diff --git a/LibOS/shim/src/bookkeep/shim_signal.c b/LibOS/shim/src/bookkeep/shim_signal.c
index 2487d1ce..728f729d 100644
--- a/LibOS/shim/src/bookkeep/shim_signal.c
+++ b/LibOS/shim/src/bookkeep/shim_signal.c
@@ -408,7 +408,7 @@ static bool is_sgx_pal(void) {
 
     if (!__atomic_load_n(&inited.counter, __ATOMIC_SEQ_CST)) {
         /* Ensure that is_sgx_pal is updated before initialized */
-        __atomic_store_n(&sgx_pal.counter, !strcmp_static(PAL_CB(host_type), "Linux-SGX"),
+        __atomic_store_n(&sgx_pal.counter, !strcmp(PAL_CB(host_type), "Linux-SGX"),
                          __ATOMIC_SEQ_CST);
         __atomic_store_n(&inited.counter, 1, __ATOMIC_SEQ_CST);
     }
diff --git a/LibOS/shim/src/fs/chroot/fs.c b/LibOS/shim/src/fs/chroot/fs.c
index bcc1400e..45a907c0 100644
--- a/LibOS/shim/src/fs/chroot/fs.c
+++ b/LibOS/shim/src/fs/chroot/fs.c
@@ -42,11 +42,11 @@ struct mount_data {
 static int chroot_mount(const char* uri, void** mount_data) {
     enum shim_file_type type;
 
-    if (strstartswith_static(uri, URI_PREFIX_FILE)) {
+    if (strstartswith(uri, URI_PREFIX_FILE)) {
         type = FILE_UNKNOWN;
         uri += 5;
-    } else if (strstartswith_static(uri, URI_PREFIX_DEV)) {
-        type = strstartswith_static(uri + static_strlen(URI_PREFIX_DEV), "tty")
+    } else if (strstartswith(uri, URI_PREFIX_DEV)) {
+        type = strstartswith(uri + static_strlen(URI_PREFIX_DEV), "tty")
                ? FILE_TTY
                : FILE_DEV;
         uri += 4;
@@ -808,7 +808,7 @@ static int chroot_readdir(struct shim_dentry* dent, struct shim_dirent** dirent)
     chroot_update_ino(dent);
 
     const char* uri = qstrgetstr(&data->host_uri);
-    assert(strstartswith_static(uri, URI_PREFIX_DIR));
+    assert(strstartswith(uri, URI_PREFIX_DIR));
 
     pal_hdl = DkStreamOpen(uri, PAL_ACCESS_RDONLY, 0, 0, 0);
     if (!pal_hdl)
diff --git a/LibOS/shim/src/fs/dev/attestation.c b/LibOS/shim/src/fs/dev/attestation.c
index d71fe210..85d15b32 100644
--- a/LibOS/shim/src/fs/dev/attestation.c
+++ b/LibOS/shim/src/fs/dev/attestation.c
@@ -113,7 +113,7 @@ static int dev_attestation_user_report_data_open(struct shim_handle* hdl, const
     __UNUSED(name);
     __UNUSED(flags);
 
-    if (strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* this pseudo-file is only available with Linux-SGX */
         return -EACCES;
     }
@@ -157,7 +157,7 @@ static int dev_attestation_target_info_open(struct shim_handle* hdl, const char*
     __UNUSED(name);
     __UNUSED(flags);
 
-    if (strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* this pseudo-file is only available with Linux-SGX */
         return -EACCES;
     }
@@ -206,7 +206,7 @@ static int dev_attestation_my_target_info_open(struct shim_handle* hdl, const ch
     char* target_info          = NULL;
     struct shim_str_data* data = NULL;
 
-    if (strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* this pseudo-file is only available with Linux-SGX */
         return -EACCES;
     }
@@ -291,7 +291,7 @@ static int dev_attestation_report_open(struct shim_handle* hdl, const char* name
     struct shim_str_data* data = NULL;
     char* data_str_report      = NULL;
 
-    if (strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* this pseudo-file is only available with Linux-SGX */
         return -EACCES;
     }
@@ -370,7 +370,7 @@ static int dev_attestation_quote_open(struct shim_handle* hdl, const char* name,
     char* data_str_quote       = NULL;
     struct shim_str_data* data = NULL;
 
-    if (strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* this pseudo-file is only available with Linux-SGX */
         return -EACCES;
     }
@@ -450,7 +450,7 @@ static int dev_attestation_pfkey_open(struct shim_handle* hdl, const char* name,
     __UNUSED(name);
     __UNUSED(flags);
 
-    if (strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* this pseudo-file is only available with Linux-SGX */
         return -EACCES;
     }
diff --git a/LibOS/shim/src/fs/proc/thread.c b/LibOS/shim/src/fs/proc/thread.c
index e5bbe464..3f7cf6e8 100644
--- a/LibOS/shim/src/fs/proc/thread.c
+++ b/LibOS/shim/src/fs/proc/thread.c
@@ -24,7 +24,7 @@ static int parse_thread_name(const char* name, IDTYPE* pidptr, const char** next
     if (*p == '/')
         p++;
 
-    if (strstartswith_static(p, "self")) {
+    if (strstartswith(p, "self")) {
         p += static_strlen("self");
         if (*p && *p != '/')
             return -ENOENT;
diff --git a/LibOS/shim/src/shim_debug.c b/LibOS/shim/src/shim_debug.c
index 2499e33e..20f0c028 100644
--- a/LibOS/shim/src/shim_debug.c
+++ b/LibOS/shim/src/shim_debug.c
@@ -86,13 +86,11 @@ void append_r_debug(const char* uri, void* addr, void* dyn_addr) {
     if (!new)
         return;
 
-    int uri_len   = strlen(uri);
-    char* new_uri = malloc(uri_len + 1);
+    char* new_uri = strdup(uri);
     if (!new_uri) {
         free(new);
         return;
     }
-    memcpy(new_uri, uri, uri_len + 1);
 
     new->l_addr = addr;
     new->l_ld   = dyn_addr;
diff --git a/LibOS/shim/src/shim_init.c b/LibOS/shim/src/shim_init.c
index 0696a156..be68c848 100644
--- a/LibOS/shim/src/shim_init.c
+++ b/LibOS/shim/src/shim_init.c
@@ -9,6 +9,7 @@
 #include <asm/unistd.h>
 #include <sys/mman.h>
 
+#include "api.h"
 #include "hex.h"
 #include "pal.h"
 #include "pal_debug.h"
@@ -310,7 +311,7 @@ int init_stack(const char** argv, const char** envp, const char*** out_argp,
 
 static int read_environs(const char** envp) {
     for (const char** e = envp; *e; e++) {
-        if (strstartswith_static(*e, "LD_LIBRARY_PATH=")) {
+        if (strstartswith(*e, "LD_LIBRARY_PATH=")) {
             /* populate library_paths with entries from LD_LIBRARY_PATH envvar */
             const char* s = *e + static_strlen("LD_LIBRARY_PATH=");
             size_t npaths = 2; // One for the first entry, one for the last NULL.
@@ -326,16 +327,13 @@ static int read_environs(const char** envp) {
                 const char* next;
                 for (next = s; *next && *next != ':'; next++)
                     ;
-                size_t len = next - s;
-                char* str = malloc(len + 1);
+                char* str = alloc_substr(s, next - s);
                 if (!str) {
                     for (size_t i = 0; i < cnt; i++)
                         free(paths[i]);
                     free(paths);
                     return -ENOMEM;
                 }
-                memcpy(str, s, len);
-                str[len] = 0;
                 paths[cnt++] = str;
                 s = *next ? next + 1 : next;
             }
@@ -710,7 +708,7 @@ static int open_file(const char* path, void* obj) {
 static int open_pal_handle(const char* uri, void* obj) {
     PAL_HANDLE hdl;
 
-    if (strstartswith_static(uri, URI_PREFIX_DEV))
+    if (strstartswith(uri, URI_PREFIX_DEV))
         hdl = DkStreamOpen(uri, 0, PAL_SHARE_OWNER_X | PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_R,
                            PAL_CREATE_TRY | PAL_CREATE_ALWAYS, 0);
     else
diff --git a/LibOS/shim/src/shim_parser.c b/LibOS/shim/src/shim_parser.c
index d53e5836..c5980a78 100644
--- a/LibOS/shim/src/shim_parser.c
+++ b/LibOS/shim/src/shim_parser.c
@@ -467,8 +467,7 @@ static inline int is_pointer(const char* type) {
 }
 
 static inline int is_pointer_or_long(const char* type) {
-    return is_pointer(type) || !strcmp_static(type, "long") ||
-           !strcmp_static(type, "unsigned long");
+    return is_pointer(type) || !strcmp(type, "long") || !strcmp(type, "unsigned long");
 }
 
