Can't execute any MIPS binary
Hi,
I have a machine, an AR7 MIPS router I want to hack, but I'm unable to run _any_ executable on that machine outside the ones in the firmware. I tried building a static mips1 binary, but it fails so:
# /var/test.bin
/var/test.bin: 1: Syntax error: "(" unexpectedso I downloaded a binary builtin in the firmware and I compared it to my own:
$ file busybox.bin test.bin busybox.bin: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), stripped test.bin: ELF 32-bit LSB executable, MIPS, version 1 (SYSV), statically linked, stripped
busybox.bin is the builtin busybox while test.bin is a static HelloWorld
I ran readelf on it:
$ readelf -h busybox.bin ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 Entry point address: 0x4037e0 Start of program headers: 52 (bytes into file) Start of section headers: 337304 (bytes into file) Flags: 0x5, noreorder, cpic, mips1 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 6 Size of section headers: 40 (bytes) Number of section headers: 21 Section header string table index: 20 $ readelf -h test.bin ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 Entry point address: 0x400140 Start of program headers: 52 (bytes into file) Start of section headers: 11780 (bytes into file) Flags: 0x50001007, noreorder, pic, cpic, o32, mips32 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 3 Size of section headers: 40 (bytes) Number of section headers: 17 Section header string table index: 16 $ diff -u <(readelf -h busybox.bin) <(readelf -h test.bin) --- /dev/fd/63 2008-02-13 00:26:48.880261477 +0100 +++ /dev/fd/62 2008-02-13 00:26:48.880261477 +0100 @@ -8,13 +8,13 @@ Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 - Entry point address: 0x4037e0 + Entry point address: 0x400140 Start of program headers: 52 (bytes into file) - Start of section headers: 337304 (bytes into file) - Flags: 0x5, noreorder, cpic, mips1 + Start of section headers: 11780 (bytes into file) + Flags: 0x50001007, noreorder, pic, cpic, o32, mips32 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) - Number of program headers: 6 + Number of program headers: 3 Size of section headers: 40 (bytes) - Number of section headers: 21 - Section header string table index: 20 + Number of section headers: 17 + Section header string table index: 16
The router firmware uses:
# cat /proc/version Linux version 2.4.17_mvl21-malta-mips_fp_le ([email protected]) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Fri Mar 18 11:00:12 EST 2005
While I have a gcc-4.2.3 toolchain with 2.6.24 headers.
How can I build a mips1 binary instead of the mips32 I make? Can I disable o32?
Best Regards,
Matteo Croce
A message that is not in the archive (sent off-list or not yet received): [email protected]
Il Wednesday 13 February 2008 00:39:59 Edin Hodzic ha scritto:
Quoted 96 lines
-march=mips1 or -mips1 should do the trick, no?
Dino
Quoted 91 lines · Matteo Croce
Hi,
I have a machine, an AR7 MIPS router I want to hack, but I'm unable to run _any_ executable on that machine outside the ones in the firmware. I tried building a static mips1 binary, but it fails so:# /var/test.bin /var/test.bin: 1: Syntax error: "(" unexpectedso I downloaded a binary builtin in the firmware and I compared it to my own:
$ file busybox.bin test.bin busybox.bin: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), stripped test.bin: ELF 32-bit LSB executable, MIPS, version 1 (SYSV), statically linked, strippedbusybox.bin is the builtin busybox while test.bin is a static HelloWorld
I ran readelf on it:
$ readelf -h busybox.bin ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 Entry point address: 0x4037e0 Start of program headers: 52 (bytes into file) Start of section headers: 337304 (bytes into file) Flags: 0x5, noreorder, cpic, mips1 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 6 Size of section headers: 40 (bytes) Number of section headers: 21 Section header string table index: 20 $ readelf -h test.bin ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 Entry point address: 0x400140 Start of program headers: 52 (bytes into file) Start of section headers: 11780 (bytes into file) Flags: 0x50001007, noreorder, pic, cpic, o32, mips32 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 3 Size of section headers: 40 (bytes) Number of section headers: 17 Section header string table index: 16 $ diff -u <(readelf -h busybox.bin) <(readelf -h test.bin)dev/fd/62 2008-02-13 00:26:48.880261477 +0100 renamed from dev/fd/63 2008-02-13 00:26:48.880261477 +0100 +6
-6@@ -8,13 +8,13 @@ Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 - Entry point address: 0x4037e0 + Entry point address: 0x400140 Start of program headers: 52 (bytes into file) - Start of section headers: 337304 (bytes into file) - Flags: 0x5, noreorder, cpic, mips1 + Start of section headers: 11780 (bytes into file) + Flags: 0x50001007, noreorder, pic, cpic, o32, mips32 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) - Number of program headers: 6 + Number of program headers: 3 Size of section headers: 40 (bytes) - Number of section headers: 21 - Section header string table index: 20 + Number of section headers: 17 + Section header string table index: 16The router firmware uses:
# cat /proc/version Linux version 2.4.17_mvl21-malta-mips_fp_le ([email protected]) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Fri Mar 18 11:00:12 EST 2005While I have a gcc-4.2.3 toolchain with 2.6.24 headers.
