1

I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler.

In order to understand the binary much better, I need to debug the binary to understand a few subroutines.

I am using Ubuntu 64-bit (version 14.04). I have followed the instructions provided here: https://reverseengineering.stackexchange.com/a/8917/2673 for installing qemu, binfmt, gdb-multiarch, MIPS libraries and cross compiling tool chain.

cross compiler installation error:

I get an error while trying to install gcc-4.4-mipsel-linux-gnu on Ubuntu 14.04

gcc-4.4-mipsel-linux-gnu depends on cpp-4.4-mipsel-linux-gnu.

When I try to install cpp-4.4-mipsel-linux-gnu, I get an error that libgmp32c2 is not installed. And when I try to install libgmp3c2 using apt-get, it doesn't find the package.

I can find several other packages like libgmp3c2-* however, cannot find the specific, libgmp3c2 package which cpp-4.4-mipsel-linux-gnu needs. And I have even added the recommended repositories to /etc/apt/sources.list

However, I thought we need to install the cross platform compiling tools only if I need to compile the program for the target architecture.

Error in Execution of MIPS Binary

So, I tried to execute the MIPS binary and it crashes. When I run strace on it, I get the following error:

NeonFlash:~$ qemu-mips -strace ./test 
61294 brk(NULL) = 0x00412000
61294 mmap(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x767ca000
61294 uname(0x76ffeae8) = 0
61294 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
61294 access("/etc/ld.so.preload",R_OK) = -1 errno=2 (No such file or directory)
61294 open("/etc/ld.so.cache",O_RDONLY) = 3
61294 fstat64(3,0x76ffe6d0) = 0
61294 mmap(NULL,104789,PROT_READ,MAP_PRIVATE,3,0) = 0x767b0000
61294 close(3) = 0
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault (core dumped)

Below are the details when I tried to use gdb with the binary:

NeonFlash$ qemu-mips -g 12345 ./test &
[1] 60181
NeonFlash$ gdb-multiarch ./test 
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./test...(no debugging symbols found)...done.
(gdb) set arch mips
The target architecture is assumed to be mips
(gdb) target remote localhost:12345
Remote debugging using localhost:12345
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
0x767cb880 in ?? ()
(gdb) x/i $pc
=> 0x767cb880:  move    t9,ra

I even tried remote debugging the binary using IDA Pro by running qemu-mips as shown below:

qemu-mips -E REMOTE_ADDR=<IP_address_of_machine_with_IDA_PRO> -g 12345 ./test &

However, if I set a breakpoint on the main function, it crashes.

Do I need to install qemu-system or qemu-user should be enough for debugging MIPS binaries?

  • libgmp3c2 was removed from both debian and ubuntu.Its probably best to fix up the environment before jumping into debugging. Gcc-6 is out, libgmp10 is the current i think. – Sigtran Jun 23 '17 at 11:59

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.