 #define PRINTF(fmt, ...)                \
@@ -538,7 +537,7 @@ static inline void parse_integer_arg(va_list* ap) {
 static inline void parse_syscall_args(va_list* ap) {
     const char* arg_type = va_arg(*ap, const char*);
 
-    if (!strcmp_static(arg_type, "const char *") || !strcmp_static(arg_type, "const char*"))
+    if (!strcmp(arg_type, "const char *") || !strcmp(arg_type, "const char*"))
         parse_string_arg(ap);
     else if (is_pointer_or_long(arg_type))
         parse_pointer_arg(ap);
@@ -549,7 +548,7 @@ static inline void parse_syscall_args(va_list* ap) {
 static inline void skip_syscall_args(va_list* ap) {
     const char* arg_type = va_arg(*ap, const char*);
 
-    if (!strcmp_static(arg_type, "const char *") || !strcmp_static(arg_type, "const char*"))
+    if (!strcmp(arg_type, "const char *") || !strcmp(arg_type, "const char*"))
         va_arg(*ap, const char*);
     else if (is_pointer_or_long(arg_type))
         va_arg(*ap, void*);
diff --git a/LibOS/shim/src/sys/shim_exec.c b/LibOS/shim/src/sys/shim_exec.c
index 5c5e1f88..4b6d6238 100644
--- a/LibOS/shim/src/sys/shim_exec.c
+++ b/LibOS/shim/src/sys/shim_exec.c
@@ -26,8 +26,7 @@ static int normalize_and_cmp_uris(const char* uri1, const char* uri2) {
     size_t len;
     int ret;
 
-    if (!strstartswith_static(uri1, URI_PREFIX_FILE) ||
-        !strstartswith_static(uri2, URI_PREFIX_FILE))
+    if (!strstartswith(uri1, URI_PREFIX_FILE) || !strstartswith(uri2, URI_PREFIX_FILE))
         return -1;
 
     uri1 += URI_PREFIX_FILE_LEN;
@@ -360,7 +359,7 @@ reopen:
     __atomic_store_n(&first, 0, __ATOMIC_RELAXED);
 
     bool use_same_process = true;
-    if (!strcmp_static(PAL_CB(host_type), "Linux-SGX")) {
+    if (!strcmp(PAL_CB(host_type), "Linux-SGX")) {
         /* for SGX PALs, can use same process only if it is the same executable (because a different
          * executable has a different measurement and thus requires a new enclave); this special
          * case is to correctly handle e.g. Bash process replacing itself */
diff --git a/LibOS/shim/src/sys/shim_socket.c b/LibOS/shim/src/sys/shim_socket.c
index 29abfd45..680d45c5 100644
--- a/LibOS/shim/src/sys/shim_socket.c
+++ b/LibOS/shim/src/sys/shim_socket.c
@@ -580,13 +580,13 @@ static int inet_parse_addr(int domain, int type, const char* uri, struct addr_in
 
     enum { UDP, UDPSRV, TCP, TCPSRV } prefix;
 
-    if (strstartswith_static(uri, URI_PREFIX_UDP))
+    if (strstartswith(uri, URI_PREFIX_UDP))
         prefix = UDP;
-    else if (strstartswith_static(uri, URI_PREFIX_UDP_SRV))
+    else if (strstartswith(uri, URI_PREFIX_UDP_SRV))
         prefix = UDPSRV;
-    else if (strstartswith_static(uri, URI_PREFIX_TCP))
+    else if (strstartswith(uri, URI_PREFIX_TCP))
         prefix = TCP;
-    else if (strstartswith_static(uri, URI_PREFIX_TCP_SRV))
+    else if (strstartswith(uri, URI_PREFIX_TCP_SRV))
         prefix = TCPSRV;
     else
         return -EINVAL;
diff --git a/Pal/include/lib/api.h b/Pal/include/lib/api.h
index 177628a1..e00de392 100644
--- a/Pal/include/lib/api.h
+++ b/Pal/include/lib/api.h
@@ -142,23 +142,19 @@ void* memmove(void* dest, const void* src, size_t count);
 void* memset(void* dest, int ch, size_t count);
 int memcmp(const void* lhs, const void* rhs, size_t count);
 
-bool strendswith(const char* haystack, const char* needle);
+bool strstartswith(const char* str, const char* prefix);
+bool strendswith(const char* str, const char* suffix);
+char* strdup(const char* str);
+char* alloc_substr(const char* start, size_t len);
+char* alloc_concat(const char* a, size_t a_len, const char* b, size_t b_len);
+char* alloc_concat3(const char* a, size_t a_len, const char* b, size_t b_len,
+                    const char* c, size_t c_len);
 
 /* Libc memory allocation functions */
 void* malloc(size_t size);
 void free(void* ptr);
 void* calloc(size_t nmemb, size_t size);
 
-/* check if `var` is exactly the same as a static string */
-#define strcmp_static(var, str) \
-    (memcmp(var, str, MIN(strlen(var), static_strlen(str)) + 1))
-
-/* check if `str` starts with a static string */
-#define strstartswith_static(str, prefix)          \
-    (strlen(str) >= static_strlen(prefix)          \
-     ? !memcmp(str, prefix, static_strlen(prefix)) \
-     : false)
-
 /* copy static string and return the address of the NUL byte (NULL if the dest
  * is not large enough).*/
 #define strcpy_static(var, str, max)                                  \
diff --git a/Pal/lib/Makefile b/Pal/lib/Makefile
index 1108c45a..bf31eb03 100644
--- a/Pal/lib/Makefile
+++ b/Pal/lib/Makefile
@@ -115,10 +115,10 @@ objs += \
 	string/memset.o \
 	string/strchr.o \
 	string/strcmp.o \
-	string/strendswith.o \
 	string/strlen.o \
 	string/strspn.o \
-	string/strstr.o
+	string/strstr.o \
+	string/utils.o
 
 $(addprefix $(target),crypto/adapters/mbedtls_adapter.o crypto/adapters/mbedtls_dh.o crypto/adapters/mbedtls_encoding.o): crypto/mbedtls/crypto/library/aes.c
 
diff --git a/Pal/lib/string/strendswith.c b/Pal/lib/string/strendswith.c
deleted file mode 100644
index ee2492f5..00000000
--- a/Pal/lib/string/strendswith.c
+++ /dev/null
@@ -1,12 +0,0 @@
-#include "api.h"
-
-bool strendswith(const char* haystack, const char* needle) {
-    size_t haystack_len = strlen(haystack);
-    size_t needle_len = strlen(needle);
-
-    if (haystack_len < needle_len) {
-        return false;
-    }
-
-    return !memcmp(&haystack[haystack_len - needle_len], needle, needle_len);
-}
diff --git a/Pal/lib/string/utils.c b/Pal/lib/string/utils.c
new file mode 100644
index 00000000..7299774b
--- /dev/null
+++ b/Pal/lib/string/utils.c
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: LGPL-3.0-or-later */
+/* Copyright (C) 2016 Stony Brook University
+ * Copyright (C) 2020 Invisible Things Lab
+ *                    Borys Popławski <borysp@invisiblethingslab.com>
+ * Copyright (C) 2020 Intel Corporation
+ *                    Michał Kowalczyk <mkow@invisiblethingslab.com>
+ */
+
+#include <stdint.h>
+
+#include "api.h"
+
+char* strdup(const char* str) {
+    return alloc_concat3(str, -1, NULL, 0, NULL, 0);
+}
+
+char* alloc_substr(const char* start, size_t len) {
+    return alloc_concat3(start, len, NULL, 0, NULL, 0);
+}
+
+char* alloc_concat(const char* a, size_t a_len, const char* b, size_t b_len) {
+    return alloc_concat3(a, a_len, b, b_len, NULL, 0);
+}
+
+char* alloc_concat3(const char* a, size_t a_len, const char* b, size_t b_len,
+                    const char* c, size_t c_len) {
+    a_len = (a_len != (size_t)-1) ? a_len : (a ? strlen(a) : 0);
+    b_len = (b_len != (size_t)-1) ? b_len : (b ? strlen(b) : 0);
+    c_len = (c_len != (size_t)-1) ? c_len : (c ? strlen(c) : 0);
+
+    char* buf = malloc(a_len + b_len + c_len + 1);
+    if (!buf)
+        return NULL;
+
+    if (a_len)
+        memcpy(buf, a, a_len);
+    if (b_len)
+        memcpy(buf + a_len, b, b_len);
+    if (c_len)
+        memcpy(buf + a_len + b_len, c, c_len);
+
+    buf[a_len + b_len + c_len] = '\0';
+    return buf;
+}
+
+bool strstartswith(const char* str, const char* prefix) {
+    size_t prefix_len = strlen(prefix);
+    size_t str_len = strnlen(str, prefix_len);
+
+    if (str_len < prefix_len) {
+        return false;
+    }
+
+    return !memcmp(str, prefix, prefix_len);
+}
+
+bool strendswith(const char* str, const char* suffix) {
+    size_t str_len = strlen(str);
+    size_t suffix_len = strlen(suffix);
+
+    if (str_len < suffix_len) {
+        return false;
+    }
+
+    return !memcmp(&str[str_len - suffix_len], suffix, suffix_len);
+}
diff --git a/Pal/src/db_main.c b/Pal/src/db_main.c
index 700f63e7..fa381182 100644
--- a/Pal/src/db_main.c
+++ b/Pal/src/db_main.c
@@ -55,6 +55,8 @@ static void load_libraries(void) {
         }
 }
 
