1

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at the firmware in a disassembler (e.g. Ghidra)

So a few questions...

  1. What exactly is a base address when it comes to firmware and embedded systems and why is it important?
  2. Is finding the base address relevant if the firmware is compiled as position independent code?
  3. If the base address is wrong what cross references won't work? (just strings?)

I'm mainly interested in the ARM architecture

Thank you

1 Answer 1

1

Any code is mapped or loaded at a specific address, from which it is then executed. This can be called base address, load address, or image base. For firmware which is usually optimized to run from flash or other kind of ROM, the fixed address means it can use hardcoded (fixed at compile or link time) addresses to refer to other parts of code or data such as string constants.

Position-independent code in theory can be loaded at any address, but in practice there may be hardware limitations, or it could still refer to fixed addresses for some reason. Making the code position-independent often makes it bigger for little benefit, so it is rarely encountered in embedded devices.

Besides strings, other address references may be missing or wrong if the load address is incorrect: jump tables, function pointers, pointers to other kinds of data and so on.

NOTE: sometimes startup code of the firmware copies parts of itself to predetermined addresses in RAM (for speed or when the data needs to be writable). For example, see this post. In such situations, you may need to copy or remap parts of the input firmware at the final addresses so the pointers line up properly.

For some hints on determining the correct load address, see my Recon 2010 presentation (from page 48).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.