[+] System emulation of Linux based embedded devices.
This module builds and emulates Linux firmware - this module is based on the great work of firmadyne
Check out the original firmadyne project at https://github.com/firmadyne
[*] Testing root path (1/1): /logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extract/1179788-3612812.squashfs_v4_le_extract
[*] Found supported architecture mipsel
==> Create Qemu filesystem for full system emulation
[*] Create Qemu filesystem for emulation - /logs/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extract/1179788-3612812.squashfs_v4_le_extract.
[*] Size of filesystem for emulation - 428807424.
[*] Name of filesystem for emulation - 1179788-3612812.squashfs_v4_le_extract_mipsel-19717.
[*] Creating Partition Table
[*] Identify Qemu Image device for /logs/l10_system_emulation/1179788-3612812.squashfs_v4_le_extract_mipsel-19717
[*] Qemu Image device: /dev/loop0p1
[*] Device mapper created at /dev/loop0p1
[*] Creating Filesystem
[*] Mounting QEMU Image Partition 1 to /logs/l10_system_emulation/emulation_tmp_fs_EMBA
[*] Copy extracted root filesystem to new QEMU image
[*] Binwalk v3+ creates raw files on extraction. We remove these files from our emulation root directory
[*] Multiple firmwares have broken links and script and ELF permissions - We fix them now
[*] Creating EMBA emulation helper directories within the firmware environment
[*] Patching filesystem (chroot)
[*] fixImage.sh (chroot)
[*] inferFile.sh (chroot)
[*] EMBA inferFile script starting ...
[*] Found boot file /etc/init.d/rcS
[*] Found boot file /etc/init0.d/rcS
[*] Found boot file /firmadyne/init
[*] Found boot file /sbin/init
[*] Writing firmadyne init /etc/init.d/rcS
[*] Writing firmadyne init /etc/init0.d/rcS
[*] Writing firmadyne init /sbin/init
[*] Re-creating firmadyne/init:
[*] Re-creating BusyBox applet link for /bin/linuxrc
[*] Re-creating BusyBox applet link for /bin/init
/etc/init.d/rcS
/etc/init0.d/rcS
/sbin/init
/bin/linuxrc
/bin/init
/firmadyne/preInit.sh
[*] EMBA inferFile script finished ...
[*] inferService.sh (chroot)
[*] EMBA inferService script starting ...
[*] Service detection running ...
[*] Writing EMBA service starter for /etc/init.d/S16ipv6.sh service
[*] Writing EMBA service starter for /etc/init.d/S19init.sh service
[*] Writing EMBA service starter for /etc/init.d/S50config.sh service
[*] Writing EMBA service starter for /etc/init.d/S10init.sh service
[*] Writing EMBA service starter for /etc/init.d/S20interfaces.sh service
[*] Writing EMBA service starter for /etc/init.d/S20init.sh service
[*] Writing EMBA service starter for /etc/init.d/S15pts.sh service
[*] Writing EMBA service starter for /etc/init.d/rcS service
[*] Writing EMBA service starter for /etc/init.d/S45gpiod.sh service
[*] Writing EMBA service starter for /etc/init0.d/S65ddnsd.sh service
[*] Writing EMBA service starter for /etc/init0.d/S40event.sh service
[*] Writing EMBA service starter for /etc/init0.d/S41autowan.sh service
[*] Writing EMBA service starter for /etc/init0.d/S41autowanv6.sh service
[*] Writing EMBA service starter for /etc/init0.d/S21wlan.sh service
[*] Writing EMBA service starter for /etc/init0.d/S41inf.sh service
[*] Writing EMBA service starter for /etc/init0.d/S42pthrough.sh service
[*] Writing EMBA service starter for /etc/init0.d/rcS service
[*] Writing EMBA service starter for /etc/init0.d/S40gpioevent.sh service
[*] Writing EMBA service starter for /etc/init0.d/S80telnetd.sh service
[*] Writing EMBA service starter for /etc/init0.d/S21layout.sh service
[*] Writing EMBA process starter for /usr/sbin/pppd
[*] Writing EMBA process starter for /usr/sbin/telnetd
[*] Writing EMBA process starter for /sbin/httpd
[*] Writing EMBA debugging service for the EMBA netcat listener
[*] Writing EMBA debugging service for the EMBA telnet listener
[*] EMBA inferService script finished ...