+/* This function leaks memory on failure (and this is non-trivial to fix), but the assumption is
+ * that its failure finishes the execution of the whole process right away. */
 static int insert_envs_from_manifest(const char*** envpp) {
     assert(envpp);
 
@@ -121,18 +123,12 @@ static int insert_envs_from_manifest(const char*** envpp) {
         ptr = &new_envp[(idx == -1) ? nenvs++ : idx];
         memcpy(key + prefix_len, str, len + 1);
         if ((bytes = get_config(store, key, cfgbuf, sizeof(cfgbuf))) > 0) {
-            char* e = malloc(len + bytes + 2);
-            memcpy(e, str, len);
-            e[len] = '=';
-            memcpy(e + len + 1, cfgbuf, bytes + 1);
-            *ptr = e;
+            *ptr = alloc_concat3(str, len, "=", 1, cfgbuf, bytes);
         } else {
-            char* e = malloc(len + 2);
-            memcpy(e, str, len);
-            e[len] = '=';
-            e[len + 1] = 0;
-            *ptr = e;
+            *ptr = alloc_concat(str, len, "=", 1);
         }
+        if (!*ptr)
+            return -PAL_ERROR_NOMEM;
     }
 
     *envpp = new_envp;
@@ -152,16 +148,16 @@ static void set_debug_type(void) {
 
     PAL_HANDLE handle = NULL;
 
-    if (!strcmp_static(cfgbuf, "inline")) {
+    if (!strcmp(cfgbuf, "inline")) {
         ret = _DkStreamOpen(&handle, URI_PREFIX_DEV "tty", PAL_ACCESS_RDWR, 0, 0, 0);
-    } else if (!strcmp_static(cfgbuf, "file")) {
+    } else if (!strcmp(cfgbuf, "file")) {
         ret = get_config(g_pal_state.root_config, "loader.debug_file", cfgbuf, sizeof(cfgbuf));
         if (ret <= 0)
             INIT_FAIL(PAL_ERROR_INVAL, "debug file not specified");
 
         ret = _DkStreamOpen(&handle, cfgbuf, PAL_ACCESS_RDWR, PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W,
                             PAL_CREATE_TRY, 0);
-    } else if (!strcmp_static(cfgbuf, "none")) {
+    } else if (!strcmp(cfgbuf, "none")) {
         ret = 0;
     } else {
         INIT_FAIL(PAL_ERROR_INVAL, "unknown debug type");
@@ -342,11 +338,11 @@ noreturn void pal_main(PAL_NUM instance_id,        /* current instance id */
         size_t exec_strlen = manifest_strlen - 9;
         int success = 0;
         // Try .manifest
-        if (!strcmp_static(&manifest_uri[exec_strlen], ".manifest")) {
+        if (!strcmp(&manifest_uri[exec_strlen], ".manifest")) {
             success = 1;
         } else {
             exec_strlen -= 4;
-            if (!strcmp_static(&manifest_uri[exec_strlen], ".manifest.sgx")) {
+            if (!strcmp(&manifest_uri[exec_strlen], ".manifest.sgx")) {
                 success = 1;
             }
         }
diff --git a/Pal/src/db_rtld.c b/Pal/src/db_rtld.c
index 26d29d32..47d9f2ac 100644
--- a/Pal/src/db_rtld.c
+++ b/Pal/src/db_rtld.c
@@ -882,7 +882,7 @@ void DkDebugAttachBinary(PAL_STR uri, PAL_PTR start_addr) {
     __UNUSED(uri);
     __UNUSED(start_addr);
 #else
-    if (!strstartswith_static(uri, URI_PREFIX_FILE) || !start_addr)
+    if (!strstartswith(uri, URI_PREFIX_FILE) || !start_addr)
         return;
 
     const char* realname = uri + URI_PREFIX_FILE_LEN;
diff --git a/Pal/src/db_streams.c b/Pal/src/db_streams.c
index 19bc2779..0a285d21 100644
--- a/Pal/src/db_streams.c
+++ b/Pal/src/db_streams.c
@@ -71,13 +71,13 @@ static int parse_stream_uri(const char** uri, char** prefix, struct handle_ops**
             static_assert(static_strlen(URI_PREFIX_UDP) == 4, "URI_PREFIX_UDP has unexpected length");
             static_assert(static_strlen(URI_PREFIX_DEV) == 4, "URI_PREFIX_DEV has unexpected length");
 
-            if (strstartswith_static(u, URI_PREFIX_DIR))
+            if (strstartswith(u, URI_PREFIX_DIR))
                 hops = &g_dir_ops;
-            else if (strstartswith_static(u, URI_PREFIX_TCP))
+            else if (strstartswith(u, URI_PREFIX_TCP))
                 hops = &g_tcp_ops;
-            else if (strstartswith_static(u, URI_PREFIX_UDP))
+            else if (strstartswith(u, URI_PREFIX_UDP))
                 hops = &g_udp_ops;
-            else if (strstartswith_static(u, URI_PREFIX_DEV))
+            else if (strstartswith(u, URI_PREFIX_DEV))
                 hops = &g_dev_ops;
             break;
 
@@ -85,9 +85,9 @@ static int parse_stream_uri(const char** uri, char** prefix, struct handle_ops**
             static_assert(static_strlen(URI_PREFIX_FILE) == 5, "URI_PREFIX_FILE has unexpected length");
             static_assert(static_strlen(URI_PREFIX_PIPE) == 5, "URI_PREFIX_PIPE has unexpected length");
 
-            if (strstartswith_static(u, URI_PREFIX_FILE))
+            if (strstartswith(u, URI_PREFIX_FILE))
                 hops = &g_file_ops;
-            else if (strstartswith_static(u, URI_PREFIX_PIPE))
+            else if (strstartswith(u, URI_PREFIX_PIPE))
                 hops = &g_pipe_ops;
             break;
 
@@ -96,18 +96,18 @@ static int parse_stream_uri(const char** uri, char** prefix, struct handle_ops**
             static_assert(static_strlen(URI_PREFIX_UDP_SRV) == 8, "URI_PREFIX_UDP_SRV has unexpected length");
             static_assert(static_strlen(URI_PREFIX_EVENTFD) == 8, "URI_PREFIX_EVENTFD has unexpected length");
 
-            if (strstartswith_static(u, URI_PREFIX_TCP_SRV))
+            if (strstartswith(u, URI_PREFIX_TCP_SRV))
                 hops = &g_tcp_ops;
-            else if (strstartswith_static(u, URI_PREFIX_UDP_SRV))
+            else if (strstartswith(u, URI_PREFIX_UDP_SRV))
                 hops = &g_udp_ops;
-            else if (strstartswith_static(u, URI_PREFIX_EVENTFD))
+            else if (strstartswith(u, URI_PREFIX_EVENTFD))
                 hops = &g_eventfd_ops;
             break;
 
         case 9: ;
             static_assert(static_strlen(URI_PREFIX_PIPE_SRV) == 9, "URI_PREFIX_PIPE_SRV has unexpected length");
 
