nongiach / arm_now

arm_now is a qemu powered tool that allows instant setup of virtual machines on arm cpu, mips, powerpc, nios2, x86 and more, for reverse, exploit, fuzzing and programming purpose.

arm_now 1.2

arm_now is a qemu powered tool that allows instant setup of virtual machines on arm cpu, mips, powerpc, nios2, x86 and more, for reverse, exploit, fuzzing and programming purpose.

Install

# pip3 install https://github.com/nongiach/arm_now/archive/master.zip --upgrade
# # Or you can also do:
# pip3 install arm_now

Supported System: Linux, Windows WSL, MacOS, Docker.

Docker install

If you are using docker, just run and enjoy!

$ docker run -it --name arm_now -v $PWD:/mount --rm bannsec/arm_now_docker arm_now

For a bash function wrapper see here: https://github.com/bannsec/arm_now_docker

Start an arm Virtual Machine

$ arm_now start armv5-eabi
Welcome to arm_now
buildroot login: root
# uname -m
armv7l

Resizing an arm Virtual Machine

$ arm_now resize +10G
WARNING: Image format was not specified for 'arm_now/rootfs.ext2' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
Image resized.

Debug the ls binary on mips

$ arm_now start mips32el
Welcome to arm_now
buildroot login: root
# gdb /bin/ls
(gdb) start
Temporary breakpoint 1, 0x00405434 in main ()
(gdb) x/i $pc
=> 0x405434 <main+12>:	li	a0,-1

How to exit qemu

Press "Ctrl + ]" (Ctrl + altgr + ] on azerty).

Wiki

All features and good use cases are documented in the wiki: https://github.com/nongiach/arm_now/wiki

• Exploit a heap use after free on PowerPC
• Run the game of life on a FPGA cpu (MicroBlaze)
• Share files
• Install new package
• ..

Supported cpu

CPU	images
arm	armv5-eabi, armv6-eabihf, armv7-eabihf
m68k	m68k-coldfire
microblaze	microblazeel, microblazebe
mips	mips32, mips32el, mips32r5el, mips32r6el
mips64	mips64-n32, mips64el-n32
xtensa	xtensa (a configurable processor)
nios2	nios2
powerpc	powerpc64-e5500, powerpc64-power8, powerpc64le-power8
sh4	sh-sh4
x86-32	x86-core2, x86-i686
x86-64	x86-64-core-i7
aarch64	aarch64

Writeups

Link	Credit
MIPS binary exploitation challenge	Aperikube

Ping me for any new writeups.

Project using arm_now

Project	Credit
Mandibule: linux elf injector for x86 x86_64 arm arm64	ixty

---

By @chaignc #HexpressoTeam.

arm_now's Issues

can arm_now access inet?

always url error , i think the network is ok

File "/usr/lib/python3.5/urllib/request.py", line 1263, in do_open
raise URLError(err)
urllib.error.URLError:

Clean the code plz

the first Cpio class needs to be deleted
https://github.com/nongiach/arm_now/blob/master/arm_now/filesystem.py

nios2 --sync doesn't seem to work

When I try to use --sync on the nios2 machine, it doesn't pick up the contents of the directory.
Syntax: arm_now start nios2 --offline --sync

However, when switching the machine to mips32el, the --sync does work.
Syntax: arm_now start mips32el --offline --sync

Thanks for any tips!

