Determining the Image Base of ARM Firmware by Matching Function Addresses

Algorithm 3

DBMFA algorithm.

Input: Set of binary function offsets in firmware

   Set of addresses loaded by LDR instructions

   Size of the binary file fileSize

Output: Descending order of elements and the number of occurrences

function DBMFA(O, A, fileSize)

  Initialize each element in matrix M to -1

  max ⟵0xFFFFFFFF - fileSize

  for all a_jAdo

   for all o_iOdo

     if 0 < a_j - o_i && a_j - o_i < max

       M_{[j, i]} ⟵ a_j - o_i

     end if

   end for

  end for

  Count the number of occurrences of each element in matrix M

  Sort the number of occurrences in descending order

  Delete the initial value -1 and the number of occurrences in the sort result

  Output: Descending order of elements and the number of occurrences

end function