-            if (strstartswith_static(u, URI_PREFIX_PIPE_SRV))
+            if (strstartswith(u, URI_PREFIX_PIPE_SRV))
                 hops = &g_pipe_ops;
             break;
 
diff --git a/Pal/src/host/Linux-SGX/db_devices.c b/Pal/src/host/Linux-SGX/db_devices.c
index f62d78b1..48e8e56b 100644
--- a/Pal/src/host/Linux-SGX/db_devices.c
+++ b/Pal/src/host/Linux-SGX/db_devices.c
@@ -45,23 +45,22 @@ static const struct handle_ops* g_pal_device_ops[PAL_DEVICE_TYPE_BOUND] = {
 static int parse_device_uri(const char** uri, char** type, struct handle_ops** ops) {
     struct handle_ops* dops = NULL;
     const char* p;
-    const char* u = (*uri);
+    const char* u = *uri;
 
-    for (p = u; (*p) && (*p) != ',' && (*p) != '/'; p++)
+    for (p = u; *p && *p != ',' && *p != '/'; p++)
         ;
 
-    if (strstartswith_static(u, "tty"))
+    if (strstartswith(u, "tty"))
         dops = &g_term_ops;
 
     if (!dops)
         return -PAL_ERROR_NOTSUPPORT;
 
-    *uri = (*p) ? p + 1 : p;
+    *uri = *p ? p + 1 : p;
     if (type) {
-        *type = malloc_copy(u, p - u + 1);
+        *type = alloc_substr(u, p - u);
         if (!*type)
             return -PAL_ERROR_NOMEM;
-        (*type)[p - u] = '\0';
     }
     if (ops)
         *ops = dops;
@@ -108,7 +107,7 @@ static int term_open(PAL_HANDLE* handle, const char* type, const char* uri, int
     assert(WITHIN_MASK(create,  PAL_CREATE_MASK));
     assert(WITHIN_MASK(options, PAL_OPTION_MASK));
 
-    if (strcmp_static(type, "tty"))
+    if (strcmp(type, "tty"))
         return -PAL_ERROR_INVAL;
 
     const char* term  = NULL;
@@ -140,7 +139,7 @@ static int term_close(PAL_HANDLE handle) {
 static int term_attrquery(const char* type, const char* uri, PAL_STREAM_ATTR* attr) {
     __UNUSED(uri);
 
-    if (strcmp_static(type, "tty"))
+    if (strcmp(type, "tty"))
         return -PAL_ERROR_INVAL;
 
     attr->handle_type  = pal_type_dev;
@@ -207,7 +206,7 @@ static int64_t char_write(PAL_HANDLE handle, uint64_t offset, uint64_t size, con
 /* 'open' operation for device streams */
 static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                     int create, int options) {
-    if (strcmp_static(type, URI_TYPE_DEV))
+    if (strcmp(type, URI_TYPE_DEV))
         return -PAL_ERROR_INVAL;
 
     struct handle_ops* ops = NULL;
@@ -316,7 +315,7 @@ static int dev_flush(PAL_HANDLE handle) {
 
 /* 'attrquery' operation for device streams */
 static int dev_attrquery(const char* type, const char* uri, PAL_STREAM_ATTR* attr) {
-    if (strcmp_static(type, URI_TYPE_DEV))
+    if (strcmp(type, URI_TYPE_DEV))
         return -PAL_ERROR_INVAL;
 
     struct handle_ops* ops = NULL;
diff --git a/Pal/src/host/Linux-SGX/db_eventfd.c b/Pal/src/host/Linux-SGX/db_eventfd.c
index 14fbf49a..881de862 100644
--- a/Pal/src/host/Linux-SGX/db_eventfd.c
+++ b/Pal/src/host/Linux-SGX/db_eventfd.c
@@ -44,7 +44,7 @@ static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* ur
     __UNUSED(access);
     __UNUSED(share);
 
-    if ((strcmp_static(type, URI_TYPE_EVENTFD) != 0) || (*uri != '\0')) {
+    if (strcmp(type, URI_TYPE_EVENTFD) != 0 || *uri != '\0') {
         return -PAL_ERROR_INVAL;
     }
 
diff --git a/Pal/src/host/Linux-SGX/db_files.c b/Pal/src/host/Linux-SGX/db_files.c
index 392290c2..fd1b9beb 100644
--- a/Pal/src/host/Linux-SGX/db_files.c
+++ b/Pal/src/host/Linux-SGX/db_files.c
@@ -28,7 +28,7 @@ typedef __kernel_pid_t pid_t;
 /* 'open' operation for file streams */
 static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                      int create, int options) {
-    if (strcmp_static(type, URI_TYPE_FILE))
+    if (strcmp(type, URI_TYPE_FILE))
         return -PAL_ERROR_INVAL;
 
     /* prepare the file handle */
@@ -584,7 +584,7 @@ static int pf_file_attrquery(struct protected_file* pf, int fd_from_attrquery, c
 
 /* 'attrquery' operation for file streams */
 static int file_attrquery(const char* type, const char* uri, PAL_STREAM_ATTR* attr) {
-    if (strcmp_static(type, URI_TYPE_FILE) && strcmp_static(type, URI_TYPE_DIR))
+    if (strcmp(type, URI_TYPE_FILE) && strcmp(type, URI_TYPE_DIR))
         return -PAL_ERROR_INVAL;
 
     /* open the file with O_NONBLOCK to avoid blocking the current thread if it is actually a FIFO
@@ -678,7 +678,7 @@ static int file_attrsetbyhdl(PAL_HANDLE handle, PAL_STREAM_ATTR* attr) {
 }
 
 static int file_rename(PAL_HANDLE handle, const char* type, const char* uri) {
-    if (strcmp_static(type, URI_TYPE_FILE))
+    if (strcmp(type, URI_TYPE_FILE))
         return -PAL_ERROR_INVAL;
 
     char* tmp = strdup(uri);
@@ -740,7 +740,7 @@ struct handle_ops g_file_ops = {
    ended with slashes. dir_open will be called by file_open. */
 static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                     int create, int options) {
-    if (strcmp_static(type, URI_TYPE_DIR))
+    if (strcmp(type, URI_TYPE_DIR))
         return -PAL_ERROR_INVAL;
     if (!WITHIN_MASK(access, PAL_ACCESS_MASK))
         return -PAL_ERROR_INVAL;
@@ -895,7 +895,7 @@ static int dir_delete(PAL_HANDLE handle, int access) {
 }
 
 static int dir_rename(PAL_HANDLE handle, const char* type, const char* uri) {
-    if (strcmp_static(type, URI_TYPE_DIR))
+    if (strcmp(type, URI_TYPE_DIR))
         return -PAL_ERROR_INVAL;
 
     char* tmp = strdup(uri);
diff --git a/Pal/src/host/Linux-SGX/db_main.c b/Pal/src/host/Linux-SGX/db_main.c
index 4325912a..c1ecc233 100644
--- a/Pal/src/host/Linux-SGX/db_main.c
+++ b/Pal/src/host/Linux-SGX/db_main.c
@@ -82,7 +82,7 @@ static struct link_map g_pal_map;
  * fail.
  */
 static PAL_HANDLE setup_dummy_file_handle(const char* name) {
-    if (!strstartswith_static(name, URI_PREFIX_FILE))
+    if (!strstartswith(name, URI_PREFIX_FILE))
         return NULL;
 
     name += URI_PREFIX_FILE_LEN;
diff --git a/Pal/src/host/Linux-SGX/db_pipes.c b/Pal/src/host/Linux-SGX/db_pipes.c
index 68f97ba1..76609325 100644
--- a/Pal/src/host/Linux-SGX/db_pipes.c
+++ b/Pal/src/host/Linux-SGX/db_pipes.c
@@ -345,16 +345,16 @@ static int pipe_open(PAL_HANDLE* handle, const char* type, const char* uri, int
         !WITHIN_MASK(create, PAL_CREATE_MASK) || !WITHIN_MASK(options, PAL_OPTION_MASK))
         return -PAL_ERROR_INVAL;
 
-    if (!strcmp_static(type, URI_TYPE_PIPE) && !*uri)
+    if (!strcmp(type, URI_TYPE_PIPE) && !*uri)
         return pipe_private(handle, options);
 
     if (strlen(uri) + 1 > PIPE_NAME_MAX)
         return -PAL_ERROR_INVAL;
 
