I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs
extension file) in Qemu. So I tried to unpack the .abs
file I got many files.
Example for: Amiko HD8150 2.4.43 emu Firmware.
Software used: Ali Main Code Decrypter 8.9
Files unpacked:
- bootloader
- MemCfg
- maincode(AV)
- seecode
- default_lang
- cipluskey
- countryband
- logo_user
- logo_menu
- logo_radio
- logo_boot
- patch
- defaultdb(PRC)
- userdb(64+64)
Software used: binwalk
TERMINAL OUTPUT:
# binwalk -e AMIKO_HD8150_2.4.43_emu.abs
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
196736 0x30080 LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 11883876 bytes
3866752 0x3B0080 LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 3255512 bytes
5636224 0x560080 LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 87904 bytes
Files unpacked:
- 30080
- 3B0080
- 560080
When I open the 30080 file with hexdump I can see this at the end:
# hexdump -C
part of file
00b51a30 00 00 00 00 4c 69 62 63 6f 72 65 20 76 65 72 73 |....Libcore vers|
00b51a40 69 6f 6e 20 31 33 2e 31 36 2e 30 40 53 44 4b 34 |ion 13.16.0@SDK4|
00b51a50 2e 30 66 61 2e 31 33 2e 31 36 5f 32 30 31 36 31 |.0fa.13.16_20161|
00b51a60 30 31 39 28 67 63 63 20 76 65 72 73 69 6f 6e 20 |019(gcc version |
00b51a70 33 2e 34 2e 34 20 6d 69 70 73 73 64 65 2d 36 2e |3.4.4 mipssde-6.|
00b51a80 30 36 2e 30 31 2d 32 30 30 37 30 34 32 30 29 28 |06.01-20070420)(|
00b51a90 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 40 20 46 |Administrator@ F|
00b51aa0 72 69 2c 20 4a 75 6c 20 32 38 2c 20 32 30 31 37 |ri, Jul 28, 2017|
00b51ab0 20 31 32 3a 35 33 3a 32 38 20 41 4d 29 0a 00 00 | 12:53:28 AM)...|
00b51ac0 44 4d 58 5f 53 33 36 30 31 5f 30 00 00 a1 03 18 |DMX_S3601_0.....|
When I use readelf
it says this file isn't an ELF file.
So I tried to open the bin 30080 in the qemu
(Win64) but it doesn't start the emulation.
C:\Program Files\qemu>qemu-system-mips.exe -machine mips -cpu mips32r6-generic -drive file=C:\30080.bin,index=0,media=disk,format=raw
qemu-system-mips.exe: warning: could not load MIPS bios 'mips_bios.bin'
So I think something is wrong. Well I know the kernel is missing but how can I know the correct kernel for this firmware. Has someone tried to open (emulate) a STB firmware in Qemu before? Do you think I need to create an image with bin files or emulate as rs232 flash ?
Sorry for all this questions I never used Qemu before.
UPDATE #1
So i tested some differents emulators like Firmadyne and Qemu, and now i can point the *.abs is not a linux embedded firmware like dreambox, so i opened a issue ticket in the fimadyne and qemu about my issues to can do a emulation with the *.abs or *.bin files from STB Receivers like (Amiko,Openbox,Skybox,AZbox, Cryptobox,etc...).
And now i just received some replies in Firmadyne Github.
Firmadyne ticket issue about *.abs or *.bin emulation
because when i tried to open binary and/or *.abs files he shows a error about extraction.
So here he go the issue i have in the Firmadyne
Terminal OUTPUT:
root@ns2:/Firmware/firmadyne# ./sources/extractor/extractor.py -b Amiko -sql 127.0.0.1 -np -nk "AMIKO_HD8150_2.4.43_emu.zip" images
root@ns2:/Firmware/firmadyne# >> Database Image ID: 2
root@ns2:/Firmware/firmadyne/AMIKO_HD8150_2.4.43_emu.zip
root@ns2:>> MD5: 17c266121d5568340ef927c211fcc4f4
root@ns2:>> Tag: 2
root@ns2:>> Temp: /tmp/tmpOqzn89
root@ns2:>> Status: Kernel: True, Rootfs: False, Do_Kernel: False, root@ns2:Do_Rootfs: True
root@ns2:>>>> Zip archive data, at least v2.0 to extract, compressed size: root@ns2:4454941, uncompressed size: 8388608, name: AMIKO_HD8150_2.4.43_emu.abs
root@ns2:>> Recursing into archive ...
root@ns2:/tmp/tmpOqzn89/_AMIKO_HD8150_2.4.43_emu.zip.extracted/rlz_notes.txt
root@ns2:>> MD5: aa5c7dd374bf981442deb5fa67e7189e
root@ns2:>> Skipping: text/plain...
root@ns2:/tmp/tmpOqzn89/_AMIKO_HD8150_2.4.43_emu.zip.extracted/AMIKO_HD8150_2.4.43_emu.abs
root@ns2:>> MD5: dc6b86caa2c55d18a43ca9ad9053bc77
root@ns2:>> Tag: 2
root@ns2:>> Temp: /tmp/tmpBNDrbm
root@ns2:>> Status: Kernel: True, Rootfs: False, Do_Kernel: False, root@ns2:Do_Rootfs: True
root@ns2:>> Recursing into archive ...
**root@ns2:>>>> Extraction failed!**
root@ns2:>>>> LZMA compressed data, properties: 0x6C, dictionary size: root@ns2:8388608 bytes, uncompressed size: 11883876 bytes
root@ns2:>> Recursing into compressed ...
AND A LOT OF OTHER MESSAGES ABOVE
So after this issue i opened a issue ticket in Gihub and they told me this *.abs or *.bin files is not a linux embedded device so i googled again about qemu to emulate non linux-embedded device and i found a other ask/question in Stackexchange talking about Unicorn Framework. so i going to test Unicorn Framework to check if the answer is here.
Post about Emulating Non-Linux Embedded device.
I found the bootloader generic code here. so if anybody have news or something to help me to go to the right way thanks you to give me answers.
Regards,