AwesomeREA.org

Tool

allyourbase

Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. Instead of trying each base in turn, it computes the overlap as an FFT cross-correlation modulo several pairwise-coprime numbers and recovers the base with the Chinese remainder theorem, which keeps 64-bit address spaces tractable. The author keeps it small so that analysts can swap in their own heuristic, such as matching absolute call targets with the instructions that follow returns.

Targets
Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The whole tool is allyourbase.py; the reviewed main commit of 2025-03-07 only added comments to code written in April 2023, and there are no releases, tags or packages. It needs Python 3 with NumPy (requirements.txt: numpy>=1).
  • Input is a raw image supplied by the user; no firmware or samples are included. -l, the pointer length in bytes, is required; -e selects endianness (little by default), -a the alignment (the pointer length by default), -n the minimum string length in code points (5 by default) and -f a slack factor that trades speed and memory for accuracy. Only NUL-terminated UTF-8 strings count. The README says memory grows linearly with file size with a high constant factor, so images of tens of megabytes are the practical range.
  • It prints a single best offset, which may be negative, or reports that none was found; there is no candidate ranking or confidence score, and the README models stray pointer matches as noise that the slack factor lowers. The README's only example runs on /usr/bin/ls rather than a firmware image. There are no tests or CI, and this review scanned no files.
  • MIT License (2023, 8051Enthusiast). Analyzed firmware keeps its own terms. The README calls it similar to rbasefind but gives no comparison on shared images.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 8051Enthusiast/allyourbase · Revision 78e98f7
  2. allyourbase.py GitHub · 8051Enthusiast/allyourbase · Revision 78e98f7
  3. requirements.txt GitHub · 8051Enthusiast/allyourbase · Revision 78e98f7
  4. LICENSE GitHub · 8051Enthusiast/allyourbase · Revision 78e98f7

More in Firmware and hardware

All 65 entries in Firmware and hardware