4

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After some research and effort I got QEMU running a Debian MIPS system with network access and USB support to copy the file in the emulated file system:

qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic -net tap -usb -device usb-host,hostbus=1,hostaddr=8

So I copied the file, changed the rwx attributes and tried to execute it, but without success

root@debian-mips:~/myfiles/# ./generator
-bash: ./generator: No such file or directory

The file actually exists if I list the contents of the directory. After that I did notice some missing libraries :

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => not found
    libd1.so.2 => /lib/libd1.so.2 (0x2ac2d000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2ac41000)
    libc.so.6 => /lib/libc.so.6 (0x2ac67000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)

So I copied the missing libc.so.0 from the extracted router firmware files:

cp libc.so.0 /usr/lib

Then there was another missing file:

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => /usr/lib/libc.so.0 (0x2ac2d00)
    libd1.so.2 => /lib/libd1.so.2 (0x2ac8f000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2aca3000)
    libc.so.6 => /lib/libc.so.6 (0x2acc9000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)
    ld-uClibc.so.0 => not found

Copied it again from the router extracted firmware:

cp ld-uClibc.so.0 /usr/lib

Everything seemed OK at this point:

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => /usr/lib/libc.so.0 (0x2ac2d00)
    libd1.so.2 => /lib/libd1.so.2 (0x2ac8f000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2aca3000)
    libc.so.6 => /lib/libc.so.6 (0x2acc9000)
    ld-uClibc.so.0 => /usr/lib/ld-uClibc,so,0 (0x2ae4b000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)

However, I am still unable to execute the file. Some additional info about it:

root@debian-mips:~/myfiles# file generator
generator: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), stripped

I did mess around a bit more with the library files deleting those i copied and tried something like this :

ln -s /lib/libc.so.6 /lib/libc.so.0

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => /lib/libc.so.0 (0x2ac2d000)
    libd1.so.2 => /lib/libd1.so.2 (0x2adaf000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2adc3000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)

Still the same disappointing "no such file or directory message"... Any kind of help would be appreciated cause it feels like a dead end after all this...


@ SYS_V It appear that the Debian Mips distro didnt have strace and apt-get install was failing. I had to manually find it and dpkg it so after all that gives :

[11036.872000] ------------[ cut here ]------------

[11036.884000] WARNING: at /build/linux-2.6-KrPu_f/linux-2.6-2.6.32/debian/build/source_mips_none/kernel/sched.c:2628 wake_up_process+0x48/0x50()

[11036.904000] Modules linked in: ipv6 loop mtdchar uhci_hcd ehci_hcd cfi_cmdset_0001 cfi_probe gen_probe cfi_util sg physmap mtd psmouse i2c_piix4 usbcore se_mood chipreg serio_raw evdev map_funcs nls_base cdrom i2c_core

[11037.180000] Call Trace:

[11037.196000] [<8010bb24>] dump_stack+0x8/0x34

[11037.208000] [<80138a10>] warn_slowpath_common+0x70/0xb0

[11037.216000] [<8013534c>] wake_up_process+0x48/0x50

[11037.232000] [<801116ac>] arch_ptrace+0x214/0x770

[11037.244000] [<801457e8>] sys_ptrace+0x9c/0x260

[11037.256000] [<80102210>] stack_done+0x20/0x3c

[11037.268000]

[11037.280000] ---[ end trace a7daf16cd1f695f3 ]---

[11823.624000] CE: MIPS Increasing min_delta_ns to 51830 nsec

[11823.624000] CE: MIPS Increasing min_delta_ns to 77744 nsec

and prompts right there infinitely and needs ctrl+c to return to linux prompt.

  • can you show us the the output of strace ./generator? – julian Sep 26 '18 at 22:19
  • Make sure all dependencies for .sos are resolved recursively – user464014 Sep 27 '18 at 1:39
  • How did you dug it out? – KYHSGeekCode Sep 27 '18 at 4:37
0

Try to compare your firmware binary and any "malta" binary using readelf to find differences.

Example:

$ readelf -a gdb | more
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x431fd0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          4016720 (bytes into file)
  Flags:                             0x5, noreorder, cpic, mips1
...
  • I have enough reputation to comment myself only :) @Cyrax: vmlinux-2.6.32-5-4kc-malta is quite specific ELF-file. I meant compare your extracted file (generator) with any regular file (/bin/bash) from your debian-mips environment. Pay attention to string "Requesting program interpreter" in "Program Headers" section for both files. – Igor Matyuh Oct 2 '18 at 23:43
0

Some additional info that answers some of the questions above:

readelf -a vmlinux-2.6.32-5-4kc-malta | more

ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x80104300
  Start of program headers:          52 (bytes into file)
  Start of section headers:          5435392 (bytes into file)
  Flags:                             0x50001001, noreorder, o32, mips32
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         2
  Size of section headers:           40 (bytes)
  Number of section headers:         25
  Section header string table index: 22

I am not able to readelf the firmware itself or any of the extracted bin, jffs2 or filesystems that occur from the firmware file. I keep getting:

readelf: Error: Not an ELF file - it has the wrong magic bytes at the start

I can get it work on the file :

readelf -a generator  | more
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x400830
  Start of program headers:          52 (bytes into file)
  Start of section headers:          8340 (bytes into file)
  Flags:                             0x50001007, noreorder, pic, cpic, o32, mips
32
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         8
  Size of section headers:           40 (bytes)
  Number of section headers:         24
  Section header string table index: 23

The firmware file was extracted with binwalk. After the extraction i got a vmlinux.bin file and a jffs2. I extracted those again and now i have 5 directories fs_1 fs_2 fs_3 fs_4 fs_5. Some of those filesystems are completely empty, some contain the whole directory structure of a linux filesystem but with empty directories and 2 contain actual scripts and executable files, one of which is the one trying to execute.

  • Please don’t post updates as “answers” when they are not. Edit the question to add the details instead. – Igor Skochinsky Oct 2 '18 at 21:20

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.