[*] Generated injection scripts with marker 7976.
[*] Setting up system mode emulation environment on target filesystem
[*] Setting up busybox - mipsel (/external/EMBA_Live_bins/busybox-v1.36.1/busybox.mipsel)
[*] Setting up console - mipsel (/external/EMBA_Live_bins/console/console.mipsel)
[*] Setting up libnvram_dbg.so - mipsel (/external/EMBA_Live_bins/libnvram/libnvram_dbg.so.mipsel_musl_1.1.24)
[*] Setting up libnvram_nondbg.so - mipsel (/external/EMBA_Live_bins/libnvram/libnvram_nondbg.so.mipsel_musl_1.1.24)
[*] Setting up libnvram_ioctl_dbg.so - mipsel (/external/EMBA_Live_bins/libnvram_ioctl/libnvram_ioctl_dbg.so.mipsel_musl_1.1.24)
[*] Setting up libnvram_ioctl_nondbg.so - mipsel (/external/EMBA_Live_bins/libnvram_ioctl/libnvram_ioctl_nondbg.so.mipsel_musl_1.1.24)
[*] Setting up strace - mipsel (/external/EMBA_Live_bins/strace/strace.mipsel)
[*] Setting up netcat - mipsel (/external/EMBA_Live_bins/netcat/netcat.mipsel)
[*] Setting up gdb - mipsel (/external/EMBA_Live_bins/gdb/gdb.mipsel)
[*] Setting up gdbserver - mipsel (/external/EMBA_Live_bins/gdbserver/gdbserver.mipsel)
[*] Setting up emulation scripts
[*] Processing init files:
/etc/init.d/rcS
/etc/init0.d/rcS
/sbin/init
/bin/linuxrc
/bin/init
/firmadyne/preInit.sh
==> [*] Processing init file /etc/init.d/rcS (1/6)
[*] Linking to dbg libnvram.so
[*] Linking to dbg libnvram_ioctl.so
[*] Firmware Init file details:
/logs/l10_system_emulation/emulation_tmp_fs_EMBA/etc/init.d/rcS: POSIX shell script, ASCII text executable
[*] EMBA Init starter file details:
/logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/preInit.sh: a /firmadyne/sh script, ASCII text executable
[*] Backup original init file /logs/l10_system_emulation/emulation_tmp_fs_EMBA/etc/init.d/rcS
[*] inferService.sh (chroot)
[*] EMBA inferService script starting ...
[*] Service detection running ...
[*] Writing EMBA debugging service for the EMBA netcat listener
[*] Writing EMBA debugging service for the EMBA telnet listener
[*] EMBA inferService script finished ...
[*] Created init service entry for starting service /etc/init.d/S10init.sh start
[*] Created init service entry for starting service /etc/init.d/S15pts.sh start
[*] Created init service entry for starting service /etc/init.d/S16ipv6.sh start
[*] Created init service entry for starting service /etc/init.d/S19init.sh start
[*] Created init service entry for starting service /etc/init.d/S20init.sh start
[*] Created init service entry for starting service /etc/init.d/S20interfaces.sh start
[*] Created init service entry for starting service /etc/init.d/S45gpiod.sh start
[*] Created init service entry for starting service /etc/init.d/S50config.sh start
[*] Created init service entry for starting service /etc/init.d/rcS start
[*] Created init service entry for starting service /etc/init0.d/S21layout.sh start
[*] Created init service entry for starting service /etc/init0.d/S21wlan.sh start
[*] Created init service entry for starting service /etc/init0.d/S40event.sh start
[*] Created init service entry for starting service /etc/init0.d/S40gpioevent.sh start
[*] Created init service entry for starting service /etc/init0.d/S41autowan.sh start
[*] Created init service entry for starting service /etc/init0.d/S41autowanv6.sh start
[*] Created init service entry for starting service /etc/init0.d/S41inf.sh start
[*] Created init service entry for starting service /etc/init0.d/S42pthrough.sh start
[*] Created init service entry for starting service /etc/init0.d/S65ddnsd.sh start
[*] Created init service entry for starting service /etc/init0.d/S80telnetd.sh start
[*] Created init service entry for starting service /etc/init0.d/rcS start
[*] Add network.sh entry to /logs/l10_system_emulation/emulation_tmp_fs_EMBA/etc/init.d/rcS
[*] Created service entry for starting service /firmadyne/busybox telnetd -p 9877 -l /firmadyne/sh
[*] Created service entry for starting service /firmadyne/netcat -nvlp 9876 -e /firmadyne/sh
[*] Created service entry for starting service /sbin/httpd
[*] Created service entry for starting service /usr/sbin/pppd
[*] Created service entry for starting service /usr/sbin/telnetd
[*] EMBA init starter file: /logs/l10_system_emulation/emulation_tmp_fs_EMBA/etc/init.d/rcS