Quoted 7 lines
Quoted 6 lines
How can I build a mips1 binary instead of the mips32 I make? Can I disable o32?
Best Regards,
Matteo Croce
Already tried, won't work.
I attach the binaries
Quoted 84 lines · Matteo Croce
Hi,
I have a machine, an AR7 MIPS router I want to hack, but I'm unable to run _any_ executable on that machine outside the ones in the firmware. I tried building a static mips1 binary, but it fails so:# /var/test.bin /var/test.bin: 1: Syntax error: "(" unexpectedso I downloaded a binary builtin in the firmware and I compared it to my own:
$ file busybox.bin test.bin busybox.bin: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), stripped test.bin: ELF 32-bit LSB executable, MIPS, version 1 (SYSV), statically linked, strippedbusybox.bin is the builtin busybox while test.bin is a static HelloWorld
I ran readelf on it:
$ readelf -h busybox.bin ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 Entry point address: 0x4037e0 Start of program headers: 52 (bytes into file) Start of section headers: 337304 (bytes into file) Flags: 0x5, noreorder, cpic, mips1 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 6 Size of section headers: 40 (bytes) Number of section headers: 21 Section header string table index: 20 $ readelf -h test.bin ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 Entry point address: 0x400140 Start of program headers: 52 (bytes into file) Start of section headers: 11780 (bytes into file) Flags: 0x50001007, noreorder, pic, cpic, o32, mips32 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 3 Size of section headers: 40 (bytes) Number of section headers: 17 Section header string table index: 16 $ diff -u <(readelf -h busybox.bin) <(readelf -h test.bin)dev/fd/62 2008-02-13 00:26:48.880261477 +0100 renamed from dev/fd/63 2008-02-13 00:26:48.880261477 +0100 +6
-6@@ -8,13 +8,13 @@ Type: EXEC (Executable file) Machine: MIPS R3000 Version: 0x1 - Entry point address: 0x4037e0 + Entry point address: 0x400140 Start of program headers: 52 (bytes into file) - Start of section headers: 337304 (bytes into file) - Flags: 0x5, noreorder, cpic, mips1 + Start of section headers: 11780 (bytes into file) + Flags: 0x50001007, noreorder, pic, cpic, o32, mips32 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) - Number of program headers: 6 + Number of program headers: 3 Size of section headers: 40 (bytes) - Number of section headers: 21 - Section header string table index: 20 + Number of section headers: 17 + Section header string table index: 16
Quoted 4 lines
The router firmware uses:
# cat /proc/version Linux version 2.4.17_mvl21-malta-mips_fp_le ([email protected]) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Fri Mar 18 11:00:12 EST 2005
IIRC, the definitions of the elf flags were wrong in 2.4.x (x < 20 or 25 or something like that). I had similar problems.
You should be able to run the binary if run a binary editor on it and clear the mips32 flag (i.e. change the flags from 0x50001007 to just 0x1007).
If you want to generate the program with out the mips32 flag in the first place you have to compile everything (libc, libgcc crt*.o, program ) with -mips1
It may be easier to run a program that post processes the executable to clear the flag.
David Daney
Il Wednesday 13 February 2008 00:54:21 hai scritto:
Quoted 3 lines
You should be able to run the binary if run a binary editor on it and clear the mips32 flag (i.e. change the flags from
0x50001007to just0x1007).
Solved by changing flags from 0x50001007 to 0x5, thanks :)
Quoted 4 lines · Matteo Croce
Il Wednesday 13 February 2008 00:54:21 hai scritto:
Quoted 1 line
You should be able to run the binary if run a binary editor on it and clear the mips32 flag (i.e. change the flags from
0x50001007to just0x1007).Solved by changing flags from
0x50001007to0x5, thanks :)
I think that you only want to clear the mips32 part (that is the part keeping the elf exec from working). I would leave all the other bits as they were.
In other words, probably the flags should be 0x1007, instead of 0x5.
Although it may not really matter. It has been several years since I studied the code.
David Daney
Hi
Quoted 7 lines · Matteo Croce
Hi,
I have a machine, an AR7 MIPS router I want to hack, but I'm unable to run _any_ executable on that machine outside the ones in the firmware. I tried building a static mips1 binary, but it fails so:# /var/test.bin /var/test.bin: 1: Syntax error: "(" unexpected
I had the exact same problem.
As far as I remember I had to make sure to build uclibc for MIPS-I, because if I built a MIPS-I object file and linked it to a uclibc that was not built for MIPS-I, it would give those errors.
I have just found my change to the OpenWrt wiki (on the WRTP54G page):
http://wiki.openwrt.org/OpenWrtDocs/Hardware/Linksys/WRTP54G?action=diff&rev2=171&rev1=170
Signature · 1 line
Michael Wood <[email protected]>