basedetection module¶

`binaryninja.basedetection.BaseAddressDetection`(view)	`class BaseAddressDetection` is a class that is used to detect candidate base addresses for position-dependent raw binaries
`binaryninja.basedetection.BaseAddressDetectionReason`(...)	`class BaseAddressDetectionReason` is a class that stores information used to understand why a base address is a candidate.

class BaseAddressDetection(view: str | PathLike | BinaryView)[source]¶

Bases: object

class BaseAddressDetection is a class that is used to detect candidate base addresses for position-dependent raw binaries

Example:

>>> from binaryninja import *
>>> bad = BaseAddressDetection("firmware.bin")
>>> bad.detect_base_address()
True
>>> hex(bad.preferred_base_address)
'0x4000000'

Parameters:

view (str | PathLike | BinaryView) –

abort() → None[source]¶

abort aborts base address detection analysis

Note

abort does not stop base address detection until after initial analysis has completed and it is in the base address enumeration phase

Return type:: None

detect_base_address runs initial analysis and attempts to identify candidate base addresses

Note

This operation can take a long time to complete depending on the size and complexity of the binary and the settings used

Parameters:

arch (Architecture) – CPU architecture of the binary (defaults to using auto-detection)
analysis (str) – analysis mode (basic, controlFlow, or full)
min_strlen (int) – minimum length of a string to be considered a point-of-interest
alignment (int) – byte boundary to align the base address to while brute-forcing
low_boundary (int) – lower boundary of the base address range to test
high_boundary (int) – upper boundary of the base address range to test
poi_analysis (BaseAddressDetectionPOISetting) – specifies types of points-of-interest to use for analysis
max_pointers (int) – maximum number of candidate pointers to collect per pointer cluster

Returns:

True if initial analysis completed with results, False otherwise

Return type:

bool

get_data_hits(base_address: int) → int[source]¶

get_data_hits returns the number of times a pointer pointed to a data variable at the specified base address

Parameters:: base_address (int) – base address to get data hits for
Returns:: number of data hits for the specified base address
Return type:: int

get_function_hits(base_address: int) → int[source]¶

get_function_hits returns the number of times a pointer pointed to a function at the specified base address

Parameters:: base_address (int) – base address to get function hits for
Returns:: number of function hits for the specified base address
Return type:: int

get_reasons(base_address: int) → list[BaseAddressDetectionReason][source]¶

get_reasons returns a list of reasons that can be used to determine why a base address is a candidate

Parameters:: base_address (int) – base address to get reasons for
Returns:: list of reasons for the specified base address
Return type:: list[BaseAddressDetectionReason]

get_string_hits(base_address: int) → int[source]¶

get_string_hits returns the number of times a pointer pointed to a string at the specified base address

Note

Data variables are only used as points-of-interest if analysis doesn’t discover enough strings and functions

Parameters:: base_address (int) – base address to get string hits for
Returns:: number of string hits for the specified base address
Return type:: int

property aborted: bool¶

aborted indicates whether or not base address detection analysis was aborted early

Returns:: True if the analysis was aborted, False otherwise
Return type:: bool

property confidence: BaseAddressDetectionConfidence¶

confidence returns an enum that indicates confidence the preferred candidate base address is correct

Returns:: confidence of the base address detection results
Return type:: BaseAddressDetectionConfidence

property last_tested_base_address: int¶

last_tested_base_address returns the last candidate base address that was tested

Note

This is useful for situations where the user aborts the analysis and wants to restart from the last tested base address by setting the low_boundary parameter in BaseAddressDetection.detect_base_address

Returns:: last candidate base address tested
Return type:: int

property preferred_base_address: int | None¶

preferred_base_address returns the candidate base address which contains the most amount of pointers that align with discovered points-of-interest in the binary

Note

BaseAddressDetection.confidence reports a confidence level that the preferred base is correct

Note

BaseAddressDetection.scores returns a list of the top 10 candidate base addresses and their scores and can be used to discover other potential candidates

Returns:: preferred candidate base address
Return type:: int

property scores: list[tuple[int, int]]¶

scores returns a list of candidate base addresses and their scores

Note

The score is set to the number of times a pointer pointed to a point-of-interest at that base address

Example:

>>> from binaryninja import *
>>> bad = BaseAddressDetection("firmware.bin")
>>> bad.detect_base_address()
True
>>> for addr, score in bad.scores:
...     print(f"0x{addr:x}: {score}")
...
0x4000000: 7
0x400dc00: 1
0x400d800: 1
0x400cc00: 1
0x400c400: 1
0x400bc00: 1
0x400b800: 1
0x3fffc00: 1

Returns:

list of tuples containing each base address and score

Return type:

list[tuple[int, int]]

class BaseAddressDetectionReason(pointer: int, offset: int, type: BaseAddressDetectionPOIType)[source]¶

Bases: object

class BaseAddressDetectionReason is a class that stores information used to understand why a base address is a candidate. It consists of a pointer, the offset of the point-of-interest that the pointer aligns with, and the type of point-of-interest (string, function, or data variable)

Parameters:

pointer (int) –
offset (int) –
type (BaseAddressDetectionPOIType) –

offset: int¶

pointer: int¶

type: BaseAddressDetectionPOIType¶