In this firmware that is ARM Little endian.

There is two strings :

0x00006953 : Foretrex 701
0x00006960 : Foretrex 601

The issue, is there is no direct Xreft to any of thoses strings ?

For the firmware, it's pretty much the same.

As IDA cannot find the entry point, to start analyzing the binary (after setting CPU to arm little endian) select all the code (with CTRL+SHIFT+PAGE_DOWN) press C, then "Analyze"

  • Do you know what is the base address of the firmware ?
    – w s
    Mar 30, 2020 at 11:50
  • No at all, first time I open up a ARM binary (or even a firmware) in IDA, should I get the adresses of all the strings, compare it to the known pointers and try to find an offset that matches the most possible (if not "all") strings ? Or is there a better way ?
    – Lapin
    Mar 30, 2020 at 15:26

1 Answer 1


As suggested in one of the answers, it's because of the base address, I used rbasefind to find the base_address of the firmware, and edited it to find the address of the bootloader as there was only two strings plus 11 false string positives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.