#!/bin/sh
for i in /etc/init.d/S??* ;do
# Ignore dangling symlinks (if any).
[ ! -f "$i" ] && continue
# Run the script.
echo "[$i]"
$i
done
echo "[$0] done!"
/etc/init0.d/rcS
/firmadyne/preInit.sh &
/firmadyne/init_service.sh &
/firmadyne/network.sh &
/firmadyne/run_service.sh &
/firmadyne/busybox sleep 36000
[*] Firmware Init file details: /etc/init.d/rcS
#!/bin/sh
for i in /etc/init.d/S??* ;do
# Ignore dangling symlinks (if any).
[ ! -f "$i" ] && continue
# Run the script.
echo "[$i]"
$i
done
echo "[$0] done!"
/etc/init0.d/rcS
/firmadyne/preInit.sh &
/firmadyne/init_service.sh &
/firmadyne/network.sh &
/firmadyne/run_service.sh &
/firmadyne/busybox sleep 36000
[*] EMBA Target filesytem:
2 1 drwxr-xr-x 17 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA
11 12 drwx------ 2 root root 12288 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/lost+found
61441 1 drwxrwxr-x 2 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/sys
59393 1 drwxrwxr-x 2 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/home
43009 1 drwxrwxr-x 2 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/proc
34817 1 drwxrwxr-x 2 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/bin
88065 1 drwxrwxr-x 11 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/htdocs
57345 1 drwxrwxr-x 10 root root 1024 Sep 16 18:22 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/etc
8193 1 drwxrwxr-x 5 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/usr
69633 1 drwxrwsr-x 4 root root 1024 Sep 16 18:22 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/lib
36865 1 drwxr-xr-x 4 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne
71681 1 drwxrwxr-x 2 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/var
38913 1 drwxrwxr-x 2 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/sbin
12289 1 drwxrwxr-x 9 root root 1024 Sep 16 18:22 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/dev
12 0 lrwxrwxrwx 1 root root 7 Sep 16 18:22 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/tmp -> var/tmp
40961 1 drwxrwxr-x 2 root root 1024 Sep 16 18:22 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/www
98305 1 drwxrwxr-x 2 root root 1024 Jan 22 2013 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/mnt
[*] EMBA emulation helpers directory:
36865 1 drwxr-xr-x 4 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne
36871 1 -rwxr-xr-x 1 root root 89 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/init
36885 0 crw-rw-rw- 1 root root 4, 65 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/ttyAMA1
36867 1 drwxr-xr-x 2 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram.override
36881 126 -rwxr-xr-x 1 root root 127740 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/netcat
36875 36 -rwxr-xr-x 1 root root 35592 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/console
36876 38 -rwxr-xr-x 1 root root 37628 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram_dbg.so
36884 0 crw-rw-rw- 1 root root 4, 65 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/ttyS1
36882 8661 -rwxr-xr-x 1 root root 8832436 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/gdb
