The complexity of modern software keeps growing, yet the demands on its performance, security and reliability persist. To meet these demands, powerful compilers with hundreds of optimizations and automated testing tools like fuzzers have become indispensable. Compilers, in particular, occupy a unique position in the software stack: they possess intricate knowledge of program semantics, which they leverage not only for optimization but also to harden compiled programs as part of the translation process. In this thesis we explore new ways a compiler's knowledge can be leveraged to address security problems and to increase the effectiveness of fuzzers, thus ultimately improving reliability. In the first part, we trace the history of code-reuse attacks and defenses up to sophisticated attacks that can bypass even state-of-the-art randomization defenses. We present a compiler-based software diversity defense called R²C against advanced code-reuse attacks, such as Address-Oblivious Code Reuse (AOCR). In the second part, we turn to fuzzer guidance and propose two compiler-assisted approaches. First, we introduce a compiler fuzzer called LOOL that leverages optimization-log counters as a coverage feedback that is both more precise and more efficient than code coverage. Second, we propose Program State Projection, a new type of compiler transformation that exposes data-dependent program states to a coverage-guided fuzzer. An empirical evaluation on FuzzBench and Magma does not yield statistically significant improvements in edge coverage or bug finding with our current heuristics, but we discuss the underlying principle as a promising direction for future work.     «

The complexity of modern software keeps growing, yet the demands on its performance, security and reliability persist. To meet these demands, powerful compilers with hundreds of optimizations and automated testing tools like fuzzers have become indispensable. Compilers, in particular, occupy a unique position in the software stack: they possess intricate knowledge of program semantics, which they leverage not only for optimization but also to harden compiled programs as part of the translation p...     »