5

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it.

According to the strings command I can see some interesting words like system, sprintf, etc. And I know it's a MIPS file, But I'm not able to get something comprehensible in IDA.

Could anyone guide me to achieve this? Regards.

Improve this question
5
  • 1
    Could you add a little more information? Output from the file command would be a start, and a dump from readelf -e if it's an ELF would be helpful.
    – Mathew Hall
    Commented Aug 5, 2013 at 10:52
  • Some more info about what IDA gives you might be useful as well. Are there any errors or warnings? Are there no listed functions in the functions window, or does the disassembly not make sense? IDA is usually quite good at loading MIPS ELF files; if it's not an ELF, you'll have to do a bit more work to get a useful disassembly.
    – devttys0
    Commented Aug 5, 2013 at 11:12
  • This is the file output: index.cgi: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.12, with unknown capability 0xf41 = 0x756e6700, with unknown capability 0x70100 = 0x1040000, stripped . Also here is the readelf dump: pastebin.com/raw.php?i=YswCPtLq . I'm using IDA FREE with Wine and the error is Can't set the target processor type "mipsl".
    – Nucklear
    Commented Aug 5, 2013 at 12:10
  • 1
    IIRC the free version of IDA doesn't come with support for MIPS. You might want to take a look at this question for a list of alternatives. Failing that, binutils can at least give you a disassembly (via objdump).
    – Mathew Hall
    Commented Aug 5, 2013 at 12:33
  • @MathewHall: write this up as an answer. IDA Freeware indeed doesn't offer any processor module for MIPS or a loader for ELF, so that's the main obstacle. I think your answer is perfectly legit.
    – 0xC0000022L ♦
    Commented Aug 5, 2013 at 12:43

1 Answer 1

Reset to default
8

Expanding on my comment:

The Freeware IDA Pro doesn't support MIPS, so you won't be able to use it. If you can't use the paid versions of IDA, there are free alternatives.

As an example, using radare2 as an example, on the Debian MIPS binutils port:

$ file bin/objdump 
bin/objdump: ELF 32-bit MSB  executable, MIPS, MIPS-II version 1 (SYSV), 
dynamically linked (uses shared libs), for GNU/Linux 2.6.26,
BuildID[sha1]=d1d228509874377d7339cfd5b2f15db020e53b7b, stripped

Following this example, we get something like this:

[0x00403300]> [email protected]
[0x00403300]> ag > foo.dot
foo.dot created
[0x00403300]> !dot -Tpdf -o foo.pdf foo.dot
[0x00403300]> !open foo.pdf

Part of the graph

Note that the PDF this churns out is enormous, so you might want to just use pdf instead of ag produce textual output rather than dot files.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.