{
  "added_at": "2026-10-31",
  "additional_evidence_urls": [
    "https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/man/binbloom.1",
    "https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/configure.ac",
    "https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/src/binbloom.c#L1197-L1259",
    "https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/src/binbloom.c#L1422-L1443",
    "https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/LICENSE",
    "https://github.com/quarkslab/binbloom/releases/tag/v2.1"
  ],
  "category": "firmware",
  "description_en": "Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. It guesses endianness from how the high bytes of pointer-sized values cluster under each byte order, and ranks candidate loading (base) addresses by how many values would then point at indexed text strings and pointer arrays. Given a base address, it also searches automotive ECU firmware for a table of Unified Diagnostic Services (UDS) command IDs and prints the inferred structure layout for use in a disassembler.",
  "description_zh": "Quarkslab 开发的命令行工具，通过对内容做简单统计来推断无文件头原始固件镜像的基本属性，因此 README 称其适用于所有架构。它根据指针宽度数值的高位字节在两种字节序下的聚集程度推测端序，并按候选加载地址（基址）下有多少数值会指向已索引的文本字符串和指针数组，对候选地址排序。给定基址后，它还能在汽车 ECU 固件中查找统一诊断服务（UDS）命令 ID 表，并输出推断出的结构体布局，供反汇编器使用。",
  "entry_url": "https://awesomerea.org/resources/binbloom/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/binbloom/",
  "evidence_url": "https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/README.md",
  "group": "tools",
  "id": "binbloom",
  "json_url": "https://awesomerea.org/resources/binbloom/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/binbloom/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/binbloom/index.md",
  "name": "binbloom",
  "name_zh": "binbloom 原始固件端序与基址分析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.1, published 2024-06-06 and tagged at the master head, commit 95cfaac from 2022-11-07, whose source reports version 2.1.0. The release adds a -m option for base-address alignment and fixes a crash on very small files and null-pointer and floating-point errors; configure.ac and the man page still say 2.0, and master has no later commits.",
    "The README documents a Linux-only source build with autoreconf, configure, make and make install; configure.ac needs a C compiler, libm and pthreads. The release attaches no prebuilt binaries.",
    "Each run takes one raw firmware dump supplied by the user and assumes a 32-bit target unless -a 64 is given. The README warns that endianness detection may be unreliable below about 10 KB and offers -e to force it; -t adds threads, -f takes a file of known function addresses, and the experimental -d deep search is slower. Output is a ranked list of candidate base addresses, sometimes marked not sure, and the UDS search runs only when -b supplies the base address.",
    "The README calls the UDS search heuristic and prone to false positives, so each candidate table has to be checked by hand. The repository contains no tests or sample firmware and publishes no accuracy results.",
    "Apache-2.0."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.1，发布于 2024-06-06，标签指向 master 最新提交 95cfaac（2022-11-07），其源码报告的版本号为 2.1.0。该版本新增用于设置基址对齐的 -m 选项，并修复了处理极小文件时的崩溃以及空指针和浮点异常错误；configure.ac 和 man 手册仍写作 2.0，master 分支此后没有新的提交。",
    "README 只说明了在 Linux 上从源码构建，步骤为 autoreconf、configure、make 和 make install；configure.ac 需要 C 编译器、libm 和 pthreads。该版本未附带预编译程序。",
    "每次运行处理一个由使用者自备的原始固件转储，未指定 -a 64 时默认按 32 位目标处理。README 提醒，文件小于约 10 KB 时端序检测可能不可靠，此时可用 -e 强制指定；-t 可启用多线程，-f 可提供已知函数地址文件，实验性的 -d 深度搜索速度较慢。输出为按得分排序的候选基址列表，有时会标注不确定；只有用 -b 提供基址时才会执行 UDS 搜索。",
    "README 称 UDS 搜索基于启发式方法，可能出现误报，因此每个候选表都需要人工核实。仓库不含测试或样例固件，也未公布准确率结果。",
    "采用 Apache-2.0 许可。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/quarkslab/binbloom",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}