AwesomeREA.org

Tool

basefind2

Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind. It searches the gaps between sorted pointer values for a run of consecutive gaps between string offsets, takes each match as a candidate base, and scores it by the share of sampled strings whose rebased address also appears as a pointer. The README's example finds the correct base of one image in about 26 seconds.

Targets
Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The whole tool is basefind2.py; the reviewed main commit of 2022-05-02 is the last of six commits made between 2022-04-07 and 2022-05-02, and there are no releases, tags or packages. It needs only Python 3 and its standard library.
  • Input is a flat image supplied by the user; no firmware or samples are included. Pointers are read as little-endian 32-bit words at 4-byte alignment, with no big-endian or 64-bit option. Strings are runs of at least 10 printable ASCII characters, tabs or line breaks (-sl), a match needs 10 consecutive gaps by default (-dl), and scoring samples every 20th string (-s). The whole file is read into memory.
  • Output lists each candidate base with its sampled match percentage, and the analyst must choose and confirm one. The README's only example raises -dl to 40 and reports the correct base of one image at 81.64% after about 26 seconds. There are no tests or CI, the README gives no comparison with rbasefind or basefind.py on shared images, and this review scanned no files.
  • MIT License (2022, soyer). Analyzed firmware keeps its own terms.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · soyersoyer/basefind2 · Revision 370d0dd
  2. basefind2.py GitHub · soyersoyer/basefind2 · Revision 370d0dd
  3. LICENSE GitHub · soyersoyer/basefind2 · Revision 370d0dd
  4. README.md GitHub · sgayou/rbasefind · Revision a661118

More in Firmware and hardware

All 65 entries in Firmware and hardware