-    if (!strcmp_static(type, URI_TYPE_PIPE_SRV))
+    if (!strcmp(type, URI_TYPE_PIPE_SRV))
         return pipe_listen(handle, uri, options);
 
-    if (!strcmp_static(type, URI_TYPE_PIPE))
+    if (!strcmp(type, URI_TYPE_PIPE))
         return pipe_connect(handle, uri, options);
 
     return -PAL_ERROR_INVAL;
diff --git a/Pal/src/host/Linux-SGX/db_process.c b/Pal/src/host/Linux-SGX/db_process.c
index 0022f867..619920af 100644
--- a/Pal/src/host/Linux-SGX/db_process.c
+++ b/Pal/src/host/Linux-SGX/db_process.c
@@ -230,7 +230,7 @@ static int check_child_mr_enclave(PAL_HANDLE child, sgx_measurement_t* mr_enclav
 
 int _DkProcessCreate(PAL_HANDLE* handle, const char* uri, const char** args) {
     /* only access creating process with regular file */
-    if (!strstartswith_static(uri, URI_PREFIX_FILE))
+    if (!strstartswith(uri, URI_PREFIX_FILE))
         return -PAL_ERROR_INVAL;
 
     unsigned int child_pid;
diff --git a/Pal/src/host/Linux-SGX/db_rtld.c b/Pal/src/host/Linux-SGX/db_rtld.c
index c431494c..1763a05c 100644
--- a/Pal/src/host/Linux-SGX/db_rtld.c
+++ b/Pal/src/host/Linux-SGX/db_rtld.c
@@ -186,7 +186,7 @@ void _DkDebugAddMap(struct link_map* map) {
             continue;
         if (s->sh_type == SHT_NULL)
             continue;
-        if (strstartswith_static(shstrtab + s->sh_name, ".debug_"))
+        if (strstartswith(shstrtab + s->sh_name, ".debug_"))
             continue;
 
         if (!debug_map_add_section(debug_map, shstrtab + s->sh_name,
diff --git a/Pal/src/host/Linux-SGX/db_sockets.c b/Pal/src/host/Linux-SGX/db_sockets.c
index ce5cc1c7..466f2690 100644
--- a/Pal/src/host/Linux-SGX/db_sockets.c
+++ b/Pal/src/host/Linux-SGX/db_sockets.c
@@ -386,10 +386,10 @@ static int tcp_open(PAL_HANDLE* handle, const char* type, const char* uri, int a
     char uri_buf[PAL_SOCKADDR_SIZE];
     memcpy(uri_buf, uri, uri_len);
 
-    if (!strcmp_static(type, URI_TYPE_TCP_SRV))
+    if (!strcmp(type, URI_TYPE_TCP_SRV))
         return tcp_listen(handle, uri_buf, create, options);
 
-    if (!strcmp_static(type, URI_TYPE_TCP))
+    if (!strcmp(type, URI_TYPE_TCP))
         return tcp_connect(handle, uri_buf, options);
 
     return -PAL_ERROR_NOTSUPPORT;
@@ -530,10 +530,10 @@ static int udp_open(PAL_HANDLE* hdl, const char* type, const char* uri, int acce
 
     memcpy(buf, uri, len + 1);
 
-    if (!strcmp_static(type, URI_TYPE_UDP_SRV))
+    if (!strcmp(type, URI_TYPE_UDP_SRV))
         return udp_bind(hdl, buf, create, options);
 
-    if (!strcmp_static(type, URI_TYPE_UDP))
+    if (!strcmp(type, URI_TYPE_UDP))
         return udp_connect(hdl, buf, create, options);
 
     return -PAL_ERROR_NOTSUPPORT;
@@ -622,7 +622,7 @@ static int64_t udp_sendbyaddr(PAL_HANDLE handle, uint64_t offset, uint64_t len,
     if (handle->sock.fd == PAL_IDX_POISON)
         return -PAL_ERROR_BADHANDLE;
 
-    if (!strstartswith_static(addr, URI_PREFIX_UDP))
+    if (!strstartswith(addr, URI_PREFIX_UDP))
         return -PAL_ERROR_INVAL;
 
     if (len != (uint32_t)len)
diff --git a/Pal/src/host/Linux-SGX/enclave_framework.c b/Pal/src/host/Linux-SGX/enclave_framework.c
index c5534b4f..cf9f5071 100644
--- a/Pal/src/host/Linux-SGX/enclave_framework.c
+++ b/Pal/src/host/Linux-SGX/enclave_framework.c
@@ -294,7 +294,7 @@ int load_trusted_file(PAL_HANDLE file, sgx_stub_t** stubptr, uint64_t* sizeptr,
     }
 
     /* Normalize the uri */
-    if (!strstartswith_static(uri, URI_PREFIX_FILE)) {
+    if (!strstartswith(uri, URI_PREFIX_FILE)) {
         SGX_DBG(DBG_E, "Invalid URI [%s]: Trusted files must start with 'file:'\n", uri);
         return -PAL_ERROR_INVAL;
     }
@@ -701,41 +701,47 @@ static int register_trusted_file(const char* uri, const char* checksum_str, bool
 }
 
 static int init_trusted_file(const char* key, const char* uri) {
-    char cskey[URI_MAX];
-    char* tmp;
     char checksum[URI_MAX];
-    char normpath[URI_MAX];
+    char normpath[URI_MAX] = URI_PREFIX_FILE;
+    int ret;
 
-    tmp = strcpy_static(cskey, "sgx.trusted_checksum.", URI_MAX);
-    memcpy(tmp, key, strlen(key) + 1);
+    char* cskey = alloc_concat("sgx.trusted_checksum.", -1, key, -1);
+    if (!cskey) {
+        ret = -PAL_ERROR_NOMEM;
+        goto out;
+    }
 
-    ssize_t ret = get_config(g_pal_state.root_config, cskey, checksum, sizeof(checksum));
-    if (ret < 0)
-        return 0;
+    ssize_t conf_ret = get_config(g_pal_state.root_config, cskey, checksum, sizeof(checksum));
+    if (conf_ret < 0) {
+        ret = 0;
+        goto out;
+    }
 
     /* Normalize the uri */
-    if (!strstartswith_static(uri, URI_PREFIX_FILE)) {
+    if (!strstartswith(uri, URI_PREFIX_FILE)) {
         SGX_DBG(DBG_E, "Invalid URI [%s]: Trusted files must start with 'file:'\n", uri);
-        return -PAL_ERROR_INVAL;
+        ret = -PAL_ERROR_INVAL;
+        goto out;
     }
-    static_assert(sizeof(normpath) > URI_PREFIX_FILE_LEN, "`normpath` is too small");
-    memcpy(normpath, URI_PREFIX_FILE, URI_PREFIX_FILE_LEN);
-    size_t len = sizeof(normpath) - URI_PREFIX_FILE_LEN;
+    size_t len = sizeof(normpath) - strlen(normpath);
     ret = get_norm_path(uri + URI_PREFIX_FILE_LEN, normpath + URI_PREFIX_FILE_LEN, &len);
     if (ret < 0) {
         SGX_DBG(DBG_E, "Path (%s) normalization failed: %s\n", uri + URI_PREFIX_FILE_LEN,
                 pal_strerror(ret));
-        return ret;
+        goto out;
     }
 
-    return register_trusted_file(normpath, checksum, /*check_duplicates=*/false);
+    ret = register_trusted_file(normpath, checksum, /*check_duplicates=*/false);
+out:
+    free(cskey);
+    return ret;
 }
 
 int init_trusted_files(void) {
     struct config_store* store = g_pal_state.root_config;
     char* cfgbuf = NULL;
     ssize_t cfgsize;
-    int nuris, ret;
+    int uris_cnt, ret;
     char key[CONFIG_MAX];
     char uri[CONFIG_MAX];
     char* k;
@@ -787,15 +793,15 @@ int init_trusted_files(void) {
         goto out;
     }
 
-    nuris = get_config_entries(store, "sgx.trusted_files", cfgbuf, cfgsize);
-    if (nuris <= 0)
+    uris_cnt = get_config_entries(store, "sgx.trusted_files", cfgbuf, cfgsize);
+    if (uris_cnt <= 0)
         goto no_trusted;
 
     tmp = strcpy_static(key, "sgx.trusted_files.", sizeof(key));
 
     k = cfgbuf;
 
-    for (int i = 0; i < nuris; i++) {
+    for (int i = 0; i < uris_cnt; i++) {
         len = strlen(k);
         memcpy(tmp, k, len + 1);
         k += len + 1;
@@ -820,15 +826,15 @@ no_trusted:
         goto out;
     }
 
