mips - 无法在 qemu 中运行 MIPS 二进制文件
问题描述
我正在尝试在 qemu 中的完整系统仿真上运行 MIPS 二进制文件,以搜索路由器固件中的漏洞。我正在使用以下命令启动 qemu:qemu-system-mips -M malta -m 256 -hda hda.img -kernel vmlinux-4.19.0-14-4kc-malta -initrd initrd.img-4.19.0-14-4kc-malta -append "root=/dev/sda1 console=ttyS0 nokaslr" -nographic -netdev user,id=net0 -device e1000-82545em,netdev=net0,id=net0,mac=52:54:00:c9:18:27 -net user -redir tcp:2222::22 -net nic
机器启动后,我确实获得了网络连接,并且能够安装 gdb、binwalk 等。
当我尝试运行二进制文件时,我的问题就出现了,例如./busybox
,我得到了输出-bash: ./busybox: No such file or directory
。
但是当我运行时strace busyboox
,我得到:
execve("/usr/bin/busybox", ["busybox"], 0x7f7ffa70 /* 20 vars */) = 0
brk(NULL) = 0x55aae000
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x77f07000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=24625, ...}) = 0
mmap2(NULL, 24625, PROT_READ, MAP_PRIVATE, 3, 0) = 0x77f00000
close(3) = 0
openat(AT_FDCWD, "/lib/mips-linux-gnu/libresolv.so.2", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\10\0\0\0\1\0\0%\320\0\0\0004"..., 512) = 512
prctl(PR_GET_FP_MODE) = 0
_llseek(3, 724, [724], SEEK_SET) = 0
read(3, "\0\0\0\4\0\0\0\20\0\0\0\1GNU\0\0\0\0\0\0\0\0\3\0\0\0\2\0\0\0\0", 32) = 32
fstat64(3, {st_mode=S_IFREG|0644, st_size=83944, ...}) = 0
mmap2(NULL, 153808, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x77eb0000
mprotect(0x77ec3000, 61440, PROT_NONE) = 0
mmap2(0x77ed2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12000) =
0x77ed2000
mmap2(0x77ed4000, 6352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) =
0x77ed4000
close(3) = 0
openat(AT_FDCWD, "/lib/mips-linux-gnu/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\10\0\0\0\1\0\1\244d\0\0\0004"..., 512) = 512
prctl(PR_GET_FP_MODE) = 0
_llseek(3, 520, [520], SEEK_SET) = 0
read(3, "\0\0\0\4\0\0\0\24\0\0\0\3GNU\0\30\335\354\235\fM\241r\346\26\317\341R\305\363\23"..., 36) =
36
_llseek(3, 828, [828], SEEK_SET) = 0
read(3, "\0\0\0\4\0\0\0\20\0\0\0\1GNU\0\0\0\0\0\0\0\0\3\0\0\0\2\0\0\0\0", 32) = 32
fstat64(3, {st_mode=S_IFREG|0755, st_size=1668292, ...}) = 0
mmap2(NULL, 1642000, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x77d1f000
mprotect(0x77e98000, 61440, PROT_NONE) = 0
mmap2(0x77ea7000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x178000) =
0x77ea7000
mmap2(0x77eae000, 7696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) =
0x77eae000
close(3) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x77efe000
set_thread_area(0x77f054a0) = 0
mprotect(0x77ea7000, 16384, PROT_READ) = 0
mprotect(0x77ed2000, 4096, PROT_READ) = 0
mprotect(0x55728000, 8192, PROT_READ) = 0
mprotect(0x77f09000, 4096, PROT_READ) = 0
munmap(0x77f00000, 24625) = 0
getuid() = 0
ioctl(2, TIOCGWINSZ, 0x7f9faddc) = 0
dup2(1, 2) = 2
write(2, "BusyBox v1.30.1 (Debian 1:1.30.1"..., 35BusyBox v1.30.1 (Debian 1:1.30.1-4)) = 35
write(2, " multi-call binary.\n", 20 multi-call binary.
) = 20
write(2, "BusyBox is copyrighted by many a"..., 568BusyBox is copyrighted by many authors between
1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.
Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --show SCRIPT
or: busybox --install [-s] [DIR]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
) = 568
write(2, "\t", 1 ) = 1
write(2, "[", 1[) = 1
write(2, ", ", 2, ) = 2
write(2, "[[", 2[[) = 2
write(2, ", ", 2, ) = 2
write(2, "acpid", 5acpid) = 5
write(2, ", ", 2, ) = 2
write(2, "adjtimex", 8adjtimex) = 8
write(2, ", ", 2, ) = 2
write(2, "ar", 2ar) = 2
write(2, ", ", 2, ) = 2
write(2, "arch", 4arch) = 4
write(2, ", ", 2, ) = 2
write(2, "arp", 3arp) = 3
...
...
exit_group(0) = ?
+++ exited with 0 +++
看起来 strace 提供了想要的输出,但我无法弄清楚正常执行时的问题是什么。谢谢您的帮助
解决方案
推荐阅读
- python - 如何在 Django 模板中加载图表
- r - Why my code for using png logos in axis labels in ggtext is not working
- r - 调整代码以在闪亮的图表上显示正确的线条
- windows - 为测试目的制作证书,但不是自签名的
- powershell - 在 Yaml 管道中将参数传递给 Powershell 内联脚本的问题
- c++ - 在 QT 的 textedit 中为特定行(由光标指示)着色,但每次按下按钮时光标的位置都会随着功能而变化
- python - 在 PyTorch 迁移学习中使用自定义 resnet18 代码
- python - 读取响应返回错误 python sdk OCI
- google-sheets - 如何在表格的范围内查找名称?
- javascript - 使用 JavaScript 提取字符串部分