AwesomeREA.org

Tool

binbloom

Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. It guesses endianness from how the high bytes of pointer-sized values cluster under each byte order, and ranks candidate loading (base) addresses by how many values would then point at indexed text strings and pointer arrays. Given a base address, it also searches automotive ECU firmware for a table of Unified Diagnostic Services (UDS) command IDs and prints the inferred structure layout for use in a disassembler.

Requirements & limits

  • Latest release at review: v2.1, published 2024-06-06 and tagged at the master head, commit 95cfaac from 2022-11-07, whose source reports version 2.1.0. The release adds a -m option for base-address alignment and fixes a crash on very small files and null-pointer and floating-point errors; configure.ac and the man page still say 2.0, and master has no later commits.
  • The README documents a Linux-only source build with autoreconf, configure, make and make install; configure.ac needs a C compiler, libm and pthreads. The release attaches no prebuilt binaries.
  • Each run takes one raw firmware dump supplied by the user and assumes a 32-bit target unless -a 64 is given. The README warns that endianness detection may be unreliable below about 10 KB and offers -e to force it; -t adds threads, -f takes a file of known function addresses, and the experimental -d deep search is slower. Output is a ranked list of candidate base addresses, sometimes marked not sure, and the UDS search runs only when -b supplies the base address.
  • The README calls the UDS search heuristic and prone to false positives, so each candidate table has to be checked by hand. The repository contains no tests or sample firmware and publishes no accuracy results.
  • Apache-2.0. Nothing was built and no firmware was analyzed.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · quarkslab/binbloom · Revision 95cfaac
  2. man/binbloom.1 GitHub · quarkslab/binbloom · Revision 95cfaac
  3. configure.ac GitHub · quarkslab/binbloom · Revision 95cfaac
  4. src/binbloom.c#L1197-L1259 GitHub · quarkslab/binbloom · Revision 95cfaac
  5. src/binbloom.c#L1422-L1443 GitHub · quarkslab/binbloom · Revision 95cfaac
  6. LICENSE GitHub · quarkslab/binbloom · Revision 95cfaac
  7. https://github.com/quarkslab/binbloom/releases/tag/v2.1

More in Firmware and hardware

All 29 entries in Firmware and hardware