{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/allyourbase.py",
    "https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/requirements.txt",
    "https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/LICENSE"
  ],
  "category": "firmware",
  "description_en": "Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. Instead of trying each base in turn, it computes the overlap as an FFT cross-correlation modulo several pairwise-coprime numbers and recovers the base with the Chinese remainder theorem, which keeps 64-bit address spaces tractable. The author keeps it small so that analysts can swap in their own heuristic, such as matching absolute call targets with the instructions that follow returns.",
  "description_zh": "一个 Python 脚本，通过比较字符串地址与每个可能指针的目标地址来估算固件镜像的基址，支持任意指针长度和两种字节序。它不逐个尝试基址，而是在几个两两互素的模数下用 FFT 计算互相关来衡量重叠程度，再用中国剩余定理还原基址，因此也能处理 64 位地址空间。作者有意保持代码简短，方便分析者换用自己的启发式方法，例如把绝对调用的目标与返回指令之后的位置对应起来。",
  "entry_url": "https://awesomerea.org/resources/allyourbase/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/allyourbase/",
  "evidence_url": "https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/README.md",
  "group": "tools",
  "id": "allyourbase",
  "json_url": "https://awesomerea.org/resources/allyourbase/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/allyourbase/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/allyourbase/index.md",
  "name": "allyourbase",
  "name_zh": "allyourbase 固件基址估算脚本",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The whole tool is allyourbase.py; the reviewed main commit of 2025-03-07 only added comments to code written in April 2023, and there are no releases, tags or packages. It needs Python 3 with NumPy (requirements.txt: numpy>=1).",
    "Input is a raw image supplied by the user; no firmware or samples are included. -l, the pointer length in bytes, is required; -e selects endianness (little by default), -a the alignment (the pointer length by default), -n the minimum string length in code points (5 by default) and -f a slack factor that trades speed and memory for accuracy. Only NUL-terminated UTF-8 strings count. The README says memory grows linearly with file size with a high constant factor, so images of tens of megabytes are the practical range.",
    "It prints a single best offset, which may be negative, or reports that none was found; there is no candidate ranking or confidence score, and the README models stray pointer matches as noise that the slack factor lowers. The README's only example runs on /usr/bin/ls rather than a firmware image. There are no tests or CI.",
    "MIT License (2023, 8051Enthusiast). Analyzed firmware keeps its own terms. The README calls it similar to rbasefind but gives no comparison on shared images."
  ],
  "requirements_zh": [
    "整个工具就是 allyourbase.py；所审阅的 main 分支 2025-03-07 提交只为 2023 年 4 月编写的代码添加了注释，没有发布版本、标签或软件包。需要 Python 3 及 NumPy（requirements.txt：numpy>=1）。",
    "输入是使用者提供的原始镜像；仓库不含任何固件或样例。必须用 -l 指定以字节计的指针长度；-e 选择字节序（默认小端），-a 指定对齐（默认等于指针长度），-n 指定以码位计的最短字符串长度（默认 5），-f 是以速度和内存换取准确度的松弛系数。只统计以 NUL 结尾的 UTF-8 字符串。README 称内存占用随文件大小线性增长且常数因子较高，因此实际适用于几十 MB 的镜像。",
    "它只输出一个最佳偏移（可能为负），或报告未找到；没有候选排序或置信度分数，README 将错误指针的偶然匹配视为噪声，可由松弛系数压低。README 唯一的示例针对 /usr/bin/ls，而非固件镜像。项目没有测试或 CI。",
    "采用 MIT 许可证（2023 年，8051Enthusiast）。被分析的固件适用其自身条款。README 称其与 rbasefind 类似，但没有在相同镜像上进行比较。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/8051Enthusiast/allyourbase",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}