Determining the Image Base of ARM Firmware by Matching Function Addresses

Algorithm 2

FIND-Thumb-LDR algorithm.

Input: binaryFile

Output: The addressees loaded by LDR instruction in Thumb state.

function Find_Thumb_LDR(binaryFile)

  bin[fileSize] ⟵ binaryFile

  offset ⟵0

   while(0 ≤ offset < fileSize) do

     opcode ⟵ bin[offset+1]

     opcode ⟵ opcode & (11111000)₂

     if( opcode == (01001000)₂)

      PC ⟵ offset +4

      immed_8 ⟵ bit[7,…,0]

      address ⟵ (PC & 0xFFFFFFFC) + (immed_84)

      Rd ⟵ Memory[address, 4]

      Output: Rd

     end if

     offset ⟵ offset +2

   end while

end function