0

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based architecture.

File general information is extracted below from tools file and readelf. It looks that the file is compiled for ARM architecture: ARMV5TE and ARM core: arm1022e.

c444: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, stripped

Architecture specific information

kali@kali:~/Downloads/samolan$ readelf -A c444 
Attribute Section: aeabi
File Attributes
  Tag_CPU_name: "arm1022e"
  Tag_CPU_arch: v5TE
  Tag_ARM_ISA_use: Yes
  Tag_THUMB_ISA_use: Thumb-1
  Tag_FP_arch: VFPv2
  Tag_ABI_PCS_GOT_use: GOT-indirect
  Tag_ABI_PCS_wchar_t: 4
  Tag_ABI_FP_denormal: Needed
  Tag_ABI_FP_exceptions: Needed
  Tag_ABI_FP_number_model: IEEE 754
  Tag_ABI_align_needed: 8-byte
  Tag_ABI_enum_size: int
  Tag_ABI_optimization_goals: Aggressive Speed
  Tag_ABI_FP_16bit_format: IEEE 754

Headers

ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              DYN (Shared object file)
  Machine:                           ARM
  Version:                           0x1
  Entry point address:               0x470
  Start of program headers:          52 (bytes into file)
  Start of section headers:          4480 (bytes into file)
  Flags:                             0x5000200, Version5 EABI, soft-float ABI
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         8
  Size of section headers:           40 (bytes)
  Number of section headers:         24
  Section header string table index: 23


From Wiki I can see that there are many different variations of ARM architectures and one of them is ARMV5TE. I found that QEMU can emulate different AMR architectures. Hence I have tried to create a virtual ARM machine following this tutorial (tutorial).

Basically, I downloaded 3 files from here and run the command in the directory with downloaded files.

qemu-system-arm -M versatilepb -kernel vmlinuz-2.6.32-5-versatile -initrd initrd.img-2.6.32-5-versatile -hda debian_squeeze_armel_standard.qcow2 -append "root=/dev/sda1" -redir tcp:2222::22

In the created virtual machine I have run uname -a and got information that architecture can be something write (armv5tejl):

root@debian-armel:~# uname -a
Linux debian-armel 2.6.32-5-versatile #1 Wed Sep 25 00:01:55 UTC 2013 armv5tejl GNU/Linux

When VM started I connected to it with ssh and copied c444 file to the machine, changed the permissions chmod 777 ./c444, and run the command ./c444 but got an error.

root@debian-armel:/home/user# ./c444 
-bash: ./c444: No such file or directory

The questions

  • The question is am I creating the correct environment to run this file?
  • What could be a reason to get the error -bash: ./c444: No such file or directory.
  • Maybe you could point to the direction of what images, kernels, etc. are necessary to build a system where I could run this file.
  • Does somebody know what is the difference between QEMU machines and architecture?
1
  • I don't think this has anything to do with reverse engineering, just running a virtual machine
    – phuclv
    Commented Jun 3, 2022 at 0:49

1 Answer 1

3

“No such file or directory” is often printed by the shell when the dynamic interpreter of the executable is not found. You can find out which one it expects by using readelf-l.

Not the answer you're looking for? Browse other questions tagged or ask your own question.