-    nuris = get_config_entries(store, "sgx.allowed_files", cfgbuf, cfgsize);
-    if (nuris <= 0)
+    uris_cnt = get_config_entries(store, "sgx.allowed_files", cfgbuf, cfgsize);
+    if (uris_cnt <= 0)
         goto no_allowed;
 
     tmp = strcpy_static(key, "sgx.allowed_files.", sizeof(key));
 
     k = cfgbuf;
 
-    for (int i = 0; i < nuris; i++) {
+    for (int i = 0; i < uris_cnt; i++) {
         len = strlen(k);
         memcpy(tmp, k, len + 1);
         k += len + 1;
@@ -840,7 +846,7 @@ no_trusted:
         /* Normalize the uri */
         char norm_path[URI_MAX];
 
-        if (!strstartswith_static(uri, URI_PREFIX_FILE)) {
+        if (!strstartswith(uri, URI_PREFIX_FILE)) {
             SGX_DBG(DBG_E, "Invalid URI [%s]: Allowed files must start with 'file:'\n", uri);
             ret = -PAL_ERROR_INVAL;
             goto out;
@@ -872,8 +878,10 @@ out:
 int init_trusted_children(void) {
     struct config_store* store = g_pal_state.root_config;
 
-    char key[CONFIG_MAX], mrkey[CONFIG_MAX];
-    char uri[CONFIG_MAX], mr_enclave[CONFIG_MAX];
+    char key[CONFIG_MAX];
+    char mrkey[CONFIG_MAX];
+    char uri[CONFIG_MAX];
+    char mr_enclave[CONFIG_MAX];
 
     char* tmp1 = strcpy_static(key, "sgx.trusted_children.", sizeof(key));
     char* tmp2 = strcpy_static(mrkey, "sgx.trusted_mrenclave.", sizeof(mrkey));
@@ -886,11 +894,11 @@ int init_trusted_children(void) {
     if (!cfgbuf)
         return -PAL_ERROR_NOMEM;
 
-    int nuris = get_config_entries(store, "sgx.trusted_mrenclave", cfgbuf, cfgsize);
-    if (nuris > 0) {
+    int uris_cnt = get_config_entries(store, "sgx.trusted_mrenclave", cfgbuf, cfgsize);
+    if (uris_cnt > 0) {
         char* k = cfgbuf;
-        for (int i = 0; i < nuris; i++) {
-            int len = strlen(k);
+        for (int i = 0; i < uris_cnt; i++) {
+            size_t len = strlen(k);
             memcpy(tmp1, k, len + 1);
             memcpy(tmp2, k, len + 1);
             k += len + 1;
@@ -914,9 +922,9 @@ int init_file_check_policy(void) {
                              cfgbuf, sizeof(cfgbuf));
 
     if (ret > 0) {
-        if (!strcmp_static(cfgbuf, "strict"))
+        if (!strcmp(cfgbuf, "strict"))
             set_file_check_policy(FILE_CHECK_POLICY_STRICT);
-        else if (!strcmp_static(cfgbuf, "allow_all_but_log"))
+        else if (!strcmp(cfgbuf, "allow_all_but_log"))
             set_file_check_policy(FILE_CHECK_POLICY_ALLOW_ALL_BUT_LOG);
         else
             INIT_FAIL(PAL_ERROR_INVAL, "unknown file check policy");
diff --git a/Pal/src/host/Linux-SGX/enclave_pf.c b/Pal/src/host/Linux-SGX/enclave_pf.c
index 7a50f94a..007443c3 100644
--- a/Pal/src/host/Linux-SGX/enclave_pf.c
+++ b/Pal/src/host/Linux-SGX/enclave_pf.c
@@ -195,7 +195,7 @@ struct protected_file* find_protected_file_handle(PAL_HANDLE handle) {
         return NULL;
 
     /* uri is prefixed by "file:", we need path */
-    assert(strstartswith_static(uri, URI_PREFIX_FILE));
+    assert(strstartswith(uri, URI_PREFIX_FILE));
     return find_protected_file(uri + URI_PREFIX_FILE_LEN);
 }
 
@@ -291,7 +291,7 @@ static int register_protected_dir(const char* path) {
         while (pos < returned) {
             dir = (struct linux_dirent64*)((char*)buf + pos);
 
-            if (!strcmp_static(dir->d_name, ".") || !strcmp_static(dir->d_name, ".."))
+            if (!strcmp(dir->d_name, ".") || !strcmp(dir->d_name, ".."))
                 goto next;
 
             /* register file */
@@ -338,7 +338,7 @@ static int register_protected_path(const char* path, struct protected_file** new
     }
 
     /* discard the "file:" prefix */
-    if (strstartswith_static(normpath, URI_PREFIX_FILE))
+    if (strstartswith(normpath, URI_PREFIX_FILE))
         path = normpath + URI_PREFIX_FILE_LEN;
     else
         path = normpath;
@@ -432,7 +432,7 @@ static int register_protected_files(const char* key_prefix) {
         key_suffix += len + 1;
         len = get_config(g_pal_state.root_config, key, uri, CONFIG_MAX);
         if (len > 0) {
-            if (!strstartswith_static(uri, URI_PREFIX_FILE)) {
+            if (!strstartswith(uri, URI_PREFIX_FILE)) {
                 SGX_DBG(DBG_E, "Invalid URI [%s]: URIs of protected files must start with '"
                         URI_PREFIX_FILE "'\n", uri);
             } else {
diff --git a/Pal/src/host/Linux-SGX/sgx_main.c b/Pal/src/host/Linux-SGX/sgx_main.c
index c140515e..c3c3364e 100644
--- a/Pal/src/host/Linux-SGX/sgx_main.c
+++ b/Pal/src/host/Linux-SGX/sgx_main.c
@@ -35,25 +35,8 @@ char* g_libpal_path = NULL;
 
 struct pal_enclave g_pal_enclave;
 
-static inline char* alloc_concat(const char* p, size_t plen, const char* s, size_t slen) {
-    plen = (plen != (size_t)-1) ? plen : (p ? strlen(p) : 0);
-    slen = (slen != (size_t)-1) ? slen : (s ? strlen(s) : 0);
-
-    char* buf = malloc(plen + slen + 1);
-    if (!buf)
-        return NULL;
-
-    if (plen)
-        memcpy(buf, p, plen);
-    if (slen)
-        memcpy(buf + plen, s, slen);
-
-    buf[plen + slen] = '\0';
-    return buf;
-}
-
 static char* resolve_uri(const char* uri, const char** errstring) {
-    if (!strstartswith_static(uri, URI_PREFIX_FILE)) {
+    if (!strstartswith(uri, URI_PREFIX_FILE)) {
         *errstring = "Invalid URI";
         return NULL;
     }
@@ -503,7 +486,7 @@ static int initialize_enclave(struct pal_enclave* enclave) {
 
         void* data = NULL;
 
-        if (!strcmp_static(areas[i].desc, "tls")) {
+        if (!strcmp(areas[i].desc, "tls")) {
             data = (void*)INLINE_SYSCALL(mmap, 6, NULL, areas[i].size, PROT_READ | PROT_WRITE,
                                          MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
             if (IS_ERR_P(data) || data == NULL) {
@@ -535,7 +518,7 @@ static int initialize_enclave(struct pal_enclave* enclave) {
                 }
                 gs->thread = NULL;
             }
-        } else if (!strcmp_static(areas[i].desc, "tcs")) {
+        } else if (!strcmp(areas[i].desc, "tcs")) {
             data = (void*)INLINE_SYSCALL(mmap, 6, NULL, areas[i].size, PROT_READ | PROT_WRITE,
                                          MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
             if (IS_ERR_P(data) || data == NULL) {
@@ -776,10 +759,10 @@ static int load_enclave(struct pal_enclave* enclave, int manifest_fd, char* mani
 #ifdef DEBUG
     size_t env_i = 0;
     while (env_i < env_size) {
-        if (!strcmp_static(&env[env_i], "IN_GDB=1")) {
+        if (!strcmp(&env[env_i], "IN_GDB=1")) {
             SGX_DBG(DBG_I, "[ Running under GDB ]\n");
             pal_sec->in_gdb = true;
-        } else if (strstartswith_static(&env[env_i], "LD_PRELOAD=")) {
+        } else if (strstartswith(&env[env_i], "LD_PRELOAD=")) {
             uint64_t env_i_size = strnlen(&env[env_i], env_size - env_i) + 1;
             memmove(&env[env_i], &env[env_i + env_i_size], env_size - env_i - env_i_size);
             env_size -= env_i_size;
@@ -1002,8 +985,8 @@ int main(int argc, char* argv[], char* envp[]) {
     }
 
