search

attify / firmware-analysis-toolkit

Toolkit to emulate firmware and analyse it for security vulnerabilities
MIT License
1.35k stars 256 forks source link

No IP show while emulating Tp-Link Archer AX50 #95

Open y198nt opened 7 months ago

y198nt commented 7 months ago

You can download the file at here: https://us.softpedia-secure-download.com/dl/68da52af83d3218977ededbd17bcf150/6613a902/301008453/drivers/router/Archer%20AX50(EU)_V1_210730.zip

When I run sudo python3 fat.py archer-ax53/ax50v1_intel-up-ver1-0-11-P1[20210730-rel54485]_signed.bin. First there is no IP for interaction image

But after I pressed enter, it working normally. But it just there is no ip to interact Starting firmware emulation... use Ctrl-a + x to exit . [ 0.000000] Linux version 2.6.39.4+ (ddcc@ddcc-virtual) (gcc version 5.3.0 (GCC) ) #2 Tue Sep 1 18:08:53 EDT 2020 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00019300 (MIPS 24Kc) [ 0.000000] FPU revision is: 00739300 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 00001000 @ 00000000 (reserved) [ 0.000000] memory: 000ef000 @ 00001000 (ROM data) [ 0.000000] memory: 00678000 @ 000f0000 (reserved) [ 0.000000] memory: 0f897000 @ 00768000 (usable) [ 0.000000] debug: ignoring loglevel setting. [ 0.000000] Wasting 60672 bytes for tracking 1896 unused pages [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] DMA 0x00000000 -> 0x00001000 [ 0.000000] Normal 0x00001000 -> 0x0000ffff [ 0.000000] Movable zone start PFN for each node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 -> 0x0000ffff [ 0.000000] On node 0 totalpages: 65535 [ 0.000000] free_area_init_node: node 0, pgdat 80702800, node_mem_map 81000000 [ 0.000000] DMA zone: 32 pages used for memmap [ 0.000000] DMA zone: 0 pages reserved [ 0.000000] DMA zone: 4064 pages, LIFO batch:0 [ 0.000000] Normal zone: 480 pages used for memmap [ 0.000000] Normal zone: 60959 pages, LIFO batch:15 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65023 [ 0.000000] Kernel command line: root=/dev/sda1 console=ttyS0 nandsim.parts=64,64,64,64,64,64,64,64,64,64 rdinit=/firmadyne/preInit.sh rw debug ignore_loglevel print-fatal-signals=1 user_debug=31 firmadyne.syscall=0 [ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Primary instruction cache 2kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 2kB, 2-way, VIPT, no aliases, linesize 16 bytes [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 252264k/254556k available (4554k kernel code, 2292k reserved, 1609k data, 240k init, 0k highmem) [ 0.000000] NR_IRQS:256 [ 0.000000] CPU frequency 333.33 MHz [ 0.000000] Console: colour dummy device 80x25 [ 0.004000] Calibrating delay loop... 2662.40 BogoMIPS (lpj=5324800) [ 0.032000] pid_max: default: 32768 minimum: 301 [ 0.036000] Mount-cache hash table entries: 512 [ 0.044000] Performance counters: No available PMU. [ 0.052000] NET: Registered protocol family 16 [ 0.064000] bio: create slab at 0 [ 0.064000] vgaarb: loaded [ 0.068000] SCSI subsystem initialized [ 0.068000] libata version 3.00 loaded. [ 0.072000] usbcore: registered new interface driver usbfs [ 0.072000] usbcore: registered new interface driver hub [ 0.072000] usbcore: registered new device driver usb [ 0.076000] pci 0000:00:00.0: [11ab:4620] type 0 class 0x000600 [ 0.076000] pci 0000:00:00.0: reg 14: [mem 0x01000000-0x01ffffff pref] [ 0.080000] pci 0000:00:0a.0: [8086:7110] type 0 class 0x000601 [ 0.080000] pci 0000:00:0a.1: [8086:7111] type 0 class 0x000101 [ 0.080000] pci 0000:00:0a.1: reg 20: [io 0x0000-0x000f] [ 0.084000] pci 0000:00:0a.2: [8086:7112] type 0 class 0x000c03 [ 0.084000] pci 0000:00:0a.2: reg 20: [io 0x0000-0x001f] [ 0.084000] pci 