36886 3 -rwxr-xr-x 1 root root 2796 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/preInit.sh
36868 0 lrwxrwxrwx 1 root root 18 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/sh -> /firmadyne/busybox
36889 7 -rwxr-xr-x 1 root root 7063 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/run_service.sh
36883 898 -rwxr-xr-x 1 root root 914404 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/gdbserver
36891 0 lrwxrwxrwx 1 root root 21 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram_ioctl.so -> libnvram_ioctl_dbg.so
36877 28 -rwxr-xr-x 1 root root 27320 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram_nondbg.so
36874 1643 -rwxr-xr-x 1 root root 1674172 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/busybox
36887 9 -rwxr-xr-x 1 root root 8373 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/network.sh
36866 1 drwxr-xr-x 2 root root 1024 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram
36880 1494 -rwxr-xr-x 1 root root 1522440 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/strace
36878 39 -rwxr-xr-x 1 root root 38512 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram_ioctl_dbg.so
36873 1 -rw-r--r-- 1 root root 143 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/service
36872 1 -rw-r--r-- 1 root root 44 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/init_tmp_sorted
36888 3 -rwxr-xr-x 1 root root 2492 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/init_service.sh
36870 1 -rw-r--r-- 1 root root 608 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/startup_service
36869 1 -rw-r--r-- 1 root root 28 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/dir_log
36879 29 -rwxr-xr-x 1 root root 27688 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram_ioctl_nondbg.so
36890 0 lrwxrwxrwx 1 root root 15 Sep 16 20:58 /logs/l10_system_emulation/emulation_tmp_fs_EMBA/firmadyne/libnvram.so -> libnvram_dbg.so
==>
[*] Test basic emulation and identify network settings.
[*] Running firmware 1179788-3612812.squashfs_v4_le_extract_mipsel-19717: Terminating after 660 secs...
[*] Qemu network identification run for mipsel - 1179788-3612812.squashfs_v4_le_extract_mipsel-19717
[*] Kernel 2.x detected -> Using Kernel v4.x
[*] Qemu parameters used in network detection mode:
MACHINE: malta
KERNEL: /external/EMBA_Live_bins/Linux-Kernel-v4.14.336/vmlinux.mipsel.4
DRIVE: -drive if=ide,format=raw,file=/logs/l10_system_emulation/1179788-3612812.squashfs_v4_le_extract_mipsel-19717
KINIT: init=/etc/init.d/rcS
ROOT_DEV: /dev/sda1
QEMU binary: qemu-system-mipsel
NETWORK: -netdev socket,id=net0,listen=:2000 -device e1000,netdev=net0 -netdev socket,id=net1,listen=:2001 -device e1000,netdev=net1 -netdev socket,id=net2,listen=:2002 -device e1000,netdev=net2 -netdev socket,id=net3,listen=:2003 -device e1000,netdev=net3
Init file: /etc/init.d/rcS
Console interface: ttyS0
[*] Starting firmware emulation for network identification - qemu-system-mipsel / mipsel / 1179788-3612812.squashfs_v4_le_extract_mipsel-19717 ... use Ctrl-a + x to exit
==>
[+] Booted system detected.
