# allyourbase

> Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. Instead of trying each base in turn, it computes the overlap as an FFT cross-correlation modulo several pairwise-coprime numbers and recovers the base with the Chinese remainder theorem, which keeps 64-bit address spaces tractable. The author keeps it small so that analysts can swap in their own heuristic, such as matching absolute call targets with the instructions that follow returns.

- Type: Tool
- Targets: Firmware
- Category: Firmware tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/8051Enthusiast/allyourbase>
- Primary source: <https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/README.md>
- Catalog page: <https://awesomerea.org/resources/allyourbase/>
- Record JSON: <https://awesomerea.org/resources/allyourbase/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/allyourbase/index.md)

## Requirements & limits

- The whole tool is allyourbase.py; the reviewed main commit of 2025-03-07 only added comments to code written in April 2023, and there are no releases, tags or packages. It needs Python 3 with NumPy (requirements.txt: numpy>=1).
- Input is a raw image supplied by the user; no firmware or samples are included. -l, the pointer length in bytes, is required; -e selects endianness (little by default), -a the alignment (the pointer length by default), -n the minimum string length in code points (5 by default) and -f a slack factor that trades speed and memory for accuracy. Only NUL-terminated UTF-8 strings count. The README says memory grows linearly with file size with a high constant factor, so images of tens of megabytes are the practical range.
- It prints a single best offset, which may be negative, or reports that none was found; there is no candidate ranking or confidence score, and the README models stray pointer matches as noise that the slack factor lowers. The README's only example runs on /usr/bin/ls rather than a firmware image. There are no tests or CI.
- MIT License (2023, 8051Enthusiast). Analyzed firmware keeps its own terms. The README calls it similar to rbasefind but gives no comparison on shared images.

## Primary sources

1. <https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/README.md>
2. <https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/allyourbase.py>
3. <https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/requirements.txt>
4. <https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/LICENSE>

## More in Firmware and hardware

- [ghidra_kernelcache](https://awesomerea.org/resources/ghidra-kernelcache/index.md) · Tool
- [esp32_image_parser](https://awesomerea.org/resources/esp32-image-parser/index.md) · Tool
- [Tigard](https://awesomerea.org/resources/tigard/index.md) · Tool
- [UBI Reader](https://awesomerea.org/resources/ubi-reader/index.md) · Tool
- [payload-dumper-go](https://awesomerea.org/resources/payload-dumper-go/index.md) · Tool
- [mithril](https://awesomerea.org/resources/mithril-iot-scanner/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.