Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [qemu]

QEMU is a software that performs CPU emulation through dynamic binary translation. It allows the execution of applications compiled for a certain specific architecture to run on other architectures.

3
votes
1answer
103 views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
4
votes
2answers
146 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
1
vote
1answer
273 views

*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,… file firmware)

I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files. Example for: Amiko HD8150 2.4.43 emu ...
1
vote
1answer
47 views

Alter /proc/cmdline for QEMU emulated process

I am using qemu-arm to run a statically linked binary on an Ubuntu system. There is little to no chance of emulating the entire system. The binary reads /proc/cmdline as it starts up, to check for a ...
2
votes
1answer
494 views

Unable to boot ARM disk image

I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here). I was able to extract the contents of the image using ...
1
vote
1answer
304 views

gdb-multiarch Segmentation fault

I've followed the guide from Cross debugging for MIPS ELF with QEMU/toolchain to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-...
2
votes
0answers
587 views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
1
vote
1answer
107 views

library issue when running mips binary in a chrooted environment

Background In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
1
vote
1answer
403 views

Network support when emulating firmware with QEMU

Continuing from this question: Firmware analysis and file system extraction? I am trying to run the QNap firmware using QEmu. I have basically the same firmware as is used in the question above. My ...
1
vote
0answers
424 views

Debugging MIPS Binaries on Ubuntu 64-bit (version 14.04)

I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler. In order to understand the binary much better, I need to debug ...
3
votes
0answers
704 views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
5
votes
1answer
379 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
1
vote
0answers
474 views

LD_PRELOAD in QEMU user space emulation

I was trying to emulate a firmware and as a part of the process I was interested in knowing what device files are being registered using mknod. In order to intercept those calls I had created a shared ...
1
vote
1answer
791 views

Emulating Non-Linux Firmware Image of Embedded Devices

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
0
votes
1answer
463 views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
2
votes
0answers
431 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
1
vote
0answers
198 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
2
votes
1answer
3k views

Invalid ELF image for this architecture

I'm trying to load a Busybox binary with qemu-ppc-static with this command: sudo chroot . ./qemu-ppc-static ./bin/busybox And I get this error: /lib/ld.so.1: Invalid ELF image for this ...
5
votes
3answers
3k views

QEMU & router firmware

I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2 sudo qemu-...
5
votes
1answer
2k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and QEMU is ...
5
votes
1answer
474 views

Getting list of opcodes from PANDA trace

As answer to the post "Using QEmu monitor interface to extract execution traces from a binary?", one of the PANDA authors outlined how QUEMU may be used to record execution traces. I would like to do ...
3
votes
0answers
1k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
3
votes
0answers
266 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
6
votes
0answers
693 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
3
votes
1answer
1k views

Emulate juan DVR R7816 in Qemu

I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what ...
1
vote
0answers
786 views

Reverse Engineer firmware for Jffs2 filesystem in Qemu

I am looking at the firmware for my router C1000A/C1000A-D and I am having some difficulties in mounting and otherwise emulating this. From what I have read, the general process for reverse ...
1
vote
0answers
361 views

Debug function in MIPS .ko file (with IDA and Qemu)

I have a .ko file which I grabbed from a router (MSB MIPS), and I'm trying to debug a specific function inside it with IDA. Since i can't just "run" the ko file with QEmu, I tried to change its ...
15
votes
3answers
17k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
2
votes
0answers
800 views

USB not showing up on QNX in Qemu

I have spent some time reverse engineering a QNX 6.5.0 based system. I am pretty new to the Linux (Ubuntu) world and definitely new to QNX, Qemu, and embedded systems. Since the hardware is fairly ...
2
votes
1answer
828 views

How could using QEMU be useful in developing a driver for Linux?

Presently, I am trying to analyze a piece of hardware, to be specific the Broadcom 1570 PCI web cam inside a late MBPr 2013. I can pass through the device using QEMU, and have the gusest OS / VM ...
2
votes
0answers
825 views

Emulate TP-Link WR841N using Qemu

I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points. Following instructions ...
1
vote
1answer
6k views

How to debug ARM binary with IDA pro on Windows?

I'm newbie, I have a little knowledge of debugging x86 binary. However, I have to work with ARM. I'm getting stuck on install QEMU and can't debug an ARM binary. Thank you a lot for give me tutorials ...
14
votes
2answers
3k views

Using QEmu monitor interface to extract execution traces from a binary?

My original point was to build something a bit more powerful and generic than a PTRACE system call for Linux platforms. The problem with PTRACE is that it only run on your own system and architecture. ...
9
votes
1answer
9k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
1
vote
0answers
251 views

qemu and gdb error: could not load xml document

I'm trying to debug an application using Qemu for AARCH64 ./qemu-arm64-static -g 1234 file.bin When running GDB and connecting to the remote host, I get the following error message: $ ./aarch64-...