Hot answers tagged

8 votes
Accepted

Unicorn and QEMU: Example use cases to understand the differences

What does "(not) emulating hardware other than the CPU" mean? This means that whenever the software being emulated accesses hardware, it won't work in Unicorn in the same way as on actual hardware. ...
Guntram Blohm's user avatar
8 votes
Accepted

Emulating Routers and other Embedded Devices with QEMU

Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM ...
0xec's user avatar
  • 6,030
7 votes
Accepted

Unable to boot ARM disk image

I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g ...
Joshua Wright's user avatar
4 votes

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I know that this question was asked some time ago, but here comes the solution working on Windows. Note: See the last section of this answer to get the solution for other systems and architectures. ...
bart1e's user avatar
  • 3,369
4 votes
Accepted

GDB: Could not load shared library symbols

Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there. ...
Chris Stratton's user avatar
3 votes

Running ELF file built for ARM arhitecture

“No such file or directory” is often printed by the shell when the dynamic interpreter of the executable is not found. You can find out which one it expects by using readelf-l.
Igor Skochinsky's user avatar
  • 36.2k
3 votes

inspecting c-sky elf application

Yes, that is the main app, telnet into the stb via network, user root, no password. You will find the stb has that block mounted as /dvb/out.elf which is this file. It's the main app, most command ...
Hca's user avatar
  • 41
3 votes
Accepted

Getting list of opcodes from PANDA trace

At the moment PANDA doesn't provide information about the instruction size (which isn't known before translation) at the level of an individual instruction. One thing you can do, however, is get the ...
Brendan Dolan-Gavitt's user avatar
3 votes

Emulate juan DVR R7816 in Qemu

Just the firmware and qemu won't help you much. When the firmware starts up, it will try to communicate with the hardware - initialize the network card, check which channels have cameras attached to ...
Guntram Blohm's user avatar
3 votes

QEMU gdb server thread problem

QEMU user-mode emulation (e.g. qemu-arm, qemu-arm-static) does not support debugging multiple threads simultaneously. You must use qemu-arm-system and run an entire ARM kernel. Separately, your QEMU ...
Zach Riggle's user avatar
  • 2,307
2 votes
Accepted

Reverse a BFLT file

bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls: Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC ...
Igor Skochinsky's user avatar
  • 36.2k
2 votes

Invalid ELF image for this architecture

You get this error message because the ELF is stripped. See qemu-vs-strip for more information. This problem is fixed in the latest QEMU, so you have to update your QEMU or compile the latest from ...
ebux's user avatar
  • 1,759
2 votes

QEMU & router firmware

Most MIPS/ARM based routers have a ROM bootloader that runs when the device is powered on. This bootloader is typically accessible via a serial port, but some platforms (like AR7) do weird things ...
LawrenceC's user avatar
  • 121
2 votes

Network support when emulating firmware with QEMU

Use the -net argument -net nic,model=rtl8139. Of course replace rtl8139 with your network device model (e1000, i82551, i82557b, ...) Further explanations are found on this Wiki Documentation
محمد جعفر نعمة's user avatar
2 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

qemu-system-mips full system emulation with Buildroot This method simulate the entire MIPS CPU and can overcome limitations mentioned with userland emulation at: https://reverseengineering....
Ciro Santilli OurBigBook.com's user avatar
2 votes

Run ntoskrnl.exe with qemu

Linux kernel can boot mostly on its own by probing the hardware and using the linked-in drivers. The NT kernel requires an environment such as UEFI or legacy BIOS and relies on it, for example, to ...
Igor Skochinsky's user avatar
  • 36.2k
2 votes

QEMU fpu mode error when attempting to run MIPS binary

According to the source code, the EABI from your ELF is not compatible. It seems to be specific to MIPS, you can find the structure here, this structure is stored inside a specific ELF segment, the ...
wisk's user avatar
  • 1,124
1 vote

Debug bFLT in qemu-arm-static

bFLT format is mostly used by the uCLibc based tool chains and even there the build happens to ELF which is then converted to bFLT, so it’s unlikely you’ll find a GDB which supports bFLT directly. ...
Igor Skochinsky's user avatar
  • 36.2k
1 vote

error shmat function when simulating MIPS file in Qemu

From the man page: The addr argument to shmat specifies a pointer value indicating the address at which the memory segment is to be attached. If addr is NULL , the segment will be attached at an ...
Igor Skochinsky's user avatar
  • 36.2k
1 vote

GDBserver on Qemu not honoring "follow-fork-mode child"

From the docs: On most systems, GDB has no special support for debugging programs which create additional processes using the fork function. When a program forks, GDB will continue to debug the ...
Igor Skochinsky's user avatar
  • 36.2k
1 vote

inspecting c-sky elf application

Me? I'm hoping to be able to use the box to control the tuner, and do one of two things with it: sample and pass the I/Q information to a network destination for demodulation. sample and pass the I/Q ...
ve4jag's user avatar
  • 11
1 vote

inspecting c-sky elf application

Firstly I am using the GX6622 version right now. I have one GX6605s version which requires the usb wifi but not yet powered it up. Still finalising the track layout and pin out under the microscope. ...
Hca's user avatar
  • 41
1 vote

ld-uClibc.so.0: No Such file or directory when running qemu-mipsel-static

You need to pass the path to the device files directory using the -L switch
Igor Skochinsky's user avatar
  • 36.2k
1 vote
Accepted

`qemu-mips-static` chroot causing `Invalid ELF image` error

It seems your binaries are little-endian, so you neeed qemu-mipsel.
Igor Skochinsky's user avatar
  • 36.2k
1 vote
Accepted

Weird qemu behaviour with Freescale Coldfire MCF5282

I got the explanation by another source, and It seems to me to be appropriate post here the answer I received. It is weird, in my eyes I mean, but it is expected behavior, and make also sense with ...
Alessandro's user avatar
1 vote

Extracted router file execution

As far as I understand, you need to execute just one MIPS binary. There is an easy route and a hard (relatively) route. Easy route: For executing just one MIPS binary, you might get away with Qemu ...
secnigma's user avatar
1 vote

*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,... file firmware)

Unfortunately QEMU is not well suited for your use case. As explained in your addendum, it is mostly used to emulate embedded Linux systems, that’s why there are many assumptions in its code: that the ...
Igor Skochinsky's user avatar
  • 36.2k
1 vote

Alter /proc/cmdline for QEMU emulated process

The typical way to do something like this is to write a small library that intercepts open/read and fakes out the data your program is looking for, and then arrange for that library to be loaded by ...
Brendan Dolan-Gavitt's user avatar
1 vote

gdb-multiarch Segmentation fault

It seems there is some bug in gdb causing it to crash when reading symbols from your file. You can try to debug the crash(e.g. gdb --args gdb-multiarch ./mipsel-test), but this is more of a ...
Igor Skochinsky's user avatar
  • 36.2k
1 vote
Accepted

Emulating Non-Linux Firmware Image of Embedded Devices

It is possible, but emulating the raw .bin file is almost never going to work unless it's laid out exactly like the QEMU platform you're using expects. If the binary you want to run is statically-...
3pidemix's user avatar
  • 106

Only top scored, non community-wiki answers of a minimum length are eligible