{"id":13458912,"url":"https://github.com/sgayou/rbasefind","last_synced_at":"2025-03-24T16:31:07.578Z","repository":{"id":64594967,"uuid":"112968804","full_name":"sgayou/rbasefind","owner":"sgayou","description":"A firmware base address search tool.","archived":false,"fork":false,"pushed_at":"2020-09-27T20:58:55.000Z","size":25,"stargazers_count":340,"open_issues_count":1,"forks_count":32,"subscribers_count":9,"default_branch":"master","last_synced_at":"2024-10-29T04:34:27.547Z","etag":null,"topics":["firmware-analysis","reverse-engineering"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sgayou.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-03T22:23:03.000Z","updated_at":"2024-10-15T23:44:11.000Z","dependencies_parsed_at":"2022-12-16T17:53:34.315Z","dependency_job_id":null,"html_url":"https://github.com/sgayou/rbasefind","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sgayou%2Frbasefind","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sgayou%2Frbasefind/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sgayou%2Frbasefind/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sgayou%2Frbasefind/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sgayou","download_url":"https://codeload.github.com/sgayou/rbasefind/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245308484,"owners_count":20594257,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["firmware-analysis","reverse-engineering"],"created_at":"2024-07-31T09:00:59.627Z","updated_at":"2025-03-24T16:31:07.320Z","avatar_url":"https://github.com/sgayou.png","language":"Rust","funding_links":[],"categories":["Tool"],"sub_categories":["Firmware Analysis"],"readme":"# rbasefind\nA brute-force base address scanner based on [@mncoppola's](https://github.com/mncoppola) [basefind.py](https://github.com/mncoppola/ws30/blob/master/basefind.py) \u0026 [@rsaxvc's](https://github.com/rsaxvc) [basefind.cpp](https://github.com/mncoppola/ws30/blob/master/basefind.cpp) implemented in rust.\n\n## Features\nScans a flat, 32-bit binary file and attempts to calculate the base address of the image. Looks for ASCII English strings then finds the greatest intersection of all 32-bit words interpreted as pointers and the offsets of the strings.\n\nThis works rather well on some ARM (non-thumb) binaries. It's a very simple heuristic that attempts to use as little information about the file as possible from the target binary. As such, it isn't going to work miracles.\n\n### Help\n```\nScan a flat 32-bit binary and attempt to brute-force the base address via string/pointer comparison. Based on the\nexcellent basefind.py by mncoppola.\n\nUSAGE:\n    rbasefind [FLAGS] [OPTIONS] \u003cINPUT\u003e\n\nFLAGS:\n    -b, --bigendian    Interpret as big-endian (default is little)\n    -h, --help         Prints help information\n    -p, --progress     Show progress\n    -V, --version      Prints version information\n\nOPTIONS:\n    -n, --maxmatches \u003cLEN\u003e         Maximum matches to display (default is 10)\n    -m, --minstrlen \u003cLEN\u003e          Minimum string search length (default is 10)\n    -o, --offset \u003cLEN\u003e             Scan every N (power of 2) addresses. (default is 0x1000)\n    -t, --threads \u003cNUM_THREADS\u003e    # of threads to spawn. (default is # of cpu cores)\n\nARGS:\n    \u003cINPUT\u003e    The input binary to scan\n```\n\n### Example\n\n```bash\ntime ./rbasefind fw.bin \nLocated 2355 strings\nLocated 372822 pointers\nScanning with 8 threads...\n0x00002000: 2195\n0x00001000: 103\n0x00000000: 102\n0x00003000: 101\n0x00004000: 90\n0x45e95000: 74\n0x45e93000: 73\n0x00006000: 64\n0x00005000: 59\n0x45ec3000: 58\n\nreal\t0m40.937s\nuser\t5m20.908s\nsys\t0m0.035s\n```\n\n`0x00002000` was the correct base address for this binary.\n\nFor large binaries, the default scan may take too long. The search size can be dialed down, at the expense of \"accuracy\", via specifying a minimum string length. i.e.,\n\n```\ntime ./target/release/rbasefind fw_all.bin -m 100\nLocated 7 strings\nLocated 372822 pointers\nScanning with 8 threads...\n0x00002000: 4\n0x2ae7b000: 2\n0xffe54000: 1\n0xfba46000: 1\n0xfb9c3000: 1\n0xfb80a000: 1\n0xfafe6000: 1\n0xfafe0000: 1\n0xfae3b000: 1\n0xfae13000: 1\n\nreal\t0m0.149s\nuser\t0m0.751s\nsys\t0m0.012s\n```\n\n## TODO\n* Some form of auto mode. Detect endianness based on highest intersection. Auto decrease offset in window around highest match.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsgayou%2Frbasefind","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsgayou%2Frbasefind","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsgayou%2Frbasefind/lists"}