{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/src/lib.rs",
    "https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/src/main.rs",
    "https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/Cargo.toml",
    "https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/.gitignore",
    "https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/LICENSE",
    "https://github.com/sgayou/rbasefind/releases/tag/v0.1.3"
  ],
  "category": "firmware",
  "description_en": "Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp. It records the offsets of ASCII strings, reads every 32-bit word as a possible pointer, and ranks candidate base addresses by how many strings each one would turn into pointer targets. The README calls it a simple heuristic that works rather well on some ARM (non-Thumb) binaries and will not work miracles.",
  "description_zh": "一个多线程 Rust 命令行工具，以暴力搜索推算平面 32 位固件镜像的加载基址，是 mncoppola 的 basefind.py 和 rsaxvc 的 basefind.cpp 的重新实现。它记录 ASCII 字符串的偏移，把每个 32 位字都当作可能的指针，再按候选基址能让多少字符串成为指针目标来排序。README 称这只是一个简单的启发式方法，对部分 ARM（非 Thumb）二进制效果相当好，但不会创造奇迹。",
  "entry_url": "https://awesomerea.org/resources/rbasefind/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rbasefind/",
  "evidence_url": "https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/README.md",
  "group": "tools",
  "id": "rbasefind",
  "json_url": "https://awesomerea.org/resources/rbasefind/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/rbasefind/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rbasefind/index.md",
  "name": "rbasefind",
  "name_zh": "rbasefind 固件基址搜索工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest tag at review: v0.1.3, on the reviewed master commit of 2020-09-27, with no GitHub release binaries and no crates.io package. Build it from source with Cargo; Cargo.toml declares no edition and Cargo.lock is ignored, so dependencies such as clap 2.33 and regex 1.3 resolve within their version ranges at build time. The README's TODO lists an automatic mode that would detect endianness and narrow the offset around the best match.",
    "Input is a flat 32-bit image supplied by the user, little-endian by default or big-endian with -b; no firmware or samples are included. By default it takes NUL-terminated printable ASCII strings of at least 10 characters, reads 4-byte-aligned words from the start of the file as pointers, and tests candidate bases every 0x1000 bytes across the 32-bit address space, splitting the range across one thread per CPU core. The whole file is loaded into memory.",
    "Results are a ranked list of candidate bases with match counts, 10 by default, that the analyst must confirm. The README's example takes about 41 seconds on 8 threads for one image and shows that raising the minimum string length to 100 cuts the time at some cost in accuracy. Unit tests cover only the address-range split between threads, and there is no CI.",
    "MIT License (2017, Scott Gayou). Analyzed firmware keeps its own terms."
  ],
  "requirements_zh": [
    "审阅时最新标签为 v0.1.3，位于所审阅的 master 分支 2020-09-27 提交上；GitHub 上没有发布二进制，crates.io 上也没有对应软件包。需用 Cargo 从源码构建；Cargo.toml 未声明 edition，Cargo.lock 被忽略，因此 clap 2.33、regex 1.3 等依赖会在构建时按版本范围解析。README 的待办事项列出一种自动模式：根据最大交集判断字节序，并在最佳匹配附近自动缩小步长。",
    "输入是使用者提供的平面 32 位镜像，默认按小端解释，-b 选项改为大端；仓库不含任何固件或样例。默认情况下，它提取至少 10 个字符、以 NUL 结尾的可打印 ASCII 字符串，从文件开头按 4 字节对齐读取每个字作为指针，并以 0x1000 字节为步长在整个 32 位地址空间测试候选基址，按 CPU 核心数分配线程划分搜索范围。整个文件会被读入内存。",
    "结果是带匹配数的候选基址排序列表（默认 10 个），需要分析人员确认。README 示例中，在 8 线程下处理一个镜像约用 41 秒，并展示把最小字符串长度提高到 100 可大幅缩短耗时，但会牺牲一定准确性。单元测试只覆盖线程间的地址范围划分，没有 CI。",
    "采用 MIT 许可证（2017 年，Scott Gayou）。被分析的固件适用其自身条款。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/sgayou/rbasefind",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}