5

I am debugging an ARM binary using IDA Pro by connecting to QEMU (remote gdb debugging).

In gdb configuration, I am selecting ARM_versatilepb as the device.

Now, I am able to successfully debug the ARM binary. However, I am unable to execute the syscalls like fork(), socket() and so on in the binary.

I think the reason for this is that I am using a bare metal config of QEMU. So, how do I modify this configuration to have a full Linux system running on QEMU so that I can execute syscalls as well?

There is another device name, ARM_Linux in the gdb_arch.cfg file of IDA Pro which has the arm_root.img parameter passed in the command line.

I selected this device but even then, unable to execute the syscalls.

The bare metal configuration I am using at present is detailed here.

  • For Qemu and ARM I'm not aware of such a thing, but there is such a mechanism to supply mock functions for Bochs-Debugging. Look inside plugins/bochs for more information. Igor is probably best suited to answer this. Perhaps no one ever asked for this feature? – 0xC0000022L Aug 19 '13 at 11:04
6

It sounds like you are trying to emulate an ARM ELF binary by running it directly in qemu-system-arm, in which case the reason that syscalls don't work is that there is no Linux kernel to handle these syscalls.

What you are probably looking for is qemu-arm, which runs the ARM binary as a normal ELF, translating ARM syscalls to your underlying Intel kernel. The qemu-arm emulator has a built-in GDB server that IDA can connect to.

Alternatively, you can get an ARM Linux system (such as Debian, or maybe there's a raspi release designed to run in Qemu?) running in qemu-system-arm, at which point you can just copy your ELF binary to the Qemu VM and run it there. You can then attach IDA to the running process using GDB server or the Linux ARM debugging stub included with IDA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.