Hot answers tagged

50

Get Ready for an Adventure! You need a few things for your quest! Let's start at the beginning. QEMU and GDB QEMU is an emulator for various architectures. Generally, it's used to emulate an entire PC (i.e. to run a virtual machine). However, for debugging a single program this is not necessary. On Linux, you can use QEMU User-Space emulation. $ sudo ...


10

PANDA developer here. I think that actually most of the things you want are supported by QEMU's native gdbstub. If you start QEMU with the -s -S options, it will listen on port 1234 for incoming connections, and provide the functionality you want, including: Single-step using the si command Register get/set using info reg and (for example) set $edi = ...


8

What does "(not) emulating hardware other than the CPU" mean? This means that whenever the software being emulated accesses hardware, it won't work in Unicorn in the same way as on actual hardware. We have several questions about emulating firmware on QEMU. The general answer is that, when you try booting a firmware kernel in QEMU, that kernel will access ...


7

I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g 10000 ./myTargetBinary. See slides 27+ in my presentation https://files.sans.org/summit/hackfest2015/PDFs/IoT-Devices-Fall-Like-Backward-Capacitors-Or-the-Month-...


6

I was able to get that firmware to a shell by doing the following: Unpacking the squashfs image Create a filesystem image formatted to ext2 and copying the unpacked squashfs contents into that, and using that as -hda Running without -initrd ... and appending init=/bin/sh to the kernel command line Although you are not fully emulating the WR740N because ...


6

Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM devices. It's based on the venerable QEMU project. There's also firmware analysis toolkit which is a wrapper around firmadyne allowing you to automate some of ...


4

Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there. Instead, you keep the versions with symbols intact (and potentially also associated sources) on your PC, and point the debugger at those. If your files with ...


3

QEMU user-mode emulation (e.g. qemu-arm, qemu-arm-static) does not support debugging multiple threads simultaneously. You must use qemu-arm-system and run an entire ARM kernel. Separately, your QEMU and GDB are very out-of-date. I recommend updating: QEMU / qemu-static. The latest version is 2.10.1. QEMU 2.0.0 is over three years old. gdb / gdb-...


3

At the moment PANDA doesn't provide information about the instruction size (which isn't known before translation) at the level of an individual instruction. One thing you can do, however, is get the size of an entire basic block once it has been translated by QEMU using PANDA_CB_AFTER_BLOCK_TRANSLATE and then look at the tb->size field. You can then cache ...


3

I know that this question was asked some time ago, but here comes the solution working on Windows. Note: See the last section of this answer to get the solution for other systems and architectures. x86 32 bit files OllyDbg2 is the tool that can be used for logging every single assembly instruction along with memory reads and writes. A short guide how to ...


3

Just the firmware and qemu won't help you much. When the firmware starts up, it will try to communicate with the hardware - initialize the network card, check which channels have cameras attached to them, probably read some configuration values from non-volatile storage, check the total/free space of the hard disk, this kind of stuff. On a plain qemu ...


3

You can try to connect remote gdbserver using radare2 tool, with a following line: r2 -a mips gdb://[address]


3

To develop a driver, there's basically 3 steps you have to do: Learn about Linux driver programming in general. This is independent of your specifi hardware, and involves things like "How do i convert virtual memory addresses to physical and back? How do i read bytes / write bytes to hardware registers? How do i yield the CPU while waiting for the hardware ...


2

Past TEMU user here. Perhaps you should attempt to understand TEMU more (which I don't), to prevent duplicating the work already done. PTRACE only records syscall transitions, but if you go under QEMU, a better granularity is basic blocks. Not sure if TEMU has the capacity to do that, the idea is the each basic block can uniquely identify part of the ...


2

You get this error message because the ELF is stripped. See qemu-vs-strip for more information. This problem is fixed in the latest QEMU, so you have to update your QEMU or compile the latest from source.


2

Most MIPS/ARM based routers have a ROM bootloader that runs when the device is powered on. This bootloader is typically accessible via a serial port, but some platforms (like AR7) do weird things like have an FTP server going (you can flash firmware through it). This bootloader will load a kernel image and initrd from a partition of a NAND device, then run ...


2

Use the -net argument -net nic,model=rtl8139. Of course replace rtl8139 with your network device model (e1000, i82551, i82557b, ...) Further explanations are found on this Wiki Documentation


2

qemu-system-mips full system emulation with Buildroot This method simulate the entire MIPS CPU and can overcome limitations mentioned with userland emulation at: https://reverseengineering.stackexchange.com/a/8917/12321 This script fullys automate everything that is automatable for you: https://github.com/cirosantilli/linux-kernel-module-cheat/tree/...


2

According to the source code, the EABI from your ELF is not compatible. It seems to be specific to MIPS, you can find the structure here, this structure is stored inside a specific ELF segment, the code in charge to read it is here. I suggest you to make sure this segment is present and if it contains correct values. I think you can dump this information ...


1

I got the explanation by another source, and It seems to me to be appropriate post here the answer I received. It is weird, in my eyes I mean, but it is expected behavior, and make also sense with the necessary explanation. The nature of Qemu, a JIT translator, implies that all code of the target CPU is translated into the code of the host CPU. When My ...


1

From the docs: On most systems, GDB has no special support for debugging programs which create additional processes using the fork function. When a program forks, GDB will continue to debug the parent process and the child process will run unimpeded. If you have set a breakpoint in any code which the child then executes, the child will get a SIGTRAP signal ...


1

Yes that is the main app, telnet into the stb via network, user root, no password. You will find the stb has that block mounted as /dvb/out.elf which is this file. Its the main app, most command line utils are all in busybox, else a couple of scripts after OS boot and network or usb insertion. Serial port (maybe not installed to back panel) is used for ...


1

You need to pass the path to the device files directory using the -L switch


1

It seems your binaries are little-endian, so you neeed qemu-mipsel.


1

Unfortunately QEMU is not well suited for your use case. As explained in your addendum, it is mostly used to emulate embedded Linux systems, that’s why there are many assumptions in its code: that the kernel is a Linux kernel (i.e. an ELF file) and the disk image contains a Linux rootfs. In addition, the specific hardware configurations (“machines”) emulated ...


1

The typical way to do something like this is to write a small library that intercepts open/read and fakes out the data your program is looking for, and then arrange for that library to be loaded by passing in an LD_PRELOAD environment variable (QEMU's -E option). It's pretty straightforward; you could adapt the instructions here on emulating NVRAM in QEMU.


1

It seems there is some bug in gdb causing it to crash when reading symbols from your file. You can try to debug the crash(e.g. gdb --args gdb-multiarch ./mipsel-test), but this is more of a programming issue than RE, so I suggest you to use GDB support channels for this or at least ask on SO instead of here.


1

It is possible, but emulating the raw .bin file is almost never going to work unless it's laid out exactly like the QEMU platform you're using expects. If the binary you want to run is statically-linked and is in a binary format that QEMU knows, you may be able to use QEMU user mode to run it, but you'll need to extract it from your binary image. Binwalk ...


1

bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls: Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC instructions) in the code. Depending on the age of the system the will be using either Old ABI (with syscall number encoded as the operand of the SVC instruction) or ...


1

I want just to add a quick receipt about qemu-user and ptrace. Start qemu-binfmt service on the host to register qemu-user binaries. Use buildah to create amd64 container. Install latest qemu inside this amd64 container, kernel will use them instead of host. Build some toolchain inside amd64 container. Use regular strace to trace your binaries. For example:...


Only top voted, non community-wiki answers of a minimum length are eligible