Extracted router file execution

Question

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After some research and effort I got QEMU running a Debian MIPS system with network access and USB support to copy the file in the emulated file system:

qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic -net tap -usb -device usb-host,hostbus=1,hostaddr=8

So I copied the file, changed the rwx attributes and tried to execute it, but without success

root@debian-mips:~/myfiles/# ./generator
-bash: ./generator: No such file or directory

The file actually exists if I list the contents of the directory. After that I did notice some missing libraries :

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => not found
    libd1.so.2 => /lib/libd1.so.2 (0x2ac2d000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2ac41000)
    libc.so.6 => /lib/libc.so.6 (0x2ac67000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)

So I copied the missing libc.so.0 from the extracted router firmware files:

cp libc.so.0 /usr/lib

Then there was another missing file:

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => /usr/lib/libc.so.0 (0x2ac2d00)
    libd1.so.2 => /lib/libd1.so.2 (0x2ac8f000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2aca3000)
    libc.so.6 => /lib/libc.so.6 (0x2acc9000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)
    ld-uClibc.so.0 => not found

Copied it again from the router extracted firmware:

cp ld-uClibc.so.0 /usr/lib

Everything seemed OK at this point:

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => /usr/lib/libc.so.0 (0x2ac2d00)
    libd1.so.2 => /lib/libd1.so.2 (0x2ac8f000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2aca3000)
    libc.so.6 => /lib/libc.so.6 (0x2acc9000)
    ld-uClibc.so.0 => /usr/lib/ld-uClibc,so,0 (0x2ae4b000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)

However, I am still unable to execute the file. Some additional info about it:

root@debian-mips:~/myfiles# file generator
generator: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), stripped

I did mess around a bit more with the library files deleting those i copied and tried something like this :

ln -s /lib/libc.so.6 /lib/libc.so.0

root@debian-mips:~/myfiles# ldd generator
    libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)
    libc.so.0 => /lib/libc.so.0 (0x2ac2d000)
    libd1.so.2 => /lib/libd1.so.2 (0x2adaf000)
    libz.so.1 => /usr/lib/libz.so.1 (0x2adc3000)
    /lib/ld-uClibc.so.0 => /lib/ld.so.1 (0x55550000)

Still the same disappointing "no such file or directory message"... Any kind of help would be appreciated cause it feels like a dead end after all this...

---

@ SYS_V It appear that the Debian Mips distro didnt have strace and apt-get install was failing. I had to manually find it and dpkg it so after all that gives :

[11036.872000] ------------[ cut here ]------------

[11036.884000] WARNING: at /build/linux-2.6-KrPu_f/linux-2.6-2.6.32/debian/build/source_mips_none/kernel/sched.c:2628 wake_up_process+0x48/0x50()

[11036.904000] Modules linked in: ipv6 loop mtdchar uhci_hcd ehci_hcd cfi_cmdset_0001 cfi_probe gen_probe cfi_util sg physmap mtd psmouse i2c_piix4 usbcore se_mood chipreg serio_raw evdev map_funcs nls_base cdrom i2c_core

[11037.180000] Call Trace:

[11037.196000] [<8010bb24>] dump_stack+0x8/0x34

[11037.208000] [<80138a10>] warn_slowpath_common+0x70/0xb0

[11037.216000] [<8013534c>] wake_up_process+0x48/0x50

[11037.232000] [<801116ac>] arch_ptrace+0x214/0x770

[11037.244000] [<801457e8>] sys_ptrace+0x9c/0x260

[11037.256000] [<80102210>] stack_done+0x20/0x3c

[11037.268000]

[11037.280000] ---[ end trace a7daf16cd1f695f3 ]---

[11823.624000] CE: MIPS Increasing min_delta_ns to 51830 nsec

[11823.624000] CE: MIPS Increasing min_delta_ns to 77744 nsec

and prompts right there infinitely and needs ctrl+c to return to linux prompt.

Answer 1

As far as I understand, you need to execute just one MIPS binary. There is an easy route and a hard (relatively) route.

Easy route:

For executing just one MIPS binary, you might get away with Qemu Usermode emulation.

I've written a blog post about this in detail.

Zerodayinitiative also have a great blog post about this.

Since you are dealing with a binary compiled for MSB (Big Endian) systems, you need to extract the router's compressed filesytem from the firmware,then chroot into the extacted file system and run qemu-mips-static from inside the file system.

This toolset can be installed using sudo apt install qemu-user-static in Debian based systems.

For instance, if thegenerator MIPS binary you want to run was statically compiled, then you can execute the binary using the following comamnds, without fully emulating the firmware.

cd filesystem/
cp $(which qemu-mips-static) .
sudo chroot . ./qemu-mips-static bin/ls

Now, since your binary is a dynamically linked binary, we can specify the path to the missing library file using the LD_PRELOAD or LD_LIBRARY_PATH environment variable to qemu-user-static.

Eg:

sudo chroot . ./qemu-mips-static -E LD_LIBRARY_PATH="/lib/" bin/ls

If the generator binary doesn't require any network traffic or some weird state for the router to work correctly, then passing the LD_PRELOAD or LD_LIBRARY_PATH environment variables might just solve your issue.

However, if the binary requires some specific state, that can only be acheived through full system emulation, then you have to go the harder route.

Hard route:

I'm going to be honest with you.

I've tried emulating firmwares using QEMU and from my personal experience, it was very hard. So, for easier emulation experience, we have to rely on tools like Firmware Analysis Toolkit and Firmadyne.

This topic was also covered in detail on my blog post. Read that if you want an elaborate explanation and some basic troubleshooting tips.

Firmware Analysis Toolkit is the easiest to work with and it is an automator script for Firmadyne. Either clone FAT from the github repo, or you can just download AttifyOS‘s Virtual machine file for a pre-configured environment.

Once FAT has been installed, copy the firmware file into FAT’s directory. We just need to edit the fat.config file and enter the sudo password in it.

Running FAT is a ONE-TIME PROCESS and once the initial extraction and emulation is succesful, we can run further emulations from Firmadyne’s folder.

Now run the python script named fat.py and pass the firmware’s name to it. Eg:

./fat.py firmware.tar

If everything went right, then you will see a login console to the emulated router!

Login to the router with the console or access the emulated router's web interface by the IP address shown by FAT.

For the subsequent executions, run firmadyne/scratch/<image-id>/run.sh script; where the image-id is the number shown, when running FAT for the first time.

Answer 2

Try to compare your firmware binary and any "malta" binary using readelf to find differences.

Example:

$ readelf -a gdb | more
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x431fd0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          4016720 (bytes into file)
  Flags:                             0x5, noreorder, cpic, mips1
...

Answer 3

A simpler way, since you have the firmware image, is to chroot into the device's root file system (e.g. # chroot path/to/firmware /bin/sh). This will alleviate any dynamic loading issues that may be tedious to fix.

The only requirement is that you have the qemu binary installed for the correct architecture.