I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a problem is if the router's firmware is trying to use a physical device that QEMU doesn't emulate by default. My main goal is to emulate various routers' firmware and be able to connect to their webservers. Do any members of the reverse engineering community have a general guide to emulating routers with QEMU?
Add a comment
|
1 Answer
Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM devices. It's based on the venerable QEMU project. There's also firmware analysis toolkit which is a wrapper around firmadyne allowing you to automate some of the tasks.
However firmadyne is not without its pitfalls. Frequently, you will come across various firmware binaries that fail to emulate properly (like no network access) primarily due to the missing hardware in the emulated environment. In such cases manual tweaking may be necessary.
More often than not a full system emulation of the device is not always necessary in order to be able to interact with the web server. We can use binwalk to extract the filesystem and run the web-server using QEMU user mode emulation in a chrooted environment.