0000:00:0a.3: [8086:7113] type 0 class 0x000680 [ 0.088000] pci 0000:00:0a.3: address space collision: [io 0x1100-0x110f] conflicts with GT-64120 PCI I/O [io 0x1000-0x1fffff] [ 0.088000] pci 0000:00:12.0: [1013:00b8] type 0 class 0x000300 [ 0.088000] pci 0000:00:12.0: reg 10: [mem 0x00000000-0x01ffffff pref] [ 0.088000] pci 0000:00:12.0: reg 14: [mem 0x00000000-0x00000fff] [ 0.088000] pci 0000:00:12.0: reg 30: [mem 0x00000000-0x0000ffff pref] [ 0.088000] pci 0000:00:13.0: [8086:100e] type 0 class 0x000200 [ 0.088000] pci 0000:00:13.0: reg 10: [mem 0x00000000-0x0001ffff] [ 0.088000] pci 0000:00:13.0: reg 14: [io 0x0000-0x003f] [ 0.088000] pci 0000:00:13.0: reg 30: [mem 0x00000000-0x0007ffff pref] [ 0.088000] pci 0000:00:14.0: [8086:100e] type 0 class 0x000200 [ 0.088000] pci 0000:00:14.0: reg 10: [mem 0x00000000-0x0001ffff] [ 0.088000] pci 0000:00:14.0: reg 14: [io 0x0000-0x003f] [ 0.092000] pci 0000:00:14.0: reg 30: [mem 0x00000000-0x0007ffff pref] [ 0.092000] pci 0000:00:15.0: [8086:100e] type 0 class 0x000200 [ 0.092000] pci 0000:00:15.0: reg 10: [mem 0x00000000-0x0001ffff] [ 0.096000] pci 0000:00:15.0: reg 14: [io 0x0000-0x003f] [ 0.096000] pci 0000:00:15.0: reg 30: [mem 0x00000000-0x0007ffff pref] [ 0.096000] vgaarb: device added: PCI:0000:00:12.0,decodes=io+mem,owns=none,locks=none [ 0.096000] pci 0000:00:0a.3: BAR 8: [io 0x1100-0x110f] has bogus alignment [ 0.100000] pci 0000:00:12.0: BAR 0: assigned [mem 0x10000000-0x11ffffff pref] [ 0.100000] pci 0000:00:12.0: BAR 0: set to [mem 0x10000000-0x11ffffff pref] (PCI address [0x10000000-0x11ffffff]) [ 0.100000] pci 0000:00:13.0: BAR 6: assigned [mem 0x12000000-0x1207ffff pref] [ 0.100000] pci 0000:00:14.0: BAR 6: assigned [mem 0x12080000-0x120fffff pref] [ 0.100000] pci 0000:00:15.0: BAR 6: assigned [mem 0x12100000-0x1217ffff pref] [ 0.100000] pci 0000:00:13.0: BAR 0: assigned [mem 0x12180000-0x1219ffff] [ 0.100000] pci 0000:00:13.0: BAR 0: set to [mem 0x12180000-0x1219ffff] (PCI address [0x12180000-0x1219ffff]) [ 0.100000] pci 0000:00:14.0: BAR 0: assigned [mem 0x121a0000-0x121bffff] [ 0.100000] pci 0000:00:14.0: BAR 0: set to [mem 0x121a0000-0x121bffff] (PCI address [0x121a0000-0x121bffff]) [ 0.100000] pci 0000:00:15.0: BAR 0: assigned [mem 0x121c0000-0x121dffff] [ 0.100000] pci 0000:00:15.0: BAR 0: set to [mem 0x121c0000-0x121dffff] (PCI address [0x121c0000-0x121dffff]) [ 0.100000] pci 0000:00:12.0: BAR 6: assigned [mem 0x121e0000-0x121effff pref] [ 0.100000] pci 0000:00:12.0: BAR 1: assigned [mem 0x121f0000-0x121f0fff] [ 0.100000] pci 0000:00:12.0: BAR 1: set to [mem 0x121f0000-0x121f0fff] (PCI address [0x121f0000-0x121f0fff]) [ 0.100000] pci 0000:00:13.0: BAR 1: assigned [io 0x1000-0x103f] [ 0.104000] pci 0000:00:13.0: BAR 1: set to [io 0x1000-0x103f] (PCI address [0x1000-0x103f]) [ 0.104000] pci 0000:00:14.0: BAR 1: assigned [io 0x1040-0x107f] [ 0.104000] pci 0000:00:14.0: BAR 1: set to [io 0x1040-0x107f] (PCI address [0x1040-0x107f]) [ 0.104000] pci 0000:00:15.0: BAR 1: assigned [io 0x1080-0x10bf] [ 0.104000] pci 0000:00:15.0: BAR 1: set to [io 0x1080-0x10bf] (PCI address [0x1080-0x10bf]) [ 0.104000] pci 0000:00:0a.2: BAR 4: assigned [io 0x10c0-0x10df] [ 0.104000] pci 0000:00:0a.2: BAR 4: set to [io 0x10c0-0x10df] (PCI address [0x10c0-0x10df]) [ 0.104000] pci 0000:00:0a.1: BAR 4: assigned [io 0x10e0-0x10ef] [ 0.104000] pci 0000:00:0a.1: BAR 4: set to [io 0x10e0-0x10ef] (PCI address [0x10e0-0x10ef]) [ 0.112000] Switching to clocksource MIPS [ 0.116000] Switched to NOHz mode on CPU #0 [ 0.116000] NET: Registered protocol family 2 [ 0.116000] IP route cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.120000] TCP established hash table entries: 8192 (order: 