search

e-m-b-a / embark

EMBArk - The firmware security scanning environment
https://www.securefirmware.de
MIT License
318 stars 46 forks source link

Automatically guessing the base address of a firmware image #174

Closed Moneysac90 closed 6 months ago

Moneysac90 commented 11 months ago

When trying to reverse engineer a firmware image with ghidra or IDA Pro you often have to specify the base address in order to decompile the code correctly.

There are some tools that try to guess the correct base address. For example:

We could add such scripts as additionally checks and provide a separate tab/overview of the possible base addresses. Furthermore, it would be awesome if we could have a download button somewhere in Embark to download the extracted files. This simplifies the process of reverse engineering because you can directly analyze them with your favorite disassembler/decompiler.

m-1-k-3 commented 11 months ago

This probably could be interesting for RTOS systems. If we detect an RTOS, the next step usually is to find the base address for further analysis.

BenediktMKuehne commented 11 months ago

A resource download function exists, there is just no button/interface for it yet. Right now for that purpose we use the Download-Logs funktion instead.

Will look into this. (Might also require some EMBA changes to what gets put and kept in the log-directory)

m-1-k-3 commented 6 months ago

I think this issue would better fit in the EMBA backend. If needed please re-open it here https://github.com/e-m-b-a/emba/issues