Matteo Croce wrote:
Hi,
I have a machine, an AR7 MIPS router I want to hack, but I'm unable
to run _any_ executable on that machine outside the ones in the firmware.
I tried building a static mips1 binary, but it fails so:
# /var/test.bin
/var/test.bin: 1: Syntax error: "(" unexpected
so I downloaded a binary builtin in the firmware and I compared it to my own:
$ file busybox.bin test.bin
busybox.bin: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), stripped
test.bin: ELF 32-bit LSB executable, MIPS, version 1 (SYSV), statically linked, stripped
busybox.bin is the builtin busybox while test.bin is a static HelloWorld
I ran readelf on it:
$ readelf -h busybox.bin
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: MIPS R3000
Version: 0x1
Entry point address: 0x4037e0
Start of program headers: 52 (bytes into file)
Start of section headers: 337304 (bytes into file)
Flags: 0x5, noreorder, cpic, mips1
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 6
Size of section headers: 40 (bytes)
Number of section headers: 21
Section header string table index: 20
$ readelf -h test.bin
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: MIPS R3000
Version: 0x1
Entry point address: 0x400140
Start of program headers: 52 (bytes into file)
Start of section headers: 11780 (bytes into file)
Flags: 0x50001007, noreorder, pic, cpic, o32, mips32
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 40 (bytes)
Number of section headers: 17
Section header string table index: 16
$ diff -u <(readelf -h busybox.bin) <(readelf -h test.bin)
--- /dev/fd/63 2008-02-13 00:26:48.880261477 +0100
+++ /dev/fd/62 2008-02-13 00:26:48.880261477 +0100
@@ -8,13 +8,13 @@
Type: EXEC (Executable file)
Machine: MIPS R3000
Version: 0x1
- Entry point address: 0x4037e0
+ Entry point address: 0x400140
Start of program headers: 52 (bytes into file)
- Start of section headers: 337304 (bytes into file)
- Flags: 0x5, noreorder, cpic, mips1
+ Start of section headers: 11780 (bytes into file)
+ Flags: 0x50001007, noreorder, pic, cpic, o32, mips32
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
- Number of program headers: 6
+ Number of program headers: 3
Size of section headers: 40 (bytes)
- Number of section headers: 21
- Section header string table index: 20
+ Number of section headers: 17
+ Section header string table index: 16
The router firmware uses:
# cat /proc/version
Linux version 2.4.17_mvl21-malta-mips_fp_le (root@xxxxxxxxxxxxxxxxxxxxx) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Fri Mar 18 11:00:12 EST 2005
IIRC, the definitions of the elf flags were wrong in 2.4.x (x < 20 or 25
or something like that). I had similar problems.
You should be able to run the binary if run a binary editor on it and
clear the mips32 flag (i.e. change the flags from 0x50001007 to just
0x1007).
If you want to generate the program with out the mips32 flag in the
first place you have to compile everything (libc, libgcc crt*.o, program
) with -mips1
It may be easier to run a program that post processes the executable to
clear the flag.
David Daney