4, 65536 bytes) [ 0.120000] TCP bind hash table entries: 8192 (order: 3, 32768 bytes) [ 0.120000] TCP: Hash tables configured (established 8192 bind 8192) [ 0.124000] TCP reno registered [ 0.124000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.124000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.124000] NET: Registered protocol family 1 [ 0.124000] PCI: CLS 0 bytes, default 64 [ 0.176000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.176000] Registering unionfs 2.6 (for 2.6.39.4) [ 0.176000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. [ 0.176000] ROMFS MTD (C) 2007 Red Hat, Inc. [ 0.176000] msgmni has been set to 492 [ 0.184000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 0.184000] io scheduler noop registered [ 0.184000] io scheduler cfq registered (default) [ 0.184000] firmadyne: devfs: 1, execute: 1, procfs: 1, syscall: 0 [ 0.184000] firmadyne: Cannot register character device: watchdog, 0xa, 0x82! [ 0.184000] firmadyne: Cannot register character device: wdt, 0xfd, 0x0! [ 0.216000] PCI: Enabling device 0000:00:12.0 (0000 -> 0002) [ 0.220000] cirrusfb 0000:00:12.0: Cirrus Logic chipset on PCI bus, RAM (4096 kB) at 0x10000000 [ 0.424000] Console: switching to colour frame buffer device 80x30 [ 0.436000] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 0.460000] serial8250.0: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A [ 0.464000] console [ttyS0] enabled, bootconsole disabled [ 0.464000] console [ttyS0] enabled, bootconsole disabled [ 0.484000] serial8250.0: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A [ 0.492000] brd: module loaded [ 0.492000] loop: module loaded [ 0.496000] ata_piix 0000:00:0a.1: version 2.13 [ 0.496000] PCI: Enabling device 0000:00:0a.1 (0000 -> 0001) [ 0.496000] PCI: Setting latency timer of device 0000:00:0a.1 to 64 [ 0.504000] scsi0 : ata_piix [ 0.508000] scsi1 : ata_piix [ 0.508000] ata1: PATA max UDMA/33 cmd 0x1f0 ctl 0x3f6 bmdma 0x10e0 irq 14 [ 0.508000] ata2: PATA max UDMA/33 cmd 0x170 ctl 0x376 bmdma 0x10e8 irq 15 [ 0.516000] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 0.516000] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 0.516000] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 0.516000] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 0.516000] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 0.516000] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 0.520000] NAND device: Manufacturer ID: 0x98, Chip ID: 0x39 (Toshiba NAND 128MiB 1,8V 8-bit) [ 0.520000] flash size: 128 MiB [ 0.520000] page size: 512 bytes [ 0.520000] OOB area size: 16 bytes [ 0.520000] sector size: 16 KiB [ 0.520000] pages number: 262144 [ 0.520000] pages per sector: 32 [ 0.520000] bus width: 8 [ 0.520000] bits in sector size: 14 [ 0.520000] bits in page size: 9 [ 0.520000] bits in OOB size: 4 [ 0.520000] flash size with OOB: 135168 KiB [ 0.520000] page address bytes: 4 [ 0.520000] sector address bytes: 3 [ 0.520000] options: 0x62 [ 0.524000] Scanning device for bad blocks [ 0.564000] Creating 11 MTD partitions on "NAND 128MiB 1,8V 8-bit": [ 0.564000] 0x000000000000-0x000000100000 : "NAND simulator partition 0" [ 0.568000] 0x000000100000-0x000000200000 : "NAND simulator partition 1" [ 0.568000] 0x000000200000-0x000000300000 : "NAND simulator partition 2" [ 0.572000] 0x000000300000-0x000000400000 : "NAND simulator partition 3" [ 0.572000] 0x000000400000-0x000000500000 : "NAND simulator partition 4" [ 0.572000] 0x000000500000-0x000000600000 : "NAND simulator partition 5" [ 0.572000] 0x000000600000-0x000000700000 : "NAND simulator partition 6" [ 0.572000] 0x000000700000-0x000000800000 : "NAND simulator partition 7" [ 