[*] Detected UDP service startup: dnsmasq / 53
[*] Detected TCP service startup: dnsmasq / 53
[*] Detected UDP service startup: httpd / 1900
[*] Detected TCP service startup: httpd / 49152
[*] Detected TCP service startup: httpd / 80
[*] Detected UDP service startup: llmnresp / 5355
[*] Detected UDP service startup: neaps / 64512
[*] Detected UDP service startup: netbios / 137
[*] Detected TCP service startup: telnetd / 23
[*] Detected UDP service startup: udhcpd / 67
[*] Possible VLAN details detected: register_vlan_dev[PID: 339 (vconfig)]: dev:eth2.0 vlan_id:0
[*] Possible VLAN details detected: register_vlan_dev[PID: 345 (vconfig)]: dev:eth2.2 vlan_id:2
[*] Possible interface candidate detected: (ip)]: device:br0 ifa:0x0100a8c0
[*] Identified IP address: 192.168.0.1 / (ip)]: device:br0 ifa:0x0100a8c0
[*] Possible br interface detected: br0 / IP: 192.168.0.1
[+] Processing matching bridge interface: br:br0 dev:eth2.0 / network device: br0
[*] Analyzing VLAN details register_vlan_dev[PID: 339 (vconfig)]: dev:eth2.0 vlan_id:0
[*] VLAN details: register_vlan_dev[PID: 339 (vconfig)]: dev:eth2.0 vlan_id:0
[*] Interface details: eth2
[*] Possible matching VLAN details detected: register_vlan_dev[PID: 339 (vconfig)]: dev:eth2.0 vlan_id:0
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: bridge / priority: 6
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: bridge / priority: 5
[*] Analyzing VLAN details register_vlan_dev[PID: 345 (vconfig)]: dev:eth2.2 vlan_id:2
[*] VLAN details: register_vlan_dev[PID: 345 (vconfig)]: dev:eth2.2 vlan_id:2
[*] Interface details: eth2
[*] Possible matching VLAN details detected: register_vlan_dev[PID: 345 (vconfig)]: dev:eth2.2 vlan_id:2
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 2 / network mode: bridge / priority: 6
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 2 / network mode: bridge / priority: 5
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: bridge / priority: 4
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: bridge / priority: 6
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: NONE / network mode: bridge / priority: 6
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: bridge / priority: 6
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: bridge / priority: 5
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth2 / vlan id: 0 / network mode: default / priority: 3
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: eth2 / network device: eth2 / vlan id: 0 / network mode: interface / priority: 2
[+] Interface details detected: IP address: 192.168.0.1 / bridge dev: br0 / network device: eth0 / vlan id: NONE / network mode: normal / priority: 1
[*] Firmware 1179788-3612812.squashfs_v4_le_extract_mipsel-19717 finished for identification of the network configuration
[*] Identify Qemu Image device for /logs/l10_system_emulation/1179788-3612812.squashfs_v4_le_extract_mipsel-19717
[*] Device mapper created at /dev/loop0p1
[*] Mounting QEMU Image Partition 1 to /logs/l10_system_emulation/emulation_tmp_fs_EMBA
[*] Identified the following network configuration options:
[*] Unsorted configuration
192.168.0.1 - br0 - eth2 - 0 - bridge - 6
192.168.0.1 - br0 - eth2 - 0 - bridge - 5
192.168.0.1 - br0 - eth2 - 2 - bridge - 6
192.168.0.1 - br0 - eth2 - 2 - bridge - 5
192.168.0.1 - br0 - eth2 - 0 - bridge - 4
192.168.0.1 - br0 - eth2 - 0 - bridge - 6
192.168.0.1 - br0 - eth2 - NONE - bridge - 6
192.168.0.1 - br0 - eth2 - 0 - bridge - 6
192.168.0.1 - br0 - eth2 - 0 - bridge - 5
192.168.0.1 - br0 - eth2 - 0 - default - 3
192.168.0.1 - eth2 - eth2 - 0 - interface - 2
192.168.0.1 - br0 - eth0 - NONE - normal - 1
[*] Sorted and unique configuration
192.168.0.1 - br0 - eth2 - 0 - bridge - 6
192.168.0.1 - br0 - eth2 - NONE - bridge - 6
192.168.0.1 - br0 - eth2 - 2 - bridge - 6
192.168.0.1 - br0 - eth2 - 0 - bridge - 5
192.168.0.1 - br0 - eth2 - 2 - bridge - 5
192.168.0.1 - br0 - eth2 - 0 - bridge - 4
192.168.0.1 - br0 - eth2 - 0 - default - 3
192.168.0.1 - eth2 - eth2 - 0 - interface - 2
192.168.0.1 - br0 - eth0 - NONE - normal - 1
[*] Final configuration
192.168.0.1 - br0 - eth2 - 0 - bridge - 6
192.168.0.1 - br0 - eth2 - NONE - bridge - 6
192.168.0.1 - br0 - eth2 - 2 - bridge - 6
192.168.0.1 - br0 - eth2 - 0 - default - 3
192.168.0.1 - eth2 - eth2 - 0 - interface - 2
192.168.0.1 - br0 - eth0 - NONE - normal - 1
[*] Testing system emulation with configuration: 6-192.168.0.1-br0-eth2-0-bridge.