     // Are we the first in this Graphene's namespace?
-    bool first_process = !strcmp_static(argv[2], "init");
-    if (!first_process && strcmp_static(argv[2], "child")) {
+    bool first_process = !strcmp(argv[2], "init");
+    if (!first_process && strcmp(argv[2], "child")) {
         goto usage;
     }
 
diff --git a/Pal/src/host/Linux/db_devices.c b/Pal/src/host/Linux/db_devices.c
index 43de1a41..c0143a8b 100644
--- a/Pal/src/host/Linux/db_devices.c
+++ b/Pal/src/host/Linux/db_devices.c
@@ -42,12 +42,13 @@ static const struct handle_ops* g_pal_device_ops[PAL_DEVICE_TYPE_BOUND] = {
    for stream handler wich will open or access the device. */
 static int parse_device_uri(const char** uri, char** type, struct handle_ops** ops) {
     struct handle_ops* dops = NULL;
-    const char *p, *u = (*uri);
+    const char* p;
+    const char* u = *uri;
 
-    for (p = u; (*p) && (*p) != ',' && (*p) != '/'; p++)
+    for (p = u; *p && *p != ',' && *p != '/'; p++)
         ;
 
-    if (strstartswith_static(u, "tty"))
+    if (strstartswith(u, "tty"))
         dops = &g_term_ops;
 
     if (!dops)
@@ -55,10 +56,9 @@ static int parse_device_uri(const char** uri, char** type, struct handle_ops** o
 
     *uri = (*p) ? p + 1 : p;
     if (type) {
-        *type = malloc_copy(u, p - u + 1);
+        *type = alloc_substr(u, p - u);
         if (!*type)
             return -PAL_ERROR_NOMEM;
-        (*type)[p - u] = '\0';
     }
     if (ops)
         *ops = dops;
@@ -100,7 +100,7 @@ static int term_open(PAL_HANDLE* handle, const char* type, const char* uri, int
     __UNUSED(create);
     __UNUSED(options);
 
-    if (strcmp_static(type, "tty"))
+    if (strcmp(type, "tty"))
         return -PAL_ERROR_INVAL;
 
     assert(WITHIN_MASK(access,  PAL_ACCESS_MASK));
@@ -138,7 +138,7 @@ static int term_close(PAL_HANDLE handle) {
 static int term_attrquery(const char* type, const char* uri, PAL_STREAM_ATTR* attr) {
     __UNUSED(uri);
 
-    if (strcmp_static(type, "tty"))
+    if (strcmp(type, "tty"))
         return -PAL_ERROR_INVAL;
 
     attr->handle_type  = pal_type_dev;
@@ -207,7 +207,7 @@ static int64_t char_write(PAL_HANDLE handle, uint64_t offset, uint64_t size, con
 /* 'open' operation for device streams */
 static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                     int create, int options) {
-    if (strcmp_static(type, URI_TYPE_DEV))
+    if (strcmp(type, URI_TYPE_DEV))
         return -PAL_ERROR_INVAL;
 
     struct handle_ops* ops = NULL;
@@ -344,7 +344,7 @@ static int dev_flush(PAL_HANDLE handle) {
 
 /* 'attrquery' operation for device streams */
 static int dev_attrquery(const char* type, const char* uri, PAL_STREAM_ATTR* attr) {
-    if (strcmp_static(type, URI_TYPE_DEV))
+    if (strcmp(type, URI_TYPE_DEV))
         return -PAL_ERROR_INVAL;
 
     struct handle_ops* ops = NULL;
diff --git a/Pal/src/host/Linux/db_eventfd.c b/Pal/src/host/Linux/db_eventfd.c
index 8e1b6dd4..06260460 100644
--- a/Pal/src/host/Linux/db_eventfd.c
+++ b/Pal/src/host/Linux/db_eventfd.c
@@ -46,7 +46,7 @@ static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* ur
     __UNUSED(access);
     __UNUSED(share);
 
-    if ((strcmp_static(type, URI_TYPE_EVENTFD) != 0) || (*uri != '\0')) {
+    if (strcmp(type, URI_TYPE_EVENTFD) != 0 || *uri != '\0') {
         return -PAL_ERROR_INVAL;
     }
 
diff --git a/Pal/src/host/Linux/db_files.c b/Pal/src/host/Linux/db_files.c
index c227ccd0..66a475d9 100644
--- a/Pal/src/host/Linux/db_files.c
+++ b/Pal/src/host/Linux/db_files.c
@@ -25,7 +25,7 @@ typedef __kernel_pid_t pid_t;
 /* 'open' operation for file streams */
 static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                      int create, int options) {
-    if (strcmp_static(type, URI_TYPE_FILE))
+    if (strcmp(type, URI_TYPE_FILE))
         return -PAL_ERROR_INVAL;
 
     assert(WITHIN_MASK(access,  PAL_ACCESS_MASK));
@@ -218,7 +218,7 @@ static inline void file_attrcopy(PAL_STREAM_ATTR* attr, struct stat* stat) {
 
 /* 'attrquery' operation for file streams */
 static int file_attrquery(const char* type, const char* uri, PAL_STREAM_ATTR* attr) {
-    if (strcmp_static(type, URI_TYPE_FILE) && strcmp_static(type, URI_TYPE_DIR))
+    if (strcmp(type, URI_TYPE_FILE) && strcmp(type, URI_TYPE_DIR))
         return -PAL_ERROR_INVAL;
 
     struct stat stat_buf;
@@ -258,7 +258,7 @@ static int file_attrsetbyhdl(PAL_HANDLE handle, PAL_STREAM_ATTR* attr) {
 }
 
 static int file_rename(PAL_HANDLE handle, const char* type, const char* uri) {
-    if (strcmp_static(type, URI_TYPE_FILE))
+    if (strcmp(type, URI_TYPE_FILE))
         return -PAL_ERROR_INVAL;
 
     char* tmp = strdup(uri);
@@ -320,7 +320,7 @@ struct handle_ops g_file_ops = {
    ended with slashes. dir_open will be called by file_open. */
 static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                     int create, int options) {
-    if (strcmp_static(type, URI_TYPE_DIR))
+    if (strcmp(type, URI_TYPE_DIR))
         return -PAL_ERROR_INVAL;
     if (!WITHIN_MASK(access, PAL_ACCESS_MASK))
         return -PAL_ERROR_INVAL;
@@ -500,7 +500,7 @@ static int dir_delete(PAL_HANDLE handle, int access) {
 }
 
 static int dir_rename(PAL_HANDLE handle, const char* type, const char* uri) {
-    if (strcmp_static(type, URI_TYPE_DIR))
+    if (strcmp(type, URI_TYPE_DIR))
         return -PAL_ERROR_INVAL;
 
     char* tmp = strdup(uri);
diff --git a/Pal/src/host/Linux/db_main.c b/Pal/src/host/Linux/db_main.c
index 81a4400f..4309d64f 100644
--- a/Pal/src/host/Linux/db_main.c
+++ b/Pal/src/host/Linux/db_main.c
@@ -67,7 +67,7 @@ static void read_args_from_stack(void* initial_rsp, int* out_argc, const char***
     const char** e = envp;
     for (; *e; e++) {
 #ifdef DEBUG
-        if (!strcmp_static(*e, "IN_GDB=1"))
+        if (!strcmp(*e, "IN_GDB=1"))
             g_linux_state.in_gdb = true;
 #endif
     }
@@ -170,8 +170,8 @@ noreturn void pal_linux_main(void* initial_rsp, void* fini_callback) {
         print_usage_and_exit(argv[0]);  // may be NULL!
 