0.572000] 0x000000800000-0x000000900000 : "NAND simulator partition 8" [ 0.576000] 0x000000900000-0x000000a00000 : "NAND simulator partition 9" [ 0.576000] 0x000000a00000-0x000008000000 : "NAND simulator partition 10" [ 0.576000] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI [ 0.576000] e1000: Copyright (c) 1999-2006 Intel Corporation. [ 0.576000] PCI: Enabling device 0000:00:13.0 (0000 -> 0003) [ 0.576000] PCI: Setting latency timer of device 0000:00:13.0 to 64 [ 0.580000] cfg80211: Calling CRDA to update world regulatory domain [ 0.816000] ata2.01: NODEV after polling detection [ 0.816000] ata1.01: NODEV after polling detection [ 0.816000] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100 [ 0.820000] ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100 [ 0.820000] ata1.00: 524288 sectors, multi 16: LBA48 [ 0.820000] ata1.00: configured for UDMA/33 [ 0.828000] ata2.00: configured for UDMA/33 [ 0.832000] scsi 0:0:0:0: Direct-Access ATA QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 [ 0.836000] sd 0:0:0:0: [sda] 524288 512-byte logical blocks: (268 MB/256 MiB) [ 0.836000] sd 0:0:0:0: [sda] Write Protect is off [ 0.836000] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00 [ 0.836000] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 0.852000] e1000 0000:00:13.0: eth0: (PCI:33MHz:32-bit) 52:54:00:12:34:56 [ 0.852000] e1000 0000:00:13.0: eth0: Intel(R) PRO/1000 Network Connection [ 0.852000] PCI: Enabling device 0000:00:14.0 (0000 -> 0003) [ 0.852000] PCI: Setting latency timer of device 0000:00:14.0 to 64 [ 0.860000] sda: sda1 [ 0.868000] sd 0:0:0:0: [sda] Attached SCSI disk [ 0.872000] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5 [ 1.128000] e1000 0000:00:14.0: eth1: (PCI:33MHz:32-bit) 52:54:00:12:34:57 [ 1.128000] e1000 0000:00:14.0: eth1: Intel(R) PRO/1000 Network Connection [ 1.128000] PCI: Enabling device 0000:00:15.0 (0000 -> 0003) [ 1.128000] PCI: Setting latency timer of device 0000:00:15.0 to 64 [ 1.388000] e1000 0000:00:15.0: eth2: (PCI:33MHz:32-bit) 52:54:00:12:34:58 [ 1.404000] e1000 0000:00:15.0: eth2: Intel(R) PRO/1000 Network Connection [ 1.416000] e1000e: Intel(R) PRO/1000 Network Driver - 1.3.10-k2 [ 1.424000] e1000e: Copyright(c) 1999 - 2011 Intel Corporation. [ 1.432000] pcnet32: pcnet32.c:v1.35 21.Apr.2008 tsbogend@alpha.franken.de [ 1.444000] PPP generic driver version 2.4.2 [ 1.448000] PPP Deflate Compression module registered [ 1.460000] PPP MPPE Compression module registered [ 1.464000] NET: Registered protocol family 24 [ 1.464000] tun: Universal TUN/TAP device driver, 1.6 [ 1.468000] tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com [ 1.472000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 1.476000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 1.476000] uhci_hcd: USB Universal Host Controller Interface driver [ 1.480000] PCI: Enabling device 0000:00:0a.2 (0000 -> 0001) [ 1.480000] PCI: Setting latency timer of device 0000:00:0a.2 to 64 [ 1.480000] uhci_hcd 0000:00:0a.2: UHCI Host Controller [ 1.484000] uhci_hcd 0000:00:0a.2: new USB bus registered, assigned bus number 1 [ 1.484000] uhci_hcd 0000:00:0a.2: irq 11, io base 0x000010c0 [ 1.488000] hub 1-0:1.0: USB hub found [ 1.488000] hub 1-0:1.0: 2 ports detected [ 1.492000] Initializing USB Mass Storage driver... [ 1.492000] usbcore: registered new interface driver usb-storage [ 1.492000] USB Mass Storage support registered. [ 1.496000] serio: i8042 KBD port at 0x60,0x64 irq 1 [ 1.496000] serio: i8042 AUX port at 0x60,0x64 irq 12 [ 1.496000] mousedev: PS/2 mouse device common for all mice [ 1.500000] rtc_cmos rtc_cmos: rtc core: registered rtc_cmos as rtc0 [ 1.500000] rtc0: alarms