MIPS BE - Qemu Debug Build (Meraki)

Build.md

Platform.

Assumes Ubuntu 14.04.

Install dependencies.

sudo apt-get update -y
sudo apt-get -y install git-core build-essential libssl-dev \
  libncurses5-dev unzip gawk zlib1g-dev gettext openjdk-8-jdk \
  mercurial libtest-xml-simple-perl python2.7 \
  subversion libxml-parser-perl qemu-system-mips bridge-utils

Install Binwalk.

git clone https://github.com/ReFirmLabs/binwalk.git
cd binwalk
./deps
sudo python setup.py install

Install Radare2.

git clone https://github.com/radare/radare2.git
cd radare2

Fetch the SDK.

curl -D - -O http://archive.openwrt.org/chaos_calmer/15.05.1/malta/be/OpenWrt-SDK-15.05.1-malta-be_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2
tar -xjvf OpenWrt-SDK-15.05.1-malta-be_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2

Get OpenWRT sources.

git clone https://github.com/openwrt/chaos_calmer.git
cd chaos_calmer/
./scripts/feeds update -a
./scripts/feeds install -a

Grab the MIPS BE Build.

curl -O .config https://gist.githubusercontent.com/darkarnium/fae90ac83ac7a5319e9dfb1c87c7347b/raw/2f065cbf6f5607af4e74d459a092c74dea213ed8/.config

Copy the toolchain from SDK into buildroot.

cp -r ../OpenWrt-SDK-15.05.1-malta-be_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64/staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_uClibc-0.9.33.2/ ./

Add toolchains to path.

PATH=$PATH:$(pwd)/staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_uClibc-0.9.33.2/bin
export PATH
STAGING_DIR=$(pwd)/staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_uClibc-0.9.33.2
export STAGING_DIR

Build.

make -j2 V=s

Build ext4 filesystem for storage.

dd if=/dev/zero of=./filesystem.ext4 bs=1M count=1024
mkfs.ext4 ./filesystem.ext4

Run it.

cd build_dir/target-mips_mips32_uClibc-0.9.33.2/linux-malta_be/

qemu-system-mips \
  -hda root.ext4 \
  -hdc filesystem.ext4 \
  -kernel vmlinux.elf \
  -nographic \
  -m 256 \
  -device pcnet,netdev=n0 -netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=tcp::5555-:5555 \
  -nographic \
  -append "root=/dev/sda console=ttyS0"

Via console, set password.

passwd root

Fetch the firmware image.

curl -O https://.../FL128PIF-Dump.bin

Fetch extracted binaries, and SCP over to Qemu.

curl https://.../binaries/libmeraki.so
curl https://.../binaries/serial_logincheck

scp libmeraki.so [email protected]:/lib
scp serial_logincheck [email protected]:/bin

chmod a+x /bin/serial_logincheck

Kick off gdb.

gdb -q /tmp/serial_logincheck