#07 - How To Emulate Firmware With QEMU - Hardware Hacking Tutorial скачать в хорошем качестве

#07 - How To Emulate Firmware With QEMU - Hardware Hacking Tutorial

If you have successfully identified some interesting executable binary in the firmware file of your device, and if you want to run it or reverse engineer it in a debugging friendly, reverse-engineering friendly, emulation environment, this is the video for you! We will talk about using QEMU as an emulation environment, reasonably similar to our device, where to run, debug, and reverse engineer interesting device executable binaries. "QEMU", can "Quick EMUlate" hundreds of different CPU architectures, and it is the most important building block of our emulation environment. We want to have an emulation environment that can run the device executable binaries we are interested in, this means that our emulation environment must have, at least, the same CPU architecture and instruction set as our device. There is a fantastic, Open Source, software, that can emulate hundreds of different boards with hundreds of different CPU architectures, and it is also very efficient e quite fast in this emulation, it is QEMU the Quick Emulator. There many other emulators, but many of them are not free, some of them are more specialized for a certain architecture, but, for our purpose, QEMU is, by far, the best emulation software. Installing QEMU, on Linux systems, is easy, you will find some instructions below. QEMU has 3 modes of operation: a "system mode" operation, in this mode it emulates an entire system, an entire board with a certain type of CPU, a certain amount of RAM and disk, with some other chips like EEPROM and so on. You can only emulate boards already included in QEMU, unless you want to modify its source to add additional boards; this is not impossible, but it has a quite steep learning curve; a "user mode" operation, in this mode it doesn't emulate a different board but does some sort of "machine code translation", from the machine code of, for example, a MIPS or ARM executable binary to the machine code of our x64 Linux PC; it does a good job at mapping original kernel system calls to system calls in our x64 Linux PC. It is a useful operation mode, because it can be used immediately, without building a full emulation environment, but, sometimes, it cannot run our device executable binaries and, some other times, can give weird results. We will see an example very soon; the last QEMU mode is the "virtualization mode", we are not interested in this mode because it is used to run a virtual machine in our PC with the same x86 architecture. This is the mode used by the KVM and XEN virtualization environments. Installing QEMU On Ubuntu QEMU can be installed with the following installation command: $ sudo apt-get install qemu qemu-block-extra qemu-kvm qemu-slof qemu-system \ qemu-system-arm qemu-system-common qemu-system-mips qemu-system-misc \ qemu-system-ppc qemu-system-s390x qemu-system-sparc qemu-system-x86 \ qemu-user qemu-user-binfmt qemu-utils In other distributions you have to use corresponding installation commands. Kernel, root file system image, and "qr.sh" script http://uk2.digiampietro.com:/hht/make... Links with additional Information Channel's Author: https://www.makemehack.com/2020/02/a-... Channel's Web Site: https://www.makemehack.com/ The sample router (Gemtek WVRTM-127ACN) on techinfodepot: http://en.techinfodepot.shoutwiki.com... The sample router (Gemtek WVRTM-127ACN) reverse-engineered on GitHub, includes scripts to dump the EEPROM to a text file and to convert it back to binary file: https://github.com/digiampietro/hacki... QEMU, the Quick EMUlator: https://www.qemu.org/ Buildroot, a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation: https://buildroot.org/ The Yocto Project, to create custom Linux-based systems regardless of the hardware architecture: https://www.yoctoproject.org/ OpenWRT Build System: https://openwrt.org/docs/guide-develo... Linux Kernel Device Tree: https://elinux.org/Device_Tree_What_I... MIPS Malta Evaluation Board: https://www.linux-mips.org/wiki/MIPS_... QEMU MIPS System Emulator: https://www.qemu.org/docs/master/qemu... Available platforms in QEMU: https://wiki.qemu.org/Testing/Acceptance QEMU User Documentation: https://www.qemu.org/docs/master/qemu... Linux Memory Technology Devices: http://www.linux-mtd.infradead.org/in... How to use the Linux kernel NAND simulator: http://www.linux-mtd.infradead.org/fa... UBI and the UBIFS File System: http://www.linux-mtd.infradead.org/do... Kernel, root file system image, and qr.sh script: http://uk2.digiampietro.com/hht/makem...