firmadyne / console

Serial console application (deprecated)

Introduction

This is a small binary that spawns a console on the `/firmadyne/ttyS1`` special character device at system startup. In conjunction with a patched filesystem and instrumented kernel, this allows an analyst to interact with an emulated firmware image through QEMU, since some firmware images do not spawn a terminal on the primary serial console.

Usage

First, create the special character device within the firmware image:

mknod -m 666 /firmadyne/ttyS1 c 4 65

Next, copy this binary into the firmware image:

cp console /firmadyne/console

Then, it will be automatically executed by the instrumented kernel during system bootup after the 4th execve() call if the firmadyne.execute kernel parameter is set to 1 (this is the default).

Notes

ARM Serial Devices

QEMU ARM guests do not currently support multiple serial consoles. You can build qemu with this patch or try the PANDA emulator to run ARM guests with multiple serial devices.

Shell Usability

If you start a serial console with -serial stdio, pressing ctrl-C, ctl-Z, or so on will be sent to the emulator itself. If you wish for these commands to be sent to the guest, you can use -nographic (if running with a single serial console), or -serial telnet:localhost:4321,noserver,nowait -serial stdio to expose a root shell on ttyS1 via telnet and the standard guest output on stdio. Then you can connect to the root console via telnet (with telnet localhost 4321) and press ctrl-C, ctrl-Z and have these commands sent directly into the guest.

console's Issues

kernel panic - not syncing: No init found.

I try to follow the usage to run a firmware.I run the example successully.But when i try to start another firmware.It's always have no Internet interfaces but without any error in the step of generating run.sh. when I run the run.sh,the error is:
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
[ 2.472000] VFS: Mounted root (ext2 filesystem) on device 8:1.
[ 2.484000] Freeing prom memory: 956k freed
[ 2.500000] Freeing unused kernel memory: 220k freed
[ 2.516000] firmadyne: do_execve: /firmadyne/console
[ 2.528000] OFFSETS: offset of pid: 0x100 offset of comm: 0x1f0
[ 2.544000] Kernel panic - not syncing: No init found. Try passing init= option to kernel.

I deleted the image file and try again but still not work.

Console access

I am trying to get command-line access to a firmware that I am running using firmadyne. The process I am following is:

# Using firmware-mod-kit
./extract-firmware.sh FW_RT_N15U_30043763754.trx

mkdir FW_RT_N15U_30043763754/rootfs/firmadyne

mknod -m 666 FW_RT_N15U_30043763754/rootfs/firmadyne/ttyS1 c 4 65

cp console FW_RT_N15U_30043763754/rootfs/firmadyne/console

# Using firmware-mod-kit
./build-firmware.sh FW_RT_N15U_30043763754

When I try to run the firmware it fails to start and in qemu.initial.serial.log I find:

"Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,1)"

I saw the FAQ on the main firmadyne README that mentioned an issue with kpartx and to try increasing the timeout in inferNetwork.sh and deleting the scratch directory but neither seemed to resolve the issue.

Is this the correct process for setting up the console?

Also of note, if I extract the firmware and re-build it again using the firmware-mod-kit, omiting the modification steps, the firmware loads up and runs properly.