I have a .ko file which I grabbed from a router (MSB MIPS), and I'm trying to debug a specific function inside it with IDA.

Since i can't just "run" the ko file with QEmu, I tried to change its header to make QEmu think It's an ELF executable. By doing this, I was able to run and connect with IDA (with warnings of course) but when I do the first step inside the function I get "SIGSEGV" signal.

My setup is:

  • Ubuntu host with statically compiled qemu-mips

  • VM with IDA PRO

BTW, the function I'm trying to debug is not using any hardware.

I hope you can point me to the right direction.

  • I doubt you are doing it the right way... First of all, there are several debugging facilities that you can find in the Linux kernel that are much more helpful than trying to disassemble a module to find the bug. Second, you do not give enough insight of your problem and on what you already tried to make it easy to answer. So, try to be a bit more explicit and give examples. But, look at kgdb or other kernel hacking tricks, it is more likely to help you. – perror Jul 21 '15 at 7:57
  • Inside this module there is a function that inserts modified data inside the WIFI packet. I'm trying to understand how this function works by running it and giving it my own parameters. – user4724 Jul 21 '15 at 8:09
  • The function you're debugging doesn't exist out of nowhere; it's bound to have some input parameters, some of which may be pointers, and these pointers need to point somewhere, probably a WIFI packet. You'll probably have to change back the header to make the object a loadable dll, write a main() function that sets up the packet, and call your function from there (passing sensible parameters), either by linking your main program against the .so, or by using the dlopen() family of functions. – Guntram Blohm Jul 21 '15 at 11:28
  • I've already determined the function's parameters. Since this function gets only strings and ints I was planning on inserting the parameters on-the-fly (insert them to the memory, and change the registers values). This function can run by itself, it's just encrypting some data (some xor's and sll's). If it was an ELF executable, I could just run it with QEmu-GDB and change the $pc to the function's address. I'm facing issues because it's a .ko file. I don't want to create and compile asm file with this function as main, but running it directly from the ko file. – user4724 Jul 21 '15 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.