Questions tagged [qemu]
QEMU is a software that performs CPU emulation through dynamic binary translation. It allows the execution of applications compiled for a certain specific architecture to run on other architectures.
59
questions
1
vote
0
answers
49
views
How to debug armel and armhf binaries on x86-64 Ubuntu simultaneously?
I'm working on the challenges on ROP Emporium. For the ARMv5 version of the callme challenge, we are given two binaries and two shared libraries: callme_armv5 with libcallme_armv5.so and callme_armv5-...
- 151
2
votes
0
answers
125
views
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
- 21
0
votes
1
answer
1k
views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
- 1
2
votes
0
answers
235
views
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
- 121
1
vote
0
answers
74
views
Handle Ioctl call while running with qemu
I am using qemu to emulate a binary like this
qemu -strace XXXXX .
I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages
Get and set terminal attributes
...
- 21
1
vote
1
answer
192
views
Debug bFLT in qemu-arm-static
I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static .
I want to debug that binary dynamically with GDB.
I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
1
answer
233
views
Run ntoskrnl.exe with qemu
We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu.
Also can .efi files ...
- 11
2
votes
0
answers
873
views
How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?
TL;DR:
Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file.
Long Version:
- What I have:
A cheap ...
- 51
2
votes
0
answers
159
views
QEMU with GDB: Stepping Instruction causes Windows VM BSOD
I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing.
I have ...
- 21
0
votes
1
answer
147
views
error shmat function when simulating MIPS file in Qemu
I want to run (simulating) MIPS file with Qemu:
$file httpd
httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header
...
- 177
0
votes
0
answers
116
views
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
- 73
1
vote
1
answer
664
views
GDBserver on Qemu not honoring "follow-fork-mode child"
I am using gdb-multiarch version 9.1 on Ubuntu to connect to a qemu-mipsel-static version 4.2.0 running a MIPS application which daemonizes itself with fork(), and which is running the built-in ...
- 11
4
votes
3
answers
949
views
inspecting c-sky elf application
I am new to reverse engineering , but as I am home these days , I wanted to hack my sat receiver. The receiver is based on c-sky v1 architecture'
Searching forums, I managed to get the firmware ...
- 41
0
votes
2
answers
3k
views
ld-uClibc.so.0: No Such file or directory when running qemu-mipsel-static
BLUF: When executing sudo chroot . ./qemu-mipsel-static ./bin/busybox from the squashfs-root folder the error /lib/ld-uClibc.so.0: No such file or directory is returned. Failing to figure out how to ...
- 1
4
votes
0
answers
159
views
QEMU Translation block
I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so ...
- 1,410
2
votes
1
answer
2k
views
`qemu-mips-static` chroot causing `Invalid ELF image` error
I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image.
kan3k1@kaido:~/...
- 133
1
vote
0
answers
241
views
Strange behaviour debugging Android ARM binary with gdbserver
I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
- 133
0
votes
1
answer
168
views
Radare2 not showing memory value correctly
I am debugging a bootloader running on QEMU i386.
The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens.
...
- 101
1
vote
0
answers
216
views
Debugging arbitrary ARM binary image using IDA and QEMU
i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
- 21
1
vote
0
answers
180
views
How can I emulate Huawei routers HG5xx firmware?
i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
- 180
4
votes
0
answers
356
views
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.
qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
- 141
1
vote
2
answers
714
views
QEMU fpu mode error when attempting to run MIPS binary
I have unpacked a firmware binary using binwalk and have identified the architecture as MIPS by running file bin/busybox . When I try to run the binary with the proper static version of qemu, i get an ...
- 123
2
votes
1
answer
4k
views
GDB: Could not load shared library symbols
I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here:
https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
- 23
2
votes
1
answer
279
views
Weird qemu behaviour with Freescale Coldfire MCF5282
I'm trying reverse engineer the firmware, apparently bare metal, of an industrial controller. The device is based on a Coldfire controller, to be more precise, the MCF5282. To track its behavior, I ...
- 335
8
votes
1
answer
9k
views
Emulating Routers and other Embedded Devices with QEMU
I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
- 105
8
votes
3
answers
926
views
Extracted router file execution
I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
- 81
1
vote
1
answer
2k
views
*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,... file firmware)
I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files.
