BINBLOOM(1)

🌸 BINBLOOM(1) — the firmware-finding bestie we all deserve 🌸

Okay so picture this: it's 15 Sep 2021, and the Unix gods dropped binbloom version 2.0 into the world, and honestly? Main character energy. This is the manual page, but make it a group chat. Buckle up, bestie 🎀

---

✨ NAME ✨

binbloom — literally here to find your firmware loading address and, if you're lucky, your UDS database too (if there even is one, iykyk) 💅

---

🦋 SYNOPSIS 🦋

binbloom [-a arch] [-b address] [-d] [-e endianness] [-f functions-file]
         [-t threads] [-v]

---

💖 DESCRIPTION 💖

So like, binbloom can figure out an unknown binary firmware loading address (or base address, same vibe) from its content. How? Heuristics plus the target architecture's characteristics — think 32-bit vs 64-bit and endianness. And if the endianness is a mystery? No worries, binbloom will try to determine it for you. Obsessed. 🔥

And that's not even all — binbloom is also able to locate any Unified Diagnostic Services (UDS) database, which is generally used in automotive firmwares. But plot twist: it does this once the loading address has been found. So like, address first, UDS second. Periodt. 👑

---

🌈 OPTIONS 🌈

• -a arch, --arch=arch — specify the target architecture. It must be 32 (for 32-bit architecture) or 64 (for 64-bit architecture). No in-between, bestie.
• -b address, --base=address — specify the base address (or loading address) to use. Use this option to enable the UDS database search — that's the unlock 🔓
• -e endianness, --endian=endianness — specify the target endianness. Must be le for little-endian or be for big-endian. Pick your fighter.
• -m alignment, --align=alignment — specify base address alignment. The default is 0x1000, iconic default behavior honestly.
• -d, --deep — enable deep search. This mode will consider each potential loading/base address without applying a first heuristic filter used in normal mode. Lowkey a big deal. This type of search takes longer to complete and requires much more computing power, and it's also recommended to use multiple threads (through the -t,--threads option) to speed up the search. Deep search said "I'm expensive, deal with it" 💀
• -f, --functions — specify an external file containing known function addresses in hex (one per line) that will be used by binbloom in its base address guessing algorithm. Providing such a file may help finding the correct base address, depending on the architecture. A little hint file, a little cheat sheet, we love to see it 🫶
• -t, --threads — specify a number of threads to use when searching for the base address. It is recommended to set this value to the number of cores minus 1 in order to get the best performances. Respect the math, bestie 🧚
• [-v] — enable verbose mode, and binbloom will display more information. Use this option many times to get more information displayed. Yes, many times. Stack that verbosity, no cap ✨

---

🍓 EXAMPLES 🍓

Here are some examples showing how to use binbloom in different cases. Vibe check each one 💜

binbloom -a 32 firmware.bin

binbloom will analyze firmware.bin considering a 32-bit architecture. binbloom will guess the endianness and then find out one or more possible base addresses. It's giving detective energy 🔍

binbloom -a 32 -e le firmware.bin

Same as above, but in this example the endianness is set to little-endian. You already know, so you told it. Communication is key 💅

binbloom -a 32 -e le -d -t 4 firmware.bin

binbloom will perform a deep search considering a 32-bit little-endian architecture, and will use 4 threads to speed up this process. Deep search plus threads equals "we're going fast but thoroughly" 🔥

binbloom -a 64 -f ./function.list firmware.bin

binbloom will parse firmware.bin to find points of interest but also use the provided file functions.list to guess the base address. Teamwork makes the dream work, even if the team is you and a text file 🌸

---

💀 BUGS 💀

No known bugs. Literally flawless behavior, we stan a bug-free icon 👑

---

🫶 AUTHORS 🫶

Guillaume Heilles, Damien Cauquil — the legends behind the whole thing. Thank them in your group chat 💖

---

And that's the whole manual, bestie. Source and version, for the record: this is the binbloom man page, version 2.0, dated 15 Sep 2021. Slay, go find those base addresses 🌈✨💅