Determining the Image Base of ARM Firmware by Matching Function Addresses

<table class="figure-group"><tr class="fig-image" id="a"><td><object data="https://static-preview.hindawi.com/articles/wcmc/volume-2021/4664882/figures/4664882.fig.006a.svgz" name="4664882.fig.006a" type="image/svg+xml"></object></td></tr><tr class="fig-caption"><td><b>(a) </b>Encoding format in Thumb state</td></tr><tr class="fig-image" id="b"><td><object data="https://static-preview.hindawi.com/articles/wcmc/volume-2021/4664882/figures/4664882.fig.006b.svgz" name="4664882.fig.006b" type="image/svg+xml"></object></td></tr><tr class="fig-caption"><td><b>(b) </b>Encoding format in ARM state</td></tr></table>

<div>Encoding format of LDR instruction.</div>

Wireless Communications and Mobile Computing

fig6

Figure 6

Figure 6: Determining the Image Base of ARM Firmware by Matching Function Addresses 