can not run arm_now

Hey.. trying to run arm_now on VM machine ubuntu20 with no luck

ubuntu:~$ arm_now
Traceback (most recent call last):
File "/home/thomas/.local/lib/python3.8/site-packages/arm_now/utils.py", line 44, in which
subprocess.check_output(["which", filename])
File "/usr/lib/python3.8/subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/usr/lib/python3.8/subprocess.py", line 512, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['which', 'e2cp']' returned non-zero exit status 1.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/bin/arm_now", line 11, in
load_entry_point('arm-now==1.24', 'console_scripts', 'arm_now')()
File "/home/thomas/.local/lib/python3.8/site-packages/arm_now/arm_now.py", line 72, in main
check_dependencies_or_exit()
File "/home/thomas/.local/lib/python3.8/site-packages/arm_now/arm_now.py", line 233, in check_dependencies_or_exit
which("e2cp",
File "/home/thomas/.local/lib/python3.8/site-packages/arm_now/utils.py", line 47, in which
if distribution() in kwargs:
File "/home/thomas/.local/lib/python3.8/site-packages/arm_now/utils.py", line 39, in distribution
return platform.linux_distribution()[0].lower()
AttributeError: module 'platform' has no attribute 'linux_distribution'

Help will be very appreciated

REDIR deprecated

arm_now/arm_now/arm_now.py

Line 263 in ad41778

return ''.join(map("-redir {} ".format, redir))

https://stackoverflow.com/questions/55043135/qemu-system-arm-redir-invalid-option

How can I start esp8266 machine using arm_now

I noticed that arm_now is able to start xtensa processor family. How could I start esp8266 machine using arm_now?

qemu-system-ppc64: -nic: invalid option

Tried this for PowerPC and ran into an error where -nic is no longer an option. Is there a work around for this ? Considering this is affecting each VM that I try to spin up I assume there will be a global release for this.

No LSB modules are available.
Distributor ID:	LinuxMint
Description:	Linux Mint 19.1 Tessa
Release:	19.1
Codename:	tessa

Linux ForeignHost 5.4.0-58-generic #64~18.04.1-Ubuntu SMP Wed Dec 9 17:11:11 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

arm_now start powerpc64-power8
(use --clean next time) An powerpc64le-power8 image exists, delete ? (y/n) y

Downloading /home/user/.config/arm_now/templates/powerpc64-power8.tar.xz from https://github.com/nongiach/arm_now_templates/raw/master/powerpc64-power8.tar.xz
 [*] 11.6 MB / 11.6 MB @ 3.9 MB/s [##################] [100%, 0s left]    
[+] Installed
Tempdir /tmp/tmpff2i96ie
File not found by ext2_lookup
WARNING: e2rm file already suppressed
Starting qemu-system-ppc64
stty intr ^]
       export QEMU_AUDIO_DRV="none"
       qemu-system-ppc64 -kernel arm_now/kernel -hda arm_now/rootfs.ext2 -append 'root=/dev/sda console=ttyS0 rw physmap.enabled=0 noapic'                -m 256M                -nographic                -serial stdio -monitor null  -nic user                                 -no-reboot
       stty intr ^c
    
qemu-system-ppc64: -nic: invalid option
+++++++++++++++++++++++++++ Checking the filesystem ++++++++++++++++++++++++++++
e2fsck 1.44.1 (24-Mar-2018)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

         787 inodes used (3.15%, out of 24960)
           4 non-contiguous files (0.5%)
           1 non-contiguous directory (0.1%)
             # of inodes with ind/dind/tind blocks: 214/22/0
       36547 blocks used (35.69%, out of 102400)
           0 bad blocks
           0 large files

         325 regular files
         166 directories
           1 character device file
           0 block device files
           0 fifos
           0 links
         286 symbolic links (286 fast symbolic links)
           0 sockets
------------
         778 files

qemu version

qemu-system-ppc64 --help
QEMU emulator version 2.11.1(Debian 1:2.11+dfsg-1ubuntu7.34)
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-ppc64 [options] [disk_image]

Can't start with ubuntu's latest QEMU

I'm on the latest ubuntu 18.04.3 with the QEMU installed from apt. When I start arm_now, the error message is shown below:

qemu-system-arm: -nic: invalid option

My QEMU version:

(arm_now) ~/tmp ᐅ qemu-system-arm -version
QEMU emulator version 2.11.1(Debian 1:2.11+dfsg-1ubuntu7.15)
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

