linux file systems. This work, published as "Fuzzing File Systems via Two-Dimensional Input Space Exploration" at IEEE S&P 2019, was followed by a successor project called Hydra presented at SOSP 2019. He also co-authored "Designing New Operating Primitives to Improve Fuzzing Performance" (ACM CCS 2017), "libmpk: Software Abstraction for Intel Memory Protection Keys" (USENIX ATC 2019), and a paper on aspect-preserving mutation for JavaScript engine fuzzing (IEEE S&P 2020).

Later Work and Legacy

After completing his PhD in 2021, Wen Xu moved into industry and entrepreneurship, co-founding the AI startup Narya.ai in 2022, which builds AI-assisted productivity tools including a voice-note application. Across his career, Wen Xu's trajectory from Android rooting research and international exploitation competitions to peer-reviewed fuzzing research illustrates a common pattern in the security research community, in which practical offensive skills developed in industry and competitive settings feed into, and are refined by, academic study of automated vulnerability discovery.

Timeline

• 2015-08Presented Android rooting research with Yubin Fu at Black Hat USA 2015 while affiliated with Keen Team.
• 2015Credited with a Pwn2Own 2015 result in the Adobe Reader category.
• 2016Credited with a Pwn2Own 2016 result in the Microsoft Edge category; began PhD studies at Georgia Institute of Technology.
• 2017Co-authored "Designing New Operating Primitives to Improve Fuzzing Performance," published at ACM CCS 2017.
• 2018Won DEF CON CTF 2018 as part of Team DEFKOR00T.
• 2019Co-authored the Janus file-system fuzzer paper at IEEE Symposium on Security and Privacy, and "libmpk" at USENIX ATC; successor project Hydra presented at SOSP 2019.
• 2020Co-authored a paper on JavaScript engine fuzzing via aspect-preserving mutation, published at IEEE S&P 2020.
• 2021Completed PhD at Georgia Institute of Technology's Systems Software and Security Lab (SSLab).
• 2022Co-founded the AI startup Narya.ai.