==> Setup networking - 6-192.168.0.1-br0-eth2-0-bridge
[*] Creating TAP device tap213_0 ...
[*] Bringing up HOSTNETDEV tap213_0.0 / VLAN ID 0 / TAPDEV tap213_0.
[*] Bringing up HOSTIP 192.168.0.2 / IP address 192.168.0.1 / TAPDEV tap213_0.
[*] Identify Qemu Image device for /logs/l10_system_emulation/1179788-3612812.squashfs_v4_le_extract_mipsel-19717
[*] Device mapper created at /dev/loop0p1
[*] Mounting QEMU Image Partition 1 to /logs/l10_system_emulation/emulation_tmp_fs_EMBA
[*] Setting network configuration in target filesystem:
Network interface: eth2
Network mode: bridge
Bridge interface: br0
IP address: 192.168.0.1
[*] Checking for missing area /etc/init.d/S50config.sh in filesystem ...
[*] Found missing area /etc/init.d/S50config.sh in filesystem ... trying to fix this now
[*] Linking to dbg libnvram.so
[*] Linking to dbg libnvram_ioctl.so
==>
[*] Kernel 2.x detected -> Using Kernel v4.x
[*] Network ID 0 connector / lNET_NUM: 2
[*] Create socket placeholder interface: 0
[*] Network ID 1 connector / lNET_NUM: 2
[*] Create socket placeholder interface: 1
[*] Network ID 2 connector / lNET_NUM: 2
[*] Connect interface: 2 to host
[*] Network ID 3 connector / lNET_NUM: 2
[*] Create socket placeholder interface: 3
[*] Network ID 4 connector / lNET_NUM: 2
[*] Network ID 4 bypass
[*] Network ID 5 connector / lNET_NUM: 2
[*] Network ID 5 bypass
[*] Qemu parameters used in run mode:
MACHINE: malta
KERNEL: /external/EMBA_Live_bins/Linux-Kernel-v4.14.336/vmlinux.mipsel.4
DISK: -drive if=ide,format=raw,file=/logs/l10_system_emulation/1179788-3612812.squashfs_v4_le_extract_mipsel-19717
KINIT: init=/etc/init.d/rcS
ROOT_DEV: /dev/sda1
QEMU: qemu-system-mipsel
NETWORK: -device e1000,netdev=net0 -netdev socket,id=net0,listen=:2000 -device e1000,netdev=net1 -netdev socket,id=net1,listen=:2001 -device e1000,netdev=net2 -netdev tap,id=net2,ifname=tap213_0,script=no -device e1000,netdev=net3 -netdev socket,id=net3,listen=:2003
Init file: /etc/init.d/rcS
Console interface: ttyS0
[*] Starting firmware emulation qemu-system-mipsel / mipsel / 1179788-3612812.squashfs_v4_le_extract_mipsel-19717 / 192.168.0.1 ... use Ctrl-a + x to exit
[+] Host with 192.168.0.1 is reachable via ICMP.
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.680 ms
--- 192.168.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.680/0.680/0.680/0.000 ms
[+] Host with 192.168.0.1 is reachable on TCP port 0 via hping.
HPING 192.168.0.1 (tap213_0.0 192.168.0.1): NO FLAGS are set, 40 headers + 0 data bytes
len=46 ip=192.168.0.1 ttl=64 DF id=0 sport=0 flags=RA seq=0 win=0 rtt=1.9 ms
[*] Default Nmap portscan for 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=10.4 ms
--- 192.168.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 10.443/10.443/10.443/0.000 ms
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-16 21:11 +0000
Nmap scan report for 192.168.0.1
Host is up (0.00066s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE VERSION
23/tcp open telnet D-Link 524, DIR-300, or WBR-1310 WAP telnetd
MAC Address: 00:DE:FA:1A:01:00 (Unknown)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.14
Network Distance: 1 hop
Service Info: Device: WAP
TRACEROUTE
HOP RTT ADDRESS
1 0.66 ms 192.168.0.1
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.78 seconds
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-16 21:11 +0000
Nmap scan report for 192.168.0.1
Host is up (0.00054s latency).