But the -nic option is introduced in QEMU 2.12. See the post here: https://www.qemu.org/2018/05/31/nic-parameter/

Can't Execute Binary

Good afternoon,

I'm using arm_now to debug a MIPS binary. I was able to download the challenge binary but cannot run it. I ran chmod +x on the file. I get the following.

ls
ch27.bin    wget-log    wget-log.2  wget-log.4  wget-log.6
index.html  wget-log.1  wget-log.3  wget-log.5  wget-log.7
# ./ch27.bin 
-sh: ./ch27.bin: not found
#

aarch64 dns resolution not working

So far, i've had success with a few of the other images in resolving dns, but aarch64 dns resolution appears to be broken.

arm_now start aarch64
# nslookup google.com
Server:    10.0.2.3
Address 1: 10.0.2.3

nslookup: can't resolve 'google.com'

aarch64 (arm64) package installation support

Hello, you can use the following line to add support for arm64 packages:
"aarch64": "wget -O - http://bin.entware.net/aarch64-k3.10/installer/generic.sh | /bin/sh"

Thanks for this very useful project!

insecurely downloading shell scripts

install_opkg = {
        "armv5-eabi":"""wget -O - http://pkg.entware.net/binaries/armv5/installer/entware_install.sh | /bin/sh""",
        "armv7-eabihf":"""wget -O - http://pkg.entware.net/binaries/armv5/installer/entware_install.sh | /bin/sh""",
        "mips32el":"""wget -O - http://pkg.entware.net/binaries/mipsel/installer/installer.sh | /bin/sh""",
        "x86-64-core-i7":"""wget -O - http://pkg.entware.net/binaries/x86-64/installer/entware_install.sh | /bin/sh""",
        "x86-core2":"""wget -O - http://pkg.entware.net/binaries/x86-32/installer/entware_install.sh | /bin/sh""",
        "x86-i686":"""wget -O - http://pkg.entware.net/binaries/x86-32/installer/entware_install.sh | /bin/sh""",
}

Resizing filesystem with --correct option fails

I attempted to resize the filesystem with the arm_now resize +1G --correct command. It successfully resized the partition, but failed when trying to correct the filesystem with the following error:

resize2fs 1.44.1 (24-Mar-2018)
Resizing the filesystem on arm_now/rootfs.ext2 to 1150976 (1k) blocks.
The filesystem on arm_now/rootfs.ext2 is now 1150976 (1k) blocks long.

-rw-r--r-- 1 username users 1.1G Feb 18 20:21 arm_now/rootfs.ext2
[+] Resized to +1G
Traceback (most recent call last):
  File "/usr/local/bin/arm_now", line 11, in <module>
    load_entry_point('arm-now==1.26', 'console_scripts', 'arm_now')()
  File "/usr/local/lib/python3.6/dist-packages/arm_now/arm_now.py", line 88, in main
    do_resize(a["<new_size>"], a["--correct"])
  File "/usr/local/lib/python3.6/dist-packages/arm_now/arm_now.py", line 281, in do_resize
    fs.correct()
  File "/usr/lib/python3.6/contextlib.py", line 52, in inner
    return func(*args, **kwds)
  File "/usr/local/lib/python3.6/dist-packages/arm_now/filesystem.py", line 73, in correct
    porange("[+] Correcting ... (be patient)".format(size=size))
NameError: name 'size' is not defined

This seems to be because of an unnecessary variable .format(size=size) when the program is printing the status message.

I think this would be fixed either by #12 , or by removing .format(size=size) from the status message in the filesystem correct() function.

arm_now/arm_now/filesystem.py

Line 73 in e631a88

porange("[+] Correcting ... (be patient)".format(size=size))

Vagrant and Packer plugins!

