stelftools: cross-architecture static library detector for IoT malware
summary
SLS Tools identifies statically linked library functions inside IoT binaries by combining signature pattern matching with branch-target analysis, call-dependency filtering and link-order reconstruction, and it outputs simple text results and plugins for IDA, Ghidra and dynamic tracing. It ships with 700+ toolchain patterns, supports 17 architectures, and recovers library function names even after symbol stripping. Empirical demos on BusyBox/uClibc-style builds show higher identification rates than FLIRT-like or BDiff approaches.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 6:27Command-line demo
- 13:34Ghidra plugin demo
- 16:11Dynamic analysis
- 20:45Packed binaries demo
- 22:31High-accuracy detection
- 33:11Summary
- 33:53Q&A
related talks
28mCOFI break
30mEnhancing CTI Processes with Code Search Technology
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
32mOpen Source C/C++ Embedded Toolchains Using LLVM
25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSH
32mApplied static firmware analysis in a CI environment for increased safety and code review insights
21mDeveloping secure applications
24mSymbiotic: finding bugs in C programs