11

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/mips/.

Then, I started Qemu with these parameters:

qemu-system-mips -M malta -kernel 'vmlinux-2.6.32-5-4kc-malta' -hda 'rootfs.img' -append "root=/dev/sda1 console=tty0" -nographic

And it got stuck on:

[0.000000] console [tty0] enabled, bootconsole disabled

I've also tried to run it like this:

sudo qemu-system-mips -M malta -initrd 'rootfs.img' -kernel 'vmlinux-2.6.32-5-4kc-malta' -nographic -append "console=ttyS0,115200 root=/dev/sda rootfstype=jffs2 init=/sbin/init" -hda 'hda.img'

and I get this error:

[    0.796000]  sda: unknown partition table
[    0.808000] sd 0:0:0:0: [sda] Attached SCSI disk
[    0.812000] RAMDISK: squashfs filesystem found at block 0
[    0.812000] RAMDISK: Loading 2556KiB [1 disk] into ram disk... done.
[    0.928000] VFS: Cannot open root device "sda" or unknown-block(8,0)
[    0.928000] Please append a correct "root=" boot option; here are the available partitions:
[    0.928000] 0800           65536 sda driver: sd
[    0.932000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,0)

New try after answer from 6EQUJ5 [I still get the same error though (the second one)]:

This is what I'm trying:

sudo qemu-system-mips -M malta -kernel 'vmlinux-2.6.32-5-4kc-malta' -nographic -append "init=/bin/sh" -hda 'myFileSystem.img'

And this is a link to download the filesystem I've created:

http://speedy.sh/vBUEQ/myFileSystem.img

Running "file" on my filesystem:

Linux rev 1.0 ext2 filesystem data (mounted or unclean), UUID=dac7072e-2c8b-408f-a080-57ea60cfd9ea

Those are the commands I've used to create it and move the files into it:

dd if=/dev/zero of=~/myFileSystem.img bs=1024 count=65536
mke2fs myFileSystem.img
mkdir /mnt/virtual
mount -o loop ~/myFileSystem.img /mnt/virtual
Improve this question
1
  • With the second error, the kernel thinks don't have a valid partition table and/or filesystem on your hda.img. How did you create that file? If you make hda.img an ext2 filesystem and copy an init into it and leave off the -initrd argument you may get a little further booting, although you wont be emulating the WR740N at all by then...
    – 6EQUJ5
    May 30, 2014 at 0:29

1 Answer 1

Reset to default
6

I was able to get that firmware to a shell by doing the following:

  1. Unpacking the squashfs image
  2. Create a filesystem image formatted to ext2 and copying the unpacked squashfs contents into that, and using that as -hda
  3. Running without -initrd ... and appending init=/bin/sh to the kernel command line

Although you are not fully emulating the WR740N because most of the hardware is missing and it is a different kernel. Emulating a router in qemu is always going to be a partial process because of that.

Improve this answer
5
  • Thank you! I still have the same error though (full answer below)
    – user4724
    Jun 1, 2014 at 6:16
  • 1
    Dont forget to keep root=/dev/sda
    – 6EQUJ5
    Jun 1, 2014 at 13:00
  • Thank you very much, that was my problem. I've changed the "init=/bin/sh" to "init=/sbin/init" and then typed: user - root | password - 5up , to get a shell (maybe will help others). I've tried to connect it to the net (with "tap") but when I type udhcpc -i br-lan I get the following error: error, SIOCGIFINDEX failed!: No such device. I guess that it doesn't recognize my card, but i don't know how to solve it. At the end, what i want to do is debug the webserver (httpd) with IDA. Maybe it would be better to run Debian MIPS in qemu and then upload the router's files? thank you in advance.
    – user4724
    Jun 1, 2014 at 16:05
  • Glad that helped, dont forget to accept the answer :-) If you have further questions, these sites work best if you post them separately...
    – 6EQUJ5
    Jun 2, 2014 at 0:14
  • Answer need to unpack these steps - how ext2 image was made and what kernel command line was used.
    – philcolbourn
    Aug 31, 2018 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.