Abstract: Base address identification for monolithic firmware serves as the foundation for firmware security research.Current methods and related tools suffer from low identification rate,poor performance,and high resource consumption.To address these limitations,this paper proposes a new data distribution matching-based method for monolithic firmware base address identification.The method firstly calculates the effective character density of each firmware section,then partitions the firmware into text segments and non-text segments based on this density metric.Then,it comprehensively extracts string constant data from the text segments.By identifying and parsing register load instructions,this method retrieves absolute address data embedded in the firmware.These absolute addresses are clustered according to both their destination functions and the source registers used prior to function invocation.The base address is ultimately determined by matching the distribution patterns between the absolute address clusters and string constant data within the firmware,thereby establishing their correspondence and enabling accurate base address resolution.Experimental results demonstrate that the proposed data distribution matching-based firmware base address identification method significantly outperforms existing approaches in recognition efficiency,achieving a 100% success rate on a test set comprising 30 firmware samples.

Key words: Monolithic firmware, Base address identification, Data distribution, Character density, Absolute address cluster