up to one day, 242 bytes nvram [ 1.504000] i2c /dev entries driver [ 1.504000] piix4_smbus 0000:00:0a.3: SMBus Host Controller at 0x1100, revision 0 [ 1.504000] sdhci: Secure Digital Host Controller Interface driver [ 1.504000] sdhci: Copyright(c) Pierre Ossman [ 1.504000] usbcore: registered new interface driver usbhid [ 1.504000] usbhid: USB HID core driver [ 1.508000] Netfilter messages via NETLINK v0.30. [ 1.508000] nf_conntrack version 0.5.0 (3941 buckets, 15764 max) [ 1.508000] ctnetlink v0.93: registering with nfnetlink. [ 1.512000] IPv4 over IPv4 tunneling driver [ 1.512000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 1.516000] arp_tables: (C) 2002 David S. Miller [ 1.520000] TCP cubic registered [ 1.520000] Initializing XFRM netlink socket [ 1.520000] NET: Registered protocol family 10 [ 1.528000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 1.528000] IPv6 over IPv4 tunneling driver [ 1.532000] NET: Registered protocol family 17 [ 1.532000] Bridge firewalling registered [ 1.536000] Ebtables v2.0 registered [ 1.536000] 802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com [ 1.536000] All bugs added by David S. Miller davem@redhat.com [ 1.536000] lib80211: common routines for IEEE802.11 drivers [ 1.536000] lib80211_crypt: registered algorithm 'NULL' [ 1.540000] rtc_cmos rtc_cmos: setting system clock to 2024-04-08 08:17:00 UTC (1712564220) [ 1.568000] EXT2-fs (sda1): warning: mounting unchecked fs, running e2fsck is recommended [ 1.568000] VFS: Mounted root (ext2 filesystem) on device 8:1. [ 1.572000] Freeing prom memory: 956k freed [ 1.612000] Freeing unused kernel memory: 240k freed [ 1.660000] input: AT Raw Set 2 keyboard as /devices/platform/i8042/serio0/input/input0 [ 1.680000] firmadyne: sys_reboot[PID: 1 (init)]: magic1:fee1dead, magic2:28121969, cmd:0 [ 1.688000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 1.692000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 init started: BusyBox v1.19.4 (2021-07-23 15:51:06 CST) [ 1.712000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 1.712000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 1.776000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 35225 [ 1.796000] firmadyne: do_execve: /firmadyne/console [ 1.800000] OFFSETS: offset of pid: 0xc4 offset of comm: 0x1a4 [ 1.864000] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input1 [ 1.936000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 1.936000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 1.960000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 1.964000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: cat: can't open '/proc/cmdline': No such file or directory [ 2.088000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.088000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory [ 2.112000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.112000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory [ 2.132000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.132000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory [ 2.152000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.152000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory [ 2.172000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.172000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory [ 2.192000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.192000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory [ 2.208000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 [ 2.212000] EXT2-fs (sda1): error: ext2_lookup: deleted inode referenced: 464 sysinit: sysctl: chdir(/proc/sys): No such file or directory QEMU: Terminated

