1

I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files.

Example for: Amiko HD8150 2.4.43 emu Firmware.

Software used: Ali Main Code Decrypter 8.9

Files unpacked:

  • bootloader
  • MemCfg
  • maincode(AV)
  • seecode
  • default_lang
  • cipluskey
  • countryband
  • logo_user
  • logo_menu
  • logo_radio
  • logo_boot
  • patch
  • defaultdb(PRC)
  • userdb(64+64)

Software used: binwalk

TERMINAL OUTPUT:

# binwalk -e AMIKO_HD8150_2.4.43_emu.abs

DECIMAL       HEXADECIMAL     DESCRIPTION

--------------------------------------------------------------------------------
196736        0x30080         LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 11883876 bytes
3866752       0x3B0080        LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 3255512 bytes
5636224       0x560080        LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 87904 bytes

Files unpacked:

  • 30080
  • 3B0080
  • 560080

When I open the 30080 file with hexdump I can see this at the end:

# hexdump -C 

part of file 


00b51a30  00 00 00 00 4c 69 62 63  6f 72 65 20 76 65 72 73  |....Libcore vers|
00b51a40  69 6f 6e 20 31 33 2e 31  36 2e 30 40 53 44 4b 34  |ion 13.16.0@SDK4|
00b51a50  2e 30 66 61 2e 31 33 2e  31 36 5f 32 30 31 36 31  |.0fa.13.16_20161|
00b51a60  30 31 39 28 67 63 63 20  76 65 72 73 69 6f 6e 20  |019(gcc version |
00b51a70  33 2e 34 2e 34 20 6d 69  70 73 73 64 65 2d 36 2e  |3.4.4 mipssde-6.|
00b51a80  30 36 2e 30 31 2d 32 30  30 37 30 34 32 30 29 28  |06.01-20070420)(|
00b51a90  41 64 6d 69 6e 69 73 74  72 61 74 6f 72 40 20 46  |Administrator@ F|
00b51aa0  72 69 2c 20 4a 75 6c 20  32 38 2c 20 32 30 31 37  |ri, Jul 28, 2017|
00b51ab0  20 31 32 3a 35 33 3a 32  38 20 41 4d 29 0a 00 00  | 12:53:28 AM)...|
00b51ac0  44 4d 58 5f 53 33 36 30  31 5f 30 00 00 a1 03 18  |DMX_S3601_0.....|

When I use readelf it says this file isn't an ELF file.

So I tried to open the bin 30080 in the qemu (Win64) but it doesn't start the emulation.

  C:\Program Files\qemu>qemu-system-mips.exe -machine mips -cpu mips32r6-generic -drive file=C:\30080.bin,index=0,media=disk,format=raw

qemu-system-mips.exe: warning: could not load MIPS bios 'mips_bios.bin'

So I think something is wrong. Well I know the kernel is missing but how can I know the correct kernel for this firmware. Has someone tried to open (emulate) a STB firmware in Qemu before? Do you think I need to create an image with bin files or emulate as rs232 flash ?

Sorry for all this questions I never used Qemu before.

UPDATE #1

So i tested some differents emulators like Firmadyne and Qemu, and now i can point the *.abs is not a linux embedded firmware like dreambox, so i opened a issue ticket in the fimadyne and qemu about my issues to can do a emulation with the *.abs or *.bin files from STB Receivers like (Amiko,Openbox,Skybox,AZbox, Cryptobox,etc...).

And now i just received some replies in Firmadyne Github.

Firmadyne ticket issue about *.abs or *.bin emulation

because when i tried to open binary and/or *.abs files he shows a error about extraction.

