Tool
basefind2
Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind. It searches the gaps between sorted pointer values for a run of consecutive gaps between string offsets, takes each match as a candidate base, and scores it by the share of sampled strings whose rebased address also appears as a pointer. The README's example finds the correct base of one image in about 26 seconds.
- Targets
- Firmware
- Category
- Firmware tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- The whole tool is basefind2.py; the reviewed main commit of 2022-05-02 is the last of six commits made between 2022-04-07 and 2022-05-02, and there are no releases, tags or packages. It needs only Python 3 and its standard library.
- Input is a flat image supplied by the user; no firmware or samples are included. Pointers are read as little-endian 32-bit words at 4-byte alignment, with no big-endian or 64-bit option. Strings are runs of at least 10 printable ASCII characters, tabs or line breaks (-sl), a match needs 10 consecutive gaps by default (-dl), and scoring samples every 20th string (-s). The whole file is read into memory.
- Output lists each candidate base with its sampled match percentage, and the analyst must choose and confirm one. The README's only example raises -dl to 40 and reports the correct base of one image at 81.64% after about 26 seconds. There are no tests or CI, and the README gives no comparison with rbasefind or basefind.py on shared images.
- MIT License (2022, soyer). Analyzed firmware keeps its own terms.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · soyersoyer/basefind2 · Revision 370d0dd
- basefind2.py GitHub · soyersoyer/basefind2 · Revision 370d0dd
- LICENSE GitHub · soyersoyer/basefind2 · Revision 370d0dd
- README.md GitHub · sgayou/rbasefind · Revision a661118
More in Firmware and hardware
- JTAGulator · Tool
- BIOSUtilities · Tool
- allyourbase · Tool
- ghidra_kernelcache · Tool
- esp32_image_parser · Tool
- Tigard · Tool