Welcome back to the reverse engineering embedded Linux devices blog series from Novetta. In the first post, Emulating Embedded Linux Devices with QEMU, we covered some basic tools commonly used in the reverse engineering process and utilized QEMU to execute a binary in user-mode. In the second part of this series, Emulating Embedded Linux Systems with QEMU, we used QEMU in system mode to create a VM to host the D-Link DIR-866L’s extracted squashfs root, and managed to get the web server started. In this installment, we will design a fuzzer capable of re-discovering a public vulnerability in the D-Link…
Emulating Embedded Linux Systems with QEMU
This blog is the second post in our Embedded Linux Device Security Research series. In the first post, Emulating Embedded Linux Applications with QEMU, we covered some commonly used tools and discussed using QEMU in user-mode to emulate a single binary. This post covers how to use QEMU in system mode to create a VM to emulate the target device. When emulating individual binaries doesn’t cut it, you can run QEMU in system mode to emulate an entire OS. From the previous post, we know that the D-Link DIR-866L is a MIPS device, so we will use the qemu-system-mips emulator….
Emulating Embedded Linux Devices with QEMU
Recently Internet of Things (IoT) device security has come into mainstream focus. With the rise of IoT botnets (like Mirai), IoT devices are receiving increasingly more attention from both attackers and security researchers. For people new to the world of binary exploitation, many embedded Linux devices are an attractive target to learn various vulnerability research techniques. Most embedded devices lack the security features of modern Operating Systems (OSs), such as memory protections (Data Execution Prevention (DEP)/exec-shield/etc; basically W^X page permissions), stack cookies, strong Address Space Layout Randomization (ASLR) and control flow integrity solutions (such as CFG). The lack of protections,…
