Process Immediately Killed

Question

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment.

Here's what file shows: ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped

I've tried running it on Linux using qemu and the process immediately terminates with the message "Killed". Running strace ./executable returns this:

execve("./executable", ["./executable"], [/*13 vars */] <unfinished ...> +++ killed by SIGKILL +++ Killed

I'm using the Debian Wheezy image from here: https://people.debian.org/~aurel32/qemu/armel/

Any ideas why this is happening?

Answer 1

The process may send itself (or it's child processes) the SIGTERM signal as part of an anti-debugging trick. Hunting for that will require you to search for signal-sending APIs like kill and how/when they're being used by the application.

A more simple solution, that is not necessarily RE related, could be that the process is killed by the OOM killer.

To test that, you can run mesg | egrep -i “killed process” inside the emulated machine.

If that's the case, you can easily disable it (add vm.oom-kill = 0 in /etc/sysctl.conf).