Debugging ARM binary with IDA Pro and Qemu

Question

I am debugging an ARM binary using IDA Pro by connecting to QEMU (remote gdb debugging).

In gdb configuration, I am selecting ARM_versatilepb as the device.

Now, I am able to successfully debug the ARM binary. However, I am unable to execute the syscalls like fork(), socket() and so on in the binary.

I think the reason for this is that I am using a bare metal config of QEMU. So, how do I modify this configuration to have a full Linux system running on QEMU so that I can execute syscalls as well?

There is another device name, ARM_Linux in the gdb_arch.cfg file of IDA Pro which has the arm_root.img parameter passed in the command line.

I selected this device but even then, unable to execute the syscalls.

The bare metal configuration I am using at present is detailed here.

Answer 1

It sounds like you are trying to emulate an ARM ELF binary by running it directly in qemu-system-arm, in which case the reason that syscalls don't work is that there is no Linux kernel to handle these syscalls.

What you are probably looking for is qemu-arm, which runs the ARM binary as a normal ELF, translating ARM syscalls to your underlying Intel kernel. The qemu-arm emulator has a built-in GDB server that IDA can connect to.

Alternatively, you can get an ARM Linux system (such as Debian, or maybe there's a raspi release designed to run in Qemu?) running in qemu-system-arm, at which point you can just copy your ELF binary to the Qemu VM and run it there. You can then attach IDA to the running process using GDB server or the Linux ARM debugging stub included with IDA.