extremecoders-re commented 7 months ago

Try increasing the timeout to 120 seconds in inferNetwork.sh

https://github.com/firmadyne/firmadyne/blob/748fdec9a8eb716fbb9598404389211aed8c987a/scripts/inferNetwork.sh#L40

y198nt commented 7 months ago

qemu.final.serial.log

it still error although i raise the time up to 180, sudo python3 fat.py archer-ax53/_ax50v1_intel-up-ver1-0-11-P1[20210730-rel54485]_signed.bin.extracted/0x460AA/460AA.squashfs

                           __           _
                          / _|         | |
                         | |_    __ _  | |_
                         |  _|  / _` | | __|
                         | |   | (_| | | |_
                         |_|    \__,_|  \__|

            Welcome to the Firmware Analysis Toolkit - v0.3
Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation
              By Attify - https://attify.com  | @attifyme

[+] Firmware: 460AA.squashfs [+] Extracting the firmware... [+] Image ID: 2 [+] Identifying architecture... [+] Architecture: mipseb [+] Building QEMU disk image... [+] Setting up the network connection, please standby... [+] Network interfaces: [] [+] All set! Press ENTER to run the firmware... [+] When running, press Ctrl + A X to terminate qemu [+] Command line: /home/gh0st/firmware-analysis-toolkit/firmadyne/scratch/ 2/run.sh Starting firmware emulation... use Ctrl-a + x to exit

justin-in-time commented 2 months ago

I'm having the same issue with the firmware I'm looking at. No network interface is coming up and getting commands not found . I increased my timeout as well. Is it not moving over the squashfs-root directory because it seems like the filesystem isn't working.

[ 8.844000] OFFSETS: offset of pid: 0x100 offset of comm: 0x1f0 grep: /proc/filesystems: No such file or directory sh: 1: unknown operand /etc/rc.common: line 85: can't open /proc/cmdline: no such file netlink_bind socket failed

Try iptables -h' or 'iptables --help' for more information. iptables: Index of insertion too big. iptables v1.4.10: option-o' requires an argument Try `iptables -h' or 'iptables --help' for more information. /sbin/uci: Entry not found (cloud_status.client_info.connect_status=0) /sbin/uci: Entry not found (cloud_status.client_info.fw_download_progress=0) /sbin/uci: Entry not found (cloud_status.client_info.fw_download_status=0) /sbin/uci: Entry not found (cloud_status.client_info.fw_verify_status=0) /sbin/uci: Entry not found (cloud_status.client_info.disconnect_reason=0) /sbin/uci: Entry not found (cloud_status.client_info.reconnect_time=0) uci: Entry not found (cloud_status)

Previous examples show this working on netgear firmware. Is there additional effort that needs to be made to develop this capability for other vendors? It would be nice to get this to work with easy.