Security assessments for IoT devices and embedded Linux systems have long relied on two main approaches: manual static inspection or full dynamic emulation (QEMU, Unicorn, Firmadyne, FirmAE).

Dynamic analysis is invaluable for verifying vulnerabilities, but plugging emulated environments into automated CI/CD pipelines often leads to:

High execution overhead and slow feedback loops.

Architecture incompatibilities : custom NVRAM, vendor peripherals and proprietary SoC hardware are exactly where generic emulators tend to break.

Flaky automation that stalls pull requests.

To bridge this gap I built firmware-auditor : a fast, zero-emulation static analysis framework for unpacked root filesystem images.

The Core Idea: Reproducible Static Posture

When you have an unpacked SquashFS, ext4 or UBIFS rootfs, many security posture indicators can be checked entirely offline, without executing a single target binary:

ELF binary hardening: are binaries built with modern mitigations, or exposed to classic…