I want to run (simulating) MIPS file with Qemu:

$file httpd
httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header

chroot to rootfs and then run my file: enter image description here

i found oalShm_init function into libcms_core.so library and decompile it with ghidra:

enter image description here

first httpd file use shmget for create shard memory and then use shamt for give access to this space;

but Qemu error in this function and can't mapping or can't run it

how to i can resolve this problem?

2 Answers 2


From the man page:

The addr argument to shmat specifies a pointer value indicating the address at which the memory segment is to be attached. If addr is NULL , the segment will be attached at an address selected by the system. If addr is specified, shmat will fail if the segment cannot be attached as specified because memory is already allocated near the address specified


It seems the code expects 0x58800000 to be a valid address and it isn’t under QEMU.

You can try to either play with QEMU configuration to make it valid or patch the executable to use 0 instead so the address is determined by the system.


Seems to have been a bug in qemu-user: https://gitlab.com/qemu-project/qemu/-/issues/115

It's fixed in 9.x versions. As packages lag behind compiling qemu from source is probably needed.

There are a lot of weird bugs with user space emulation in general. Sometimes it's a good idea to spin up some light distro with qemu-system (and chroot to your target binaries/libraries) for a sanity check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.