Hi, thank you for releasing this helpful tool for managing emulators, for a wide variety of architectures! Could we get Vagrant and Packer plugins for arm_now, in order to bundle and ship reusable emulation machines?

mips64-n32 failed to start

Attempting to use mips64-n32, i get the following:

arm_now start mips64-n32
(use --clean next time) An aarch64 image exists, delete ? (y/n) y

Downloading /root/.config/arm_now/templates/mips64-n32.tar.xz from https://github.com/nongiach/arm_now_templates/raw/master/mips64-n32.tar.xz                                                                                                                                                                                  [*] 1.4 MB / 1.4 MB @ 3.0 MB/s [##################] [100%, 0s left]
[+] Installed
Tempdir /tmp/tmpuk8185gs
File not found by ext2_lookup
WARNING: e2rm file already suppressed
Starting qemu-system-mips64
stty intr ^]
       export QEMU_AUDIO_DRV="none"
       qemu-system-mips64 -kernel arm_now/kernel -hda arm_now/rootfs.ext2 -append 'root=/dev/hda console=ttyS0 rw physmap.enabled=0 noapic'                -m 256M                -nographic                -serial stdio -monitor /dev/null                                  -no-reboot
       stty intr ^c

WARNING: Image format was not specified for 'arm_now/rootfs.ext2' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
qemu-system-mips64: qemu: could not load kernel 'arm_now/kernel': Failed to load ELF
+++++++++++++++++++++++++++ Checking the filesystem ++++++++++++++++++++++++++++
e2fsck 1.44.1 (24-Mar-2018)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

         397 inodes used (1.59%, out of 24960)
           0 non-contiguous files (0.0%)
           1 non-contiguous directory (0.3%)
             # of inodes with ind/dind/tind blocks: 19/4/0
        9061 blocks used (8.85%, out of 102400)
           0 bad blocks
           0 large files

          60 regular files
          41 directories
           1 character device file
           0 block device files
           0 fifos
           0 links
         286 symbolic links (286 fast symbolic links)
           0 sockets
------------
         388 files

[note to myself] use clang to crosscompile

Test and update the wiki: https://github.com/nongiach/arm_now/wiki/5.3-Compile-and-play-2048-on-ARM,-MIPS-and-PowerPc64-within-a-minute
clang -target
https://clang.llvm.org/docs/CrossCompilation.html

[FR] - Adding the logging module would be great :)

I'll will pull request this feature soon 😄

It is important to have a generic way to log things thanks to the python logging module.

add a snapshot feature

Add a snapshot feature
arm_now snapshot -h
snapshot create [NAME]: create snapshot of the current VM
snapshot list: list all available snapshot
snapshot use [NAME]: overwrite the current VM with the snapshot [NAME]

use case

$ arm_now start x86-i686
# do some config
# poweroff
$ arm_now snapshot create MyBestVM
$ arm_now snapshot list
MyBestVM: maybe add a description here
$ arm_now start
# run some malwares or not trustworthy things
# poweroff
$ arm_now snapshot use MyBestVM
$ arm_now start
# Just go back in time

Add supported OS'es to README

Please add what OS's are supported to your README.
Windows?
Seem like an awesome project! :)

Why are these errors reported? FileNotFoundError: [Errno 2] No such file or directory: 'e2rm': 'e2rm'

