Determining the Image Base of ARM Firmware by Matching Function Addresses

Algorithm 1

FIND-ARM-LDR algorithm.

Input: binaryFile

Output: The addressees loaded by LDR instruction in ARM state.

function Find_ARM_LDR(binaryFile)

  bin[fileSize] ⟵ binaryFile

  offset ⟵0

   while(0 ≤ offset < fileSize-3) do

     if (bin[offset +2] ==0x9F && bin[offset+3] ==0xE5)

       PC ⟵ offset +8

       immed_12 ⟵ bit[11,…,0]

       address ⟵ PC&0xFFFFFFFC + (immed_12)

       Rd ⟵ Memory[address, 4]

       Output: Rd

     end if

     offset ⟵ offset +4

   end while

end function