basedetection module¶

Bases: object

class BaseAddressDetection is a class that is used to detect candidate base addresses for position-dependent raw binaries

Example:

>>> from binaryninja import *
>>> bad = BaseAddressDetection("firmware.bin")
>>> bad.detect_base_address()
True
>>> hex(bad.preferred_base_address)
'0x4000000'

__init__(view: str | PathLike | BinaryView) → None[source]¶

Parameters:

view (str | PathLike | BinaryView) –

Return type:

None

abort() → None[source]¶

abort aborts base address detection analysis

Note

abort does not stop base address detection until after initial analysis has completed and it is in the base address enumeration phase

Return type:

None

detect_base_address(arch: Architecture | str | None = None, analysis: Literal['basic', 'controlFlow', 'full'] = 'full', min_strlen: int = 10, alignment: int = 1024, low_boundary: int = 0, high_boundary: int = 18446744073709551615, poi_analysis: BaseAddressDetectionPOISetting = BaseAddressDetectionPOISetting.POIAnalysisAll, max_pointers: int = 128) → bool[source]¶

detect_base_address runs initial analysis and attempts to identify candidate base addresses

Note

This operation can take a long time to complete depending on the size and complexity of the binary and the settings used

Parameters:

• arch (Architecture) – CPU architecture of the binary (defaults to using auto-detection)

• analysis (str) – analysis mode (basic, controlFlow, or full)

• min_strlen (int) – minimum length of a string to be considered a point-of-interest

• alignment (int) – byte boundary to align the base address to while brute-forcing

• low_boundary (int) – lower boundary of the base address range to test

• high_boundary (int) – upper boundary of the base address range to test

• poi_analysis (BaseAddressDetectionPOISetting) – specifies types of points-of-interest to use for analysis

• max_pointers (int) – maximum number of candidate pointers to collect per pointer cluster

Returns:

True if initial analysis completed with results, False otherwise

Return type:

bool

get_data_hits(base_address: int) → int[source]¶

get_data_hits returns the number of times a pointer pointed to a data variable at the specified base address

Parameters:

base_address (int) – base address to get data hits for

Returns:

number of data hits for the specified base address

Return type:

int

get_function_hits(base_address: int) → int[source]¶

get_function_hits returns the number of times a pointer pointed to a function at the specified base address

Parameters:

base_address (int) – base address to get function hits for

Returns:

number of function hits for the specified base address

Return type:

int

get_reasons(base_address: int) → list[BaseAddressDetectionReason][source]¶

get_reasons returns a list of reasons that can be used to determine why a base address is a candidate

Parameters:

base_address (int) – base address to get reasons for

Returns:

list of reasons for the specified base address

Return type:

list[BaseAddressDetectionReason]

get_string_hits(base_address: int) → int[source]¶

get_string_hits returns the number of times a pointer pointed to a string at the specified base address

Note

Data variables are only used as points-of-interest if analysis doesn’t discover enough strings and functions

Parameters:

base_address (int) – base address to get string hits for

Returns:

number of string hits for the specified base address

Return type:

int

property aborted: bool¶

aborted indicates whether or not base address detection analysis was aborted early

Returns:

True if the analysis was aborted, False otherwise

Return type:

bool

property confidence: BaseAddressDetectionConfidence¶

confidence returns an enum that indicates confidence the preferred candidate base address is correct

Returns:

confidence of the base address detection results

Return type:

BaseAddressDetectionConfidence

property last_tested_base_address: int¶

last_tested_base_address returns the last candidate base address that was tested

Note

This is useful for situations where the user aborts the analysis and wants to restart from the last tested base address by setting the low_boundary parameter in BaseAddressDetection.detect_base_address

Returns:

last candidate base address tested

Return type:

int

property preferred_base_address: int | None¶

preferred_base_address returns the candidate base address which contains the most amount of pointers that align with discovered points-of-interest in the binary

Note

BaseAddressDetection.confidence reports a confidence level that the preferred base is correct

Note

BaseAddressDetection.scores returns a list of the top 10 candidate base addresses and their scores and can be used to discover other potential candidates

Returns:

preferred candidate base address

Return type:

int

property scores: list[tuple[int, int]]¶

scores returns a list of candidate base addresses and their scores

Note

The score is set to the number of times a pointer pointed to a point-of-interest at that base address

Example:

>>> from binaryninja import *
>>> bad = BaseAddressDetection("firmware.bin")
>>> bad.detect_base_address()
True
>>> for addr, score in bad.scores:
...     print(f"0x{addr:x}: {score}")
...
0x4000000: 7
0x400dc00: 1
0x400d800: 1
0x400cc00: 1
0x400c400: 1
0x400bc00: 1
0x400b800: 1
0x3fffc00: 1

Returns:

list of tuples containing each base address and score

Return type:

list[tuple[int, int]]

Bases: object

class BaseAddressDetectionReason is a class that stores information used to understand why a base address is a candidate. It consists of a pointer, the offset of the point-of-interest that the pointer aligns with, and the type of point-of-interest (string, function, or data variable)

__init__(pointer: int, offset: int, type: BaseAddressDetectionPOIType) → None¶

Parameters:

• pointer (int) –

• offset (int) –

• type (BaseAddressDetectionPOIType) –

Return type:

None

offset: int¶

pointer: int¶

type: BaseAddressDetectionPOIType¶