Hellow @nongiach
I encountered some errors when I created the virtual machine using arm_now. Can you help me to fix this error? "FileNotFoundError: [Errno 2] No such file or directory: 'e2rm': 'e2rm'"
And here are traceback log ：
Traceback (most recent call last):
File "/usr/local/bin/arm_now", line 11, in
load_entry_point('arm-now==1.1', 'console_scripts', 'arm_now')()
File "/usr/local/lib/python3.6/dist-packages/arm_now-1.1-py3.6.egg/arm_now/arm_now.py", line 399, in main
File "/usr/local/lib/python3.6/dist-packages/sigtools/modifiers.py", line 158, in call
return self.func(*args, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/clize/runner.py", line 360, in run
ret = cli(*args)
File "/usr/local/lib/python3.6/dist-packages/clize/runner.py", line 220, in call
return func(*posargs, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/clize/runner.py", line 262, in _cli
return func('{0} {1}'.format(name, command), *args)
File "/usr/local/lib/python3.6/dist-packages/clize/runner.py", line 220, in call
return func(*posargs, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/arm_now-1.1-py3.6.egg/arm_now/arm_now.py", line 354, in start
File "/usr/local/lib/python3.6/dist-packages/arm_now-1.1-py3.6.egg/arm_now/arm_now.py", line 239, in config_filesystem
File "/usr/local/lib/python3.6/dist-packages/arm_now-1.1-py3.6.egg/arm_now/arm_now.py", line 231, in ext2_rm
File "/usr/lib/python3.6/subprocess.py", line 286, in check_call
retcode = call(*popenargs, **kwargs)
File "/usr/lib/python3.6/subprocess.py", line 267, in call
with Popen(*popenargs, **kwargs) as p:
File "/usr/lib/python3.6/subprocess.py", line 709, in init
restore_signals, start_new_session)
File "/usr/lib/python3.6/subprocess.py", line 1344, in _execute_child
raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'e2rm': 'e2rm'

I'm sure I installed all the dependencies, but I still can't create the arm virtual machine.
Can you help me?
Thank you
Please

option offline

https://pastebin.com/2naVcTJW

update Entware mipsel

Entware-ng and Entware-3x = Entware
https://github.com/Entware/Entware

arm_now resize 2G
arm_now start mips32el

install
wget -O - http://bin.entware.net/mipselsf-k3.4/installer/generic.sh | /bin/sh
and ...
bug fix
busybox --install -s /bin
or

rm -f /opt/bin/wget
ln -s /bin/busybox /opt/bin/wget

opkg install gcc
Installing gcc (6.3.0-1b) to root...
Downloading http://bin.entware.net/mipselsf-k3.4/gcc_6.3.0-1b_mipsel-3.4.ipk

https://github.com/Entware/Entware/wiki/Using-GCC-for-native-compilation

wget -qO- http://bin.entware.net/mipselsf-k3.4/include/include.tar.gz | tar xvz -C /opt/include

install local
http://bin.entware.net/mipselsf-k3.4

wget http://bin.entware.net/mipselsf-k3.4/gcc_6.3.0-1b_mipsel-3.4.ipk
opkg install http://.../name.ipk

mips32 opkg missing?

Looks like opkg is missing from the mips32 image:

arm_now start mips32
# opkg
-sh: opkg: not found

Compiling Go package on MIPS32EL for openwrt

Hi! I've got a question and hope someone from the community can help me.

Question is quite general. I need to compile google cloud-print-conntector; which is written in Go language; for the Lantiq XRX200 CPU; which is probably what MIPS32EL is also. This all stuff have to work in the future on the Lantiq device with OpenWRT firmware (so I will have also to create a package for it). In general, do you think, is it possible to do that?

Thanks for help!

Error on Macos with the --redir option

With the --redir option it crashes instantly

Augmenter la taille du system

pour info quand tu resize faut balancer ça dans la qemu pour resize le system : "opkg install resize2fs;resize2fs /dev/mmcblk0 &> /dev/null"

Using arm_now for QEMU development for Onion Omega2

I am attempting to setup Onion Omega2 Developments stack without the real hardware using arm_now. Mostly for Python scripts with stubs for hardware stuff.

However bringing up mips32el is stalling with this :

File not found by ext2_lookup
WARNING: e2rm file already suppressed
File not found by ext2_lookup
WARNING: e2rm file already suppressed
Tempdir /tmp/tmpolljr1r0
Starting qemu-system-mipsel
stty intr ^]
       export QEMU_AUDIO_DRV="none"
       qemu-system-mipsel -kernel arm_now/kernel -hda arm_now/rootfs.ext2 -append 'root=/dev/hda console=ttyS0 rw physmap.enabled=0 noapic'                -m 256M                -nographic                -serial stdio -monitor null  -nic user                                 -no-reboot
       stty intr ^c
    
qemu-system-mipsel: -nic: invalid option

Will work on checking the architecture and options for opkg support for this board since images are available with links to Onion opkg repo here.