So here he go the issue i have in the Firmadyne

Terminal OUTPUT:

    root@ns2:/Firmware/firmadyne# ./sources/extractor/extractor.py -b Amiko -sql 127.0.0.1 -np -nk "AMIKO_HD8150_2.4.43_emu.zip" images

root@ns2:/Firmware/firmadyne# >> Database Image ID: 2

root@ns2:/Firmware/firmadyne/AMIKO_HD8150_2.4.43_emu.zip
root@ns2:>> MD5: 17c266121d5568340ef927c211fcc4f4
root@ns2:>> Tag: 2
root@ns2:>> Temp: /tmp/tmpOqzn89
root@ns2:>> Status: Kernel: True, Rootfs: False, Do_Kernel: False,                 root@ns2:Do_Rootfs: True
root@ns2:>>>> Zip archive data, at least v2.0 to extract, compressed size: root@ns2:4454941, uncompressed size: 8388608, name: AMIKO_HD8150_2.4.43_emu.abs
root@ns2:>> Recursing into archive ...

root@ns2:/tmp/tmpOqzn89/_AMIKO_HD8150_2.4.43_emu.zip.extracted/rlz_notes.txt
        root@ns2:>> MD5: aa5c7dd374bf981442deb5fa67e7189e
        root@ns2:>> Skipping: text/plain...

root@ns2:/tmp/tmpOqzn89/_AMIKO_HD8150_2.4.43_emu.zip.extracted/AMIKO_HD8150_2.4.43_emu.abs
        root@ns2:>> MD5: dc6b86caa2c55d18a43ca9ad9053bc77
        root@ns2:>> Tag: 2
        root@ns2:>> Temp: /tmp/tmpBNDrbm
        root@ns2:>> Status: Kernel: True, Rootfs: False, Do_Kernel: False,                 root@ns2:Do_Rootfs: True
        root@ns2:>> Recursing into archive ...
        **root@ns2:>>>> Extraction failed!**
        root@ns2:>>>> LZMA compressed data, properties: 0x6C, dictionary size: root@ns2:8388608 bytes, uncompressed size: 11883876 bytes
        root@ns2:>> Recursing into compressed ...

AND A LOT OF OTHER MESSAGES ABOVE

So after this issue i opened a issue ticket in Gihub and they told me this *.abs or *.bin files is not a linux embedded device so i googled again about qemu to emulate non linux-embedded device and i found a other ask/question in Stackexchange talking about Unicorn Framework. so i going to test Unicorn Framework to check if the answer is here.

Post about Emulating Non-Linux Embedded device.

I found the bootloader generic code here. so if anybody have news or something to help me to go to the right way thanks you to give me answers.

Regards,

Improve this question
2
  • Hi @DavidMartins and welcome to RE.SE. I edited your question in order to - hopefully - make it more understandable. While when taking notes for yourself you can do whatever you like, please keep in mind that here you are posing a question for others to read and comprehend. Many of us (including myself) are not native speakers of English, but punctuation will go a long way in separating parts of sentences or sentences and aid in understanding what you ask.
    – 0xC0000022L ♦
    Jul 10, 2018 at 8:48
  • @sudhackar Thank you for you suggestions. Suggestions Approved Thanks i hope replies
    – David Martins
    Jul 10, 2018 at 16:58

1 Answer 1

Reset to default
1

Unfortunately QEMU is not well suited for your use case. As explained in your addendum, it is mostly used to emulate embedded Linux systems, that’s why there are many assumptions in its code: that the kernel is a Linux kernel (i.e. an ELF file) and the disk image contains a Linux rootfs. In addition, the specific hardware configurations (“machines”) emulated by QEMU are mostly limited to those that are supported by Linux. That does not mean that it can’t emulate non-Linux systems or hardware not supported by Linux, but to support anything unusual or non-mainstream you’ll probably have to do some coding, either to add support for your specific hardware or for the firmware layout you have so that QEMU can emulate it properly using the framework that already exists inside the code. However, using unmodified QEMU build is likely not enough for your use case. If you want to try your hand at extending QEMU I’d recommend you to contact the developers, e.g. on their mailing list for concrete recommendations. I’m afraid such work is outside of scope of this site so I’m finishing my answer here.

Improve this answer
1
  • Thank you so much to reply to my question, well actually a tried to build a kernel to see if the Qemu can support the fs (File Systems) but for now nothing happened. If i get some result and if the Qemu community give me some help i reply here and mark a update in my question. Rgds
    – David Martins
    Jul 17, 2018 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.