Questions tagged [qemu]

QEMU is a software that performs CPU emulation through dynamic binary translation. It allows the execution of applications compiled for a certain specific architecture to run on other architectures.

Filter by
Sorted by
Tagged with
0
votes
0answers
48 views

Radare2 not showing memory value correctly

I am debugging a bootloader running on QEMU i386. The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens. ...
1
vote
0answers
41 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
0answers
38 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
0
votes
0answers
54 views

Log all syscalls inside a qemu vm

I am looking for a way to trace all syscalls which are triggered inside a qemu linux virtual machine. I have no strace command inside the linux vm Is there a way to do that ? Thanks
2
votes
0answers
65 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
0
votes
2answers
415 views

QEMU fpu mode error when attempting to run MIPS binary

I have unpacked a firmware binary using binwalk and have identified the architecture as MIPS by running file bin/busybox . When I try to run the binary with the proper static version of qemu, i get an ...
2
votes
1answer
274 views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
2
votes
1answer
74 views

Weird qemu behaviour with Freescale Coldfire MCF5282

I'm trying reverse engineer the firmware, apparently bare metal, of an industrial controller. The device is based on a Coldfire controller, to be more precise, the MCF5282. To track its behavior, I ...
5
votes
1answer
2k views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
5
votes
2answers
273 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
1
vote
1answer
619 views

*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,… file firmware)

I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files. Example for: Amiko HD8150 2.4.43 emu ...
1
vote
1answer
62 views

Alter /proc/cmdline for QEMU emulated process

I am using qemu-arm to run a statically linked binary on an Ubuntu system. There is little to no chance of emulating the entire system. The binary reads /proc/cmdline as it starts up, to check for a ...
2
votes
1answer
753 views

Unable to boot ARM disk image

I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here). I was able to extract the contents of the image using ...
1
vote
1answer
474 views

gdb-multiarch Segmentation fault

I've followed the guide from Cross debugging for MIPS ELF with QEMU/toolchain to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-...
2
votes
0answers
902 views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
1
vote
1answer
147 views

library issue when running mips binary in a chrooted environment

Background In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
1
vote
1answer
506 views

Network support when emulating firmware with QEMU

Continuing from this question: Firmware analysis and file system extraction? I am trying to run the QNap firmware using QEmu. I have basically the same firmware as is used in the question above. My ...
1
vote
0answers
655 views

Debugging MIPS Binaries on Ubuntu 64-bit (version 14.04)

I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler. In order to understand the binary much better, I need to debug ...
2
votes
0answers
1k views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
4
votes
1answer
551 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
2
votes
0answers
718 views

LD_PRELOAD in QEMU user space emulation

I was trying to emulate a firmware and as a part of the process I was interested in knowing what device files are being registered using mknod. In order to intercept those calls I had created a shared ...
1
vote
1answer
1k views

Emulating Non-Linux Firmware Image of Embedded Devices

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
0
votes
1answer
719 views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
2
votes
0answers
524 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
1
vote
0answers
236 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
2
votes
1answer
4k views

Invalid ELF image for this architecture

I'm trying to load a Busybox binary with qemu-ppc-static with this command: sudo chroot . ./qemu-ppc-static ./bin/busybox And I get this error: /lib/ld.so.1: Invalid ELF image for this ...
5
votes
3answers
4k views

QEMU & router firmware

I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2 sudo qemu-...
5
votes
1answer
3k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and QEMU is ...
4
votes
1answer
634 views

Getting list of opcodes from PANDA trace

As answer to the post "Using QEmu monitor interface to extract execution traces from a binary?", one of the PANDA authors outlined how QUEMU may be used to record execution traces. I would like to do ...
4
votes
1answer
2k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
3
votes
0answers
291 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
5
votes
0answers
789 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
3
votes
1answer
2k views

Emulate juan DVR R7816 in Qemu

I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what ...
1
vote
0answers
905 views

Reverse Engineer firmware for Jffs2 filesystem in Qemu

I am looking at the firmware for my router C1000A/C1000A-D and I am having some difficulties in mounting and otherwise emulating this. From what I have read, the general process for reverse ...
1
vote
0answers
419 views

Debug function in MIPS .ko file (with IDA and Qemu)

I have a .ko file which I grabbed from a router (MSB MIPS), and I'm trying to debug a specific function inside it with IDA. Since i can't just "run" the ko file with QEmu, I tried to change its ...
18
votes
3answers
25k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
2
votes
0answers
984 views

USB not showing up on QNX in Qemu

I have spent some time reverse engineering a QNX 6.5.0 based system. I am pretty new to the Linux (Ubuntu) world and definitely new to QNX, Qemu, and embedded systems. Since the hardware is fairly ...
2
votes
1answer
967 views

How could using QEMU be useful in developing a driver for Linux?

Presently, I am trying to analyze a piece of hardware, to be specific the Broadcom 1570 PCI web cam inside a late MBPr 2013. I can pass through the device using QEMU, and have the gusest OS / VM ...
3
votes
0answers
999 views

Emulate TP-Link WR841N using Qemu

I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points. Following instructions ...
1
vote
1answer
6k views

How to debug ARM binary with IDA pro on Windows?

I'm newbie, I have a little knowledge of debugging x86 binary. However, I have to work with ARM. I'm getting stuck on install QEMU and can't debug an ARM binary. Thank you a lot for give me tutorials ...
14
votes
2answers
3k views

Using QEmu monitor interface to extract execution traces from a binary?

My original point was to build something a bit more powerful and generic than a PTRACE system call for Linux platforms. The problem with PTRACE is that it only run on your own system and architecture. ...
9
votes
1answer
10k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
1
vote
0answers
285 views

qemu and gdb error: could not load xml document

I'm trying to debug an application using Qemu for AARCH64 ./qemu-arm64-static -g 1234 file.bin When running GDB and connecting to the remote host, I get the following error message: $ ./aarch64-...