No gcc and g++ in the disk

hello, i like this, but there no gnu compiler collection commands in any disk.
why want gcc?
because if you have not a command to use you to compile but there no gcc and g++ here, and compile in host as arm hmmm, I'm having a hard time

Thank You To Include Gcc ANd G++

Missing gdb, gdbserver and empty /opt on mips32

Hi,
I'm trying to use arm_now on mips32. But I have a problem:
There is no gdb or gdbserver there, contrary to mips32el for example.
In fact, the whole /opt directory is empty.
Would there be a way to fix that so that arm_now really rocks even more than it does already ?
Thx!

Note to myself

Create a script to test that all arch boot, merging pull requests is scary this days ^^

Feature request: Include gdb (with python support)

>Scripting in the "Python" language is not supported in this copy of GDB.

Would be great if gdb were compiled with python. Now sure how involved this would be.

How can I get a bridged network interface?

I'm using armnow in a Kali Linux Virtualbox VM which is itself in bridged network interface mode.
It works great (internet works in the Kali and doesn't seem to work in the arm VM but I don't need it so that's ok), but I'd like to have a way to have access to a TCP port of the ARM virtual machine from the outside, preferably from my whole LAN if possible.

How could I do that?

Also, with :
arm_now start --redir tcp:1234::12345
I get :
qemu-system-arm: -redir: invalid option
And I don't know how to fix this.

Thanks :)

Add python dependencies to README

Please add info on what dependencies are required both by pip packages and python versions etc.
What about OS?

aarch64 doesn't work

[root@gpwn:~/code/gef]$ arm_now start aarch64

Downloading /root/.config/arm_now/templates/aarch64.tar.xz from https://github.com/nongiach/arm_now_templates/raw/master/aarch64.tar.xz
 [*] 3.4 MB / 3.4 MB @ 2.8 MB/s [##################] [100%, 0s left]
[+] Installed
Tempdir /tmp/tmpuva7od7f
File not found by ext2_lookup
WARNING: e2rm file already suppressed
Starting qemu-system-aarch64
stty intr ^]
       export QEMU_AUDIO_DRV="none"
       qemu-system-aarch64 -M virt -cpu cortex-a57 -smp 1 -kernel arm_now/kernel -append 'root=/dev/vda console=ttyAMA0' -netdev user,id=eth0 -device virtio-net-device,netdev=eth0 -drive file=arm_now/rootfs.ext2,if=none,format=raw,id=hd0 -device virtio-blk-device,drive=hd0                -m 256M                -nographic                -serial stdio -monitor /dev/null                                  -no-reboot
       stty intr ^c

Hangs like this, taking 100% cpu

You can repro:

docker run --rm -it --privileged grazfather/pwndock arm_now start aarch64

PEP8 Linting

It would be great if the code was pep8 compliant, I am already working on that on a PR :)

@nongiach try to use a pep8 linter in your python DI 😄

`--real-source` option not working because of the change of toolchains.bootlin.com

As we can see there's no such path "test-system" directory under https://toolchains.bootlin.com/downloads/releases/toolchains/{arch}/, such as https://toolchains.bootlin.com/downloads/releases/toolchains/mips32/test-system is 404,

arm_now/arm_now/download.py

Line 39 in 7251c24

url = "https://toolchains.bootlin.com/downloads/releases/toolchains/{arch}/test-system/".format(arch=arch)

so arm_now install with --real-source will always fail with "ERROR: couldn't download files for this arch"

I browsed the whole directory and not even found any files like rootfs.ext2 or vmlinux, a major update may be needed. (sorry for the Inappropriate title before)