PORT STATE SERVICE VERSION
111/udp closed rpcbind
123/udp closed ntp
137/udp open|filtered netbios-ns
161/udp closed snmp
1434/udp closed ms-sql-m
MAC Address: 00:DE:FA:1A:01:00 (Unknown)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.60 seconds
[+] Already detected running network services via Nmap ... further detection active - CNT: 1
[*] TCP Services detected via startup: 23,49152,53,80,
[*] UDP Services detected via startup: 137,1900,53,5355,64512,67,
[*] TCP Services detected via netstat: 23,49152,53,80,
[*] UDP Services detected via netstat: 137,1900,53,5355,64512,67,
[*] Checking TCP services T:0,21,22,23,443,49152,53,80,8080
[*] Checking UDP services U:0,137,1900,53,5355,64512,67
[*] Nmap portscan for network services (T:0,21,22,23,443,49152,53,80,8080,U:0,137,1900,53,5355,64512,67) started during system init on 192.168.0.1
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-16 21:14 +0000
Nmap scan report for 192.168.0.1
Host is up (0.0013s latency).
PORT STATE SERVICE VERSION
0/tcp closed unknown
21/tcp closed ftp
22/tcp closed ssh
23/tcp open telnet D-Link 524, DIR-300, or WBR-1310 WAP telnetd
53/tcp open domain dnsmasq 2.45
80/tcp open http D-Link DIR-600 WAP http config 2.14
443/tcp closed https
8080/tcp closed http-proxy
49152/tcp open upnp D-Link DIR-600 WAP UPnP 2.14 (UPnP 1.0)
0/udp closed unknown
53/udp open domain dnsmasq 2.45
67/udp open|filtered dhcps
137/udp open|filtered netbios-ns
1900/udp open|filtered upnp
5355/udp open|filtered llmnr
64512/udp open|filtered unknown
MAC Address: 00:DE:FA:1A:01:00 (Unknown)
Service Info: OS: Linux; Device: WAP; CPE: cpe:/h:dlink:dir-600:2.14, cpe:/o:linux:linux_kernel, cpe:/h:d-link:dir-600
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 110.21 seconds
[+] System emulation was successful.
[+] System should be available via IP 192.168.0.1.
[+] More than 2 TCP based Network services are available - no further emulation runs are needed
==> Archive to re-run emulated environment
With the following archive it is possible to rebuild the created emulation environment fully automated.
[*] Download Qemu emulation archive.
==> System emulation results
EMBA was able to identify the following system emulation results:
[*] RESULT_SOURCE;Booted state;ICMP state;TCP-0 state;TCP state;online services cnt;available network services;IP address;Network mode (NETWORK_DEVICE|ETH_INT|VLAN_ID|INIT_FILE|INIT_MECHANISM);ARCHIVE_PATH_;R_PATH;
[+] EMBA;Booted yes;ICMP ok;TCP-0 ok;TCP ok/tcp,49152/tcp,53/tcp,53/udp,80/tcp;IP address: 192.168.0.1;Network mode: bridge (br0|eth2|0|/etc/init.d/rcS|init);archive-1179788-3612812.squashfs_v4_le_extract_mipsel-19717-5530;/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extract/1179788-3612812.squashfs_v4_le_extract;
[+] Identified the following system emulation results (with running network services):
/home/runner/work/emba/emba/DIR-600_fw_revb5_214b01_ALL_de_20130122.zip;EMBA;Booted yes;ICMP ok;TCP-0 ok;TCP ok/tcp,49152/tcp,53/tcp,53/udp,80/tcp;IP address: 192.168.0.1;Network mode: bridge (br0|eth2|0|/etc/init.d/rcS|init);archive-1179788-3612812.squashfs_v4_le_extract_mipsel-19717-5530;/firmware/unblob_extracted/firmware_extract/DIR-600_fw_revb5_214b01_ALL_de_20130122/dir600b_v2.14_d1mg.bin_extract/1179788-3612812.squashfs_v4_le_extract
[+] System recovery was successful. Further live analysis possible for IP 192.168.0.1.
