Applied static firmware analysis in a CI environment for increased safety and code review insights
summary
Proposes adding ELF-based static analysis into CI to catch stack overflows before hardware testing, using Zephyr plus pancover to parse ELF/map files, GCC -fstack-usage output and a pancover JSON export to separate analysis from UI. Builds a web diff/trends viewer that shows per-function worst-case stack growth across releases and flags threads exceeding configured sizes; demo shows a USB/CAN build where kernel RAM and stacks grow by kilobytes and one thread is ~500 bytes from overflow. Targets ARM/RISC-V; goal is CI warning on near-overflow and automated errors for regressions.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:35Stack overflow in embedded firmware
- 5:09Memory analysis tools
- 7:18Introducing puncov
- 11:11Improving puncov
- 13:56Dynamic call analysis in puncov
- 14:59Separating analysis and visualization
- 16:05Live demo: memory footprint
- 22:41Future directions
- 26:31Summary
- 27:15Q&A
related talks
21mSecurity Features status update
21mDeveloping secure applications
43mEverything I learned about static analysis and program safety in C++
59mBeyond Sanitizers...
01h 34mA Little Introduction to Control Flow Integrity in C++
54mSecurity Features status update
36mExploiting Buffer Overflows on RISC-V
29mSecuring C code that seems to work just fine