Determining the Image Base of ARM Firmware by Matching Function Addresses

Table 1

The experimental results.

Model	File	Function	ARM_LDR	Thumb_LDR	ALL_LDR	Match	Base	Time (s)
ABB NETA-21	uImage	7549	14611	2221	16723	226	0xC0008000	233
Advantech_EKI-2748FI	3551	3176	7350	879	8195	113	0x400000	41
Emerson TopWorx ES-03001	ES-03001-1.ffd	1668	2177	440	2599	84	0x1000FFD4	8
Pebble	tintin_fw.bin	1522	0	3152	3152	N/A	N/A	8
Phoenix 400 PND-4TX-IB	2985563_321.fw	6856	9867	897	10728	187	0x20800F28	116
Samsung gear fit	wingtip_in.bin	11619	0	4334	4334	N/A	N/A	99
Schneider 140CRA31200	CRA31200_Com.bin	7517	13980	1378	15284	377	0x1000	167
Schneider 140CRA31200	140CRA31200_Master.bin	7185	13883	2176	15950	396	0x02001000	180
Sony AS30 DV	vmlinux.bin	4838	7993	1751	9676	265	0xC0018000	80
Sony SBH52	SBH52_firmware.bin	2949	4	1564	1568	73	0x8040001	8