8
votes
Accepted
Unicorn and QEMU: Example use cases to understand the differences
What does "(not) emulating hardware other than the CPU" mean?
This means that whenever the software being emulated accesses hardware, it won't work in Unicorn in the same way as on actual hardware.
...
- 12.9k
8
votes
Accepted
Emulating Routers and other Embedded Devices with QEMU
Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM ...
- 6,040
7
votes
Accepted
Unable to boot ARM disk image
I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g ...
4
votes
How to log all memory accesses (read and write) including the memory content in a binary execution trace?
I know that this question was asked some time ago, but here comes the solution working on Windows.
Note: See the last section of this answer to get the solution for other systems and architectures.
...
- 3,369
4
votes
Accepted
GDB: Could not load shared library symbols
Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there.
...
- 245
3
votes
Running ELF file built for ARM arhitecture
“No such file or directory” is often printed by the shell when the dynamic interpreter of the executable is not found. You can find out which one it expects by using readelf-l.
- 36.4k
3
votes
inspecting c-sky elf application
Yes, that is the main app, telnet into the stb via network, user root, no password. You will find the stb has that block mounted as /dvb/out.elf which is this file.
It's the main app, most command ...
- 41
3
votes
Accepted
Getting list of opcodes from PANDA trace
At the moment PANDA doesn't provide information about the instruction size (which isn't known before translation) at the level of an individual instruction. One thing you can do, however, is get the ...
- 2,868
3
votes
Emulate juan DVR R7816 in Qemu
Just the firmware and qemu won't help you much. When the firmware starts up, it will try to communicate with the hardware - initialize the network card, check which channels have cameras attached to ...
- 12.9k
3
votes
QEMU gdb server thread problem
QEMU user-mode emulation (e.g. qemu-arm, qemu-arm-static) does not support debugging multiple threads simultaneously.
You must use qemu-arm-system and run an entire ARM kernel.
Separately, your QEMU ...
- 2,317
2
votes
Accepted
Reverse a BFLT file
bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls:
Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC ...
- 36.4k
2
votes
Invalid ELF image for this architecture
You get this error message because the ELF is stripped. See qemu-vs-strip for more information.
This problem is fixed in the latest QEMU, so you have to update your QEMU or compile the latest from ...
- 1,759
2
votes
QEMU & router firmware
Most MIPS/ARM based routers have a ROM bootloader that runs when the device is powered on. This bootloader is typically accessible via a serial port, but some platforms (like AR7) do weird things ...
- 121
2
votes
Network support when emulating firmware with QEMU
Use the -net argument -net nic,model=rtl8139. Of course replace rtl8139 with your network device model (e1000, i82551, i82557b, ...)
Further explanations are found on this Wiki Documentation
- 111
2
votes
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
qemu-system-mips full system emulation with Buildroot
This method simulate the entire MIPS CPU and can overcome limitations mentioned with userland emulation at: https://reverseengineering....
2
votes
Run ntoskrnl.exe with qemu
Linux kernel can boot mostly on its own by probing the hardware and using the linked-in drivers. The NT kernel requires an environment such as UEFI or legacy BIOS and relies on it, for example, to ...
- 36.4k
2
votes
QEMU fpu mode error when attempting to run MIPS binary
According to the source code, the EABI from your ELF is not compatible. It seems to be specific to MIPS, you can find the structure here, this structure is stored inside a specific ELF segment, the ...
- 1,124
1
vote
Debug bFLT in qemu-arm-static
bFLT format is mostly used by the uCLibc based tool chains and even there the build happens to ELF which is then converted to bFLT, so it’s unlikely you’ll find a GDB which supports bFLT directly. ...
- 36.4k
1
vote
error shmat function when simulating MIPS file in Qemu
From the man page:
The addr argument to shmat specifies a pointer value indicating the
address at which the memory segment is to be attached. If addr is NULL
, the segment will be attached at an ...
- 36.4k
1
vote
GDBserver on Qemu not honoring "follow-fork-mode child"
From the docs:
On most systems, GDB has no special support for debugging programs
which create additional processes using the fork function. When a
program forks, GDB will continue to debug the ...
- 36.4k
1
vote
inspecting c-sky elf application
Me?
I'm hoping to be able to use the box to control the tuner, and do one of two things with it:
sample and pass the I/Q information to a network destination for demodulation.
sample and pass the I/Q ...
- 11
1
vote
inspecting c-sky elf application
Firstly I am using the GX6622 version right now. I have one GX6605s version which requires the usb wifi but not yet powered it up. Still finalising the track layout and pin out under the microscope.
...
- 41
1
vote
ld-uClibc.so.0: No Such file or directory when running qemu-mipsel-static
You need to pass the path to the device files directory using the -L switch
- 36.4k
1
vote
Accepted
`qemu-mips-static` chroot causing `Invalid ELF image` error
It seems your binaries are little-endian, so you neeed qemu-mipsel.
- 36.4k
1
vote
Accepted
Weird qemu behaviour with Freescale Coldfire MCF5282
I got the explanation by another source, and It seems to me to be appropriate post here the answer I received.
It is weird, in my eyes I mean, but it is expected behavior, and make also sense with ...
- 335
1
vote
Extracted router file execution
As far as I understand, you need to execute just one MIPS binary.
There is an easy route and a hard (relatively) route.
Easy route:
For executing just one MIPS binary, you might get away with Qemu ...
- 51
1
vote
*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,... file firmware)
Unfortunately QEMU is not well suited for your use case. As explained in your addendum, it is mostly used to emulate embedded Linux systems, that’s why there are many assumptions in its code: that the ...
- 36.4k
1
vote
Alter /proc/cmdline for QEMU emulated process
The typical way to do something like this is to write a small library that intercepts open/read and fakes out the data your program is looking for, and then arrange for that library to be loaded by ...
- 2,868
1
vote
gdb-multiarch Segmentation fault
It seems there is some bug in gdb causing it to crash when reading symbols from your file. You can try to debug the crash(e.g. gdb --args gdb-multiarch ./mipsel-test), but this is more of a ...
- 36.4k
1
vote
Accepted
Emulating Non-Linux Firmware Image of Embedded Devices
It is possible, but emulating the raw .bin file is almost never going to work unless it's laid out exactly like the QEMU platform you're using expects. If the binary you want to run is statically-...
- 106
Only top scored, non community-wiki answers of a minimum length are eligible