4

As a beginner I'm trying to load an unknown format binary file with IDA Pro,but I don't know the Image Base of this file. Are there any methods to get the Image Base. Could you also reference related papers in your answer.

  • Search for questions tagged firmware. It's possible that your alleged image contains a full file system. firmware-mod-kit would be the way to go in such a case. – 0xC0000022L Jun 23 '14 at 6:30
4

One possible method is if there are string tables present, and pointer tables to those strings, is load the bin into IDA at zero and find the strings, then write a program to search the binary looking for int32 differences that matched the differences in the start of each string.

I searched for byte/word/int's in big/little endian formats, and once you find the match, then you can calc the correct base from the difference from you search address and the resulting address/pointer table.

Here's the C# code I used

static void SearchDumpsForIntDiff(string filename, params int[] dcode)
{
    var sw = new StreamWriter(File.Open(filename + "status.txt", FileMode.Create, FileAccess.Write, FileShare.ReadWrite));

    byte[] data = File.ReadAllBytes(filename);

    if (data.Length == 0) return;

    int dl = dcode.Length;
    for(int loc = 0; loc < (data.Length - (dcode.Length*4)); loc++)     
    {
        for(int off = 0; off < (dcode.Length-1); off++)
        {
            int t1 = dcode[off];
            int t2 = dcode[off + 1];
            int d1 = (t2 - t1)/8;
            int v1 = (int)ReadUint32(data, loc + ((off + 0) * 4));
            int v2 = (int)ReadUint32(data, loc + ((off + 1) * 4));

            int d2 = v2 - v1; 

            if( d1 != d2 )
                break;

            if( off == (dcode.Length-2))
            {                            
                sw.WriteLine("Match at {0:X8}",  loc);
                Console.WriteLine("Match at {0:X8}",  loc);
            }
        }

    }

    sw.Close();
    sw.Dispose();
}

which I used like

SearchDumpsForIntDiff(@"Nikon\D7000Update\b750103a.bin", 0x79DF9A, 0x79DFB2, 0x79DFBA, 0x79DFC2);
| improve this answer | |
5

I wrote something for Cortex M3 MCUs here: http://www.reddit.com/r/ReverseEngineering/comments/21kgtc/beginners_project_logitech_g940_firmware/cgeokv3

As you didn't write anything about the device your blob is for and how it gets there no conclusion can be made from us.

But you really need to know which CPU you have, where the flash memory is at and how vector tables and such work on this specific model to determine something.

Some MCUs have a bootloader at the beginning of the flash and the user code is begind it, other MCUs have the bootloader in the upper region of the flash and user code starts at the front.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.