AwesomeREA.org

Tool

rbasefind

Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp. It records the offsets of ASCII strings, reads every 32-bit word as a possible pointer, and ranks candidate base addresses by how many strings each one would turn into pointer targets. The README calls it a simple heuristic that works rather well on some ARM (non-Thumb) binaries and will not work miracles.

Targets
Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest tag at review: v0.1.3, on the reviewed master commit of 2020-09-27, with no GitHub release binaries and no crates.io package. Build it from source with Cargo; Cargo.toml declares no edition and Cargo.lock is ignored, so dependencies such as clap 2.33 and regex 1.3 resolve within their version ranges at build time. The README's TODO lists an automatic mode that would detect endianness and narrow the offset around the best match.
  • Input is a flat 32-bit image supplied by the user, little-endian by default or big-endian with -b; no firmware or samples are included. By default it takes NUL-terminated printable ASCII strings of at least 10 characters, reads 4-byte-aligned words from the start of the file as pointers, and tests candidate bases every 0x1000 bytes across the 32-bit address space, splitting the range across one thread per CPU core. The whole file is loaded into memory.
  • Results are a ranked list of candidate bases with match counts, 10 by default, that the analyst must confirm. The README's example takes about 41 seconds on 8 threads for one image and shows that raising the minimum string length to 100 cuts the time at some cost in accuracy. Unit tests cover only the address-range split between threads, there is no CI, and this review scanned no files.
  • MIT License (2017, Scott Gayou). Analyzed firmware keeps its own terms.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · sgayou/rbasefind · Revision a661118
  2. src/lib.rs GitHub · sgayou/rbasefind · Revision a661118
  3. src/main.rs GitHub · sgayou/rbasefind · Revision a661118
  4. Cargo.toml GitHub · sgayou/rbasefind · Revision a661118
  5. .gitignore GitHub · sgayou/rbasefind · Revision a661118
  6. LICENSE GitHub · sgayou/rbasefind · Revision a661118
  7. https://github.com/sgayou/rbasefind/releases/tag/v0.1.3

More in Firmware and hardware

All 65 entries in Firmware and hardware