     // Are we the first in this Graphene's namespace?
-    bool first_process = !strcmp_static(argv[2], "init");
-    if (!first_process && strcmp_static(argv[2], "child")) {
+    bool first_process = !strcmp(argv[2], "init");
+    if (!first_process && strcmp(argv[2], "child")) {
         print_usage_and_exit(argv[0]);
     }
 
diff --git a/Pal/src/host/Linux/db_pipes.c b/Pal/src/host/Linux/db_pipes.c
index efe28d3d..b3bd09c9 100644
--- a/Pal/src/host/Linux/db_pipes.c
+++ b/Pal/src/host/Linux/db_pipes.c
@@ -256,16 +256,16 @@ static int pipe_open(PAL_HANDLE* handle, const char* type, const char* uri, int
         !WITHIN_MASK(create, PAL_CREATE_MASK) || !WITHIN_MASK(options, PAL_OPTION_MASK))
         return -PAL_ERROR_INVAL;
 
-    if (!strcmp_static(type, URI_TYPE_PIPE) && !*uri)
+    if (!strcmp(type, URI_TYPE_PIPE) && !*uri)
         return pipe_private(handle, options);
 
     if (strlen(uri) + 1 > PIPE_NAME_MAX)
         return -PAL_ERROR_INVAL;
 
-    if (!strcmp_static(type, URI_TYPE_PIPE_SRV))
+    if (!strcmp(type, URI_TYPE_PIPE_SRV))
         return pipe_listen(handle, uri, options);
 
-    if (!strcmp_static(type, URI_TYPE_PIPE))
+    if (!strcmp(type, URI_TYPE_PIPE))
         return pipe_connect(handle, uri, options);
 
     return -PAL_ERROR_INVAL;
diff --git a/Pal/src/host/Linux/db_sockets.c b/Pal/src/host/Linux/db_sockets.c
index 96940928..03134546 100644
--- a/Pal/src/host/Linux/db_sockets.c
+++ b/Pal/src/host/Linux/db_sockets.c
@@ -486,10 +486,10 @@ static int tcp_open(PAL_HANDLE* handle, const char* type, const char* uri, int a
     char uri_buf[PAL_SOCKADDR_SIZE];
     memcpy(uri_buf, uri, uri_len);
 
-    if (!strcmp_static(type, URI_TYPE_TCP_SRV))
+    if (!strcmp(type, URI_TYPE_TCP_SRV))
         return tcp_listen(handle, uri_buf, create, options);
 
-    if (!strcmp_static(type, URI_TYPE_TCP))
+    if (!strcmp(type, URI_TYPE_TCP))
         return tcp_connect(handle, uri_buf, options);
 
     return -PAL_ERROR_NOTSUPPORT;
@@ -699,10 +699,10 @@ static int udp_open(PAL_HANDLE* hdl, const char* type, const char* uri, int acce
 
     memcpy(buf, uri, len + 1);
 
-    if (!strcmp_static(type, URI_TYPE_UDP_SRV))
+    if (!strcmp(type, URI_TYPE_UDP_SRV))
         return udp_bind(hdl, buf, create, options);
 
-    if (!strcmp_static(type, URI_TYPE_UDP))
+    if (!strcmp(type, URI_TYPE_UDP))
         return udp_connect(hdl, buf, create, options);
 
     return -PAL_ERROR_NOTSUPPORT;
@@ -820,7 +820,7 @@ static int64_t udp_sendbyaddr(PAL_HANDLE handle, uint64_t offset, size_t len, co
     if (handle->sock.fd == PAL_IDX_POISON)
         return -PAL_ERROR_BADHANDLE;
 
-    if (!strstartswith_static(addr, URI_PREFIX_UDP))
+    if (!strstartswith(addr, URI_PREFIX_UDP))
         return -PAL_ERROR_INVAL;
 
     addr += static_strlen(URI_PREFIX_UDP);
diff --git a/Pal/src/host/Skeleton/db_devices.c b/Pal/src/host/Skeleton/db_devices.c
index c197b66a..944ed291 100644
--- a/Pal/src/host/Skeleton/db_devices.c
+++ b/Pal/src/host/Skeleton/db_devices.c
@@ -41,7 +41,7 @@ static int parse_device_uri(const char** uri, char** type, struct handle_ops** o
     for (p = u; *p && *p != ',' && *p != '/'; p++)
         ;
 
-    if (strstartswith_static(u, "tty"))
+    if (strstartswith(u, "tty"))
         dops = &g_term_ops;
 
     if (!dops)
@@ -49,10 +49,9 @@ static int parse_device_uri(const char** uri, char** type, struct handle_ops** o
 
     *uri = *p ? p + 1 : p;
     if (type) {
-        *type = malloc_copy(u, p - u + 1);
+        *type = alloc_substr(u, p - u);
         if (!*type)
             return -PAL_ERROR_NOMEM;
-        (*type)[p - u] = '\0';
     }
     if (ops)
         *ops = dops;
diff --git a/Pal/src/host/Skeleton/db_pipes.c b/Pal/src/host/Skeleton/db_pipes.c
index d4836647..c8a927aa 100644
--- a/Pal/src/host/Skeleton/db_pipes.c
+++ b/Pal/src/host/Skeleton/db_pipes.c
@@ -30,16 +30,16 @@ static int pipe_private(PAL_HANDLE* handle, int options) {
 
 static int pipe_open(PAL_HANDLE* handle, const char* type, const char* uri, int access, int share,
                      int create, int options) {
-    if (!strcmp_static(type, URI_TYPE_PIPE) && !*uri)
+    if (!strcmp(type, URI_TYPE_PIPE) && !*uri)
         return pipe_private(handle, options);
 
     if (strlen(uri) + 1 > PIPE_NAME_MAX)
         return -PAL_ERROR_INVAL;
 
-    if (!strcmp_static(type, URI_TYPE_PIPE_SRV))
+    if (!strcmp(type, URI_TYPE_PIPE_SRV))
         return pipe_listen(handle, uri, options);
 
-    if (!strcmp_static(type, URI_TYPE_PIPE))
+    if (!strcmp(type, URI_TYPE_PIPE))
         return pipe_connect(handle, uri, options);
 
     return -PAL_ERROR_INVAL;
diff --git a/Pal/src/host/Skeleton/db_sockets.c b/Pal/src/host/Skeleton/db_sockets.c
index 17a45f2e..719fc390 100644
--- a/Pal/src/host/Skeleton/db_sockets.c
+++ b/Pal/src/host/Skeleton/db_sockets.c
@@ -42,10 +42,10 @@ static int tcp_open(PAL_HANDLE* handle, const char* type, const char* uri, int a
     char uri_buf[PAL_SOCKADDR_SIZE];
     memcpy(uri_buf, uri, uri_len);
 
-    if (!strcmp_static(type, URI_TYPE_TCP_SRV))
+    if (!strcmp(type, URI_TYPE_TCP_SRV))
         return tcp_listen(handle, uri_buf, create);
 
-    if (!strcmp_static(type, URI_TYPE_TCP))
+    if (!strcmp(type, URI_TYPE_TCP))
         return tcp_connect(handle, uri_buf, create);
 
     return -PAL_ERROR_NOTSUPPORT;
@@ -81,10 +81,10 @@ static int udp_open(PAL_HANDLE* hdl, const char* type, const char* uri, int acce
 
     memcpy(buf, uri, len + 1);
 
-    if (!strcmp_static(type, URI_TYPE_UDP_SRV))
+    if (!strcmp(type, URI_TYPE_UDP_SRV))
         return udp_bind(hdl, buf, create);
 
-    if (!strcmp_static(type, URI_TYPE_UDP))
+    if (!strcmp(type, URI_TYPE_UDP))
         return udp_connect(hdl, buf);
 
     return -PAL_ERROR_NOTSUPPORT;
diff --git a/Pal/src/pal_internal.h b/Pal/src/pal_internal.h
index 3296501d..569a4d07 100644
--- a/Pal/src/pal_internal.h
+++ b/Pal/src/pal_internal.h
@@ -305,7 +305,6 @@ void init_slab_mgr(int alignment);
 void* malloc(size_t size);
 void* malloc_copy(const void* mem, size_t size);
 void* calloc(size_t nmem, size_t size);
-char* strdup(const char* source);
 void free(void* mem);
 
 #ifdef __GNUC__
diff --git a/Pal/src/slab.c b/Pal/src/slab.c
index 17ffc8d6..16bac38c 100644
--- a/Pal/src/slab.c
+++ b/Pal/src/slab.c
@@ -120,16 +120,6 @@ void* malloc_copy(const void* mem, size_t size) {
     return nmem;
 }
 
-char* strdup(const char* s) {
-    size_t len = strlen(s) + 1;
-    char* new  = malloc(len);
-
-    if (new)
-        memcpy(new, s, len);
-
-    return new;
-}
-
 void* calloc(size_t nmem, size_t size) {
     void* ptr = malloc(nmem * size);