Example for: Amiko HD8150 2.4.43 emu ...
1
vote
1
answer
144
views
Alter /proc/cmdline for QEMU emulated process
I am using qemu-arm to run a statically linked binary on an Ubuntu system. There is little to no chance of emulating the entire system.
The binary reads /proc/cmdline as it starts up, to check for a ...
- 1,762
2
votes
1
answer
1k
views
Unable to boot ARM disk image
I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here).
I was able to extract the contents of the image using ...
- 131
1
vote
1
answer
847
views
gdb-multiarch Segmentation fault
I've followed the guide from Cross debugging for MIPS ELF with QEMU/toolchain to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-...
- 101
2
votes
0
answers
2k
views
IDA Pro GDB QEMU Tricore setup
I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2):
https://www.hex-rays.com/products/ida/support/...
- 133
1
vote
1
answer
390
views
library issue when running mips binary in a chrooted environment
Background
In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
- 301
1
vote
1
answer
691
views
Network support when emulating firmware with QEMU
Continuing from this question:
Firmware analysis and file system extraction?
I am trying to run the QNap firmware using QEmu. I have basically the same
firmware as is used in the question above.
My ...
1
vote
0
answers
1k
views
Debugging MIPS Binaries on Ubuntu 64-bit (version 14.04)
I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler.
In order to understand the binary much better, I need to debug ...
- 765
2
votes
0
answers
2k
views
Using QEMU to boot arm uImage kernel
I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
- 21
4
votes
1
answer
1k
views
QEMU gdb server thread problem
I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
- 41
3
votes
0
answers
2k
views
LD_PRELOAD in QEMU user space emulation
I was trying to emulate a firmware and as a part of the process I was interested in knowing what device files are being registered using mknod. In order to intercept those calls I had created a shared ...
2
votes
1
answer
2k
views
Emulating Non-Linux Firmware Image of Embedded Devices
I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
- 397
1
vote
1
answer
2k
views
Reverse a BFLT file
A couple of days ago I bought an air conditioner.
The system has a wireless module. By analyzing the ports, I could see that port 22 is open.
I have obtained the file that is responsible for managing ...
- 13
3
votes
0
answers
1k
views
When to use qemu user mode versus system mode?
This seems to be a pretty basic question but I can't seem to find a good answer.
I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
- 101
1
vote
0
answers
304
views
All data in IDA Pro turns into zeros when using QEMU
I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program.
When I start debugging the firmware, windows pop up for QEMU.
...
3
votes
1
answer
13k
views
Invalid ELF image for this architecture
I'm trying to load a Busybox binary with qemu-ppc-static with this command:
sudo chroot . ./qemu-ppc-static ./bin/busybox
And I get this error:
/lib/ld.so.1: Invalid ELF image for this ...
- 31
5
votes
3
answers
7k
views
QEMU & router firmware
I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2
sudo qemu-...
- 51
6
votes
1
answer
5k
views
Unicorn and QEMU: Example use cases to understand the differences
The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines".
They furthermore write:
A notable difference between Unicorn and ...
- 1,550
4
votes
1
answer
868
views
Getting list of opcodes from PANDA trace
As answer to the post "Using QEmu monitor interface to extract execution traces from a binary?", one of the PANDA authors outlined how QUEMU may be used to record execution traces.
I would like to do ...
- 1,550
6
votes
1
answer
5k
views
How to log all memory accesses (read and write) including the memory content in a binary execution trace?
I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
- 1,550
3
votes
0
answers
371
views
Running vmlinux ELF under QEMU
I have a vmlinux ELF file to run under QEMU.
My arguments to qemu-system-arm.exe are:
The correct -cpu argument.
The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
- 403
5
votes
0
answers
1k
views
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed the tutorial IDA Help: Debugging code snippets with QEMU.
It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:
Should I adjust ...
- 51
3
votes
1
answer
2k
views
Emulate juan DVR R7816 in Qemu
I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what ...
- 31
1
vote
0
answers
1k
views
Reverse Engineer firmware for Jffs2 filesystem in Qemu
I am looking at the firmware for my router C1000A/C1000A-D and I am having some difficulties in mounting and otherwise emulating this. From what I have read, the general process for reverse ...
- 773