Asking for guidance to emulate firmwares using qiling

[josephKhoury95]

Hello,

I am interested in using qiling for firmware emulation. However, I need guidance to make qiling work.

I have different firmware, after extracting the .bin using binwalk I can have access to the rootfs. I am using qltool to emulate the firmware. But my main problem is I don't know what file to include as the first argument in the below command, I watched the videos on youtube and checked the documentation most of the example are using bin/httpd, does that mean I need to find the executable file for the server, and what if such file does not exist in the extraction? This is the command I am using: /qltool run -f examples/rootfs/x8664_linux/bin/x8664_hello --rootfs examples/rootfs/x8664_linux/

Also, if I want to run qiling using python, what is the envs variable, and from where I can get the values for each firmware.

And one last thing, is it possible to emulate different firmware in qiling using python threading?

Thank you

[kabeor]

@josephKhoury95 Hi, for your first question, you can try to emulate any executable file with qiling, so just choose which you want to emulate and /qltool run -f file/path --rootfs rootfs/path.

If you can't find any thing executable in the extraction, that means some thing wrong when you extract .bin

About second thing, in fact i didn't understand what you mean, you can check every value by qiling API.

Finally, as we all know, Python does not native support multithreading, so our multithread functions maybe not perfect, you can try it anyway, just set ql.multithread = True

[josephKhoury95]

Thank you @kabeor for your response.

I am able to extract the binary and have access to the full root file system. But, what I need help with; is understanding what qiling is looking for (what file?) to emulate the firmware. In the extraction, there is a lot of executable files. Which one specifical should I look for?

(Just a note: my ultimate goal is to emulate the firmware, make it have an IP address interact with it, is this possible in qiling? Because what I am seeing and understanding from you that qiling is emulating one executable file, for example, httpd in the youtube videos and demos)

Thank you for bearing with me, I am trying to learn and make it work.

[kabeor]

@josephKhoury95 Well, you see, qiling is a 'binary emulation framework', but firmware is actually an OS. So if you want to emulate and debug binary, qiling is ok. But about emulating firmware, I suggest you use QEMU.

[josephKhoury95]

Thank you