groldo

#!/bin/bash

sudo apt install qemu

wget https://cloud-images.ubuntu.com/releases/jammy/release/unpacked/ubuntu-22.04-server-cloudimg-amd64-vmlinuz-generic
wget https://cloud-images.ubuntu.com/releases/jammy/release/unpacked/ubuntu-22.04-server-cloudimg-amd64-initrd-generic
wget https://cloud-images.ubuntu.com/releases/jammy/release/ubuntu-22.04-server-cloudimg-amd64-disk-kvm.img

qemu-img create -f qcow2 -F qcow2 -b `pwd`/ubuntu-22.04-server-cloudimg-amd64-disk-kvm.img test.img 8G

mikaelhg

Running Ubuntu 21.04 on QEMU MicroVM

I mean, in this era of containers, it's not like you'd need this very often, but if you do, you do.

1. Download the required image files

https://cloud-images.ubuntu.com/releases/hirsute/release/unpacked/ubuntu-21.04-server-cloudimg-amd64-vmlinuz-generic https://cloud-images.ubuntu.com/releases/hirsute/release/unpacked/ubuntu-21.04-server-cloudimg-amd64-initrd-generic https://cloud-images.ubuntu.com/releases/hirsute/release/ubuntu-21.04-server-cloudimg-amd64-disk-kvm.img

nstarke

Reversing Raw Binary Firmware Files in Ghidra

This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.

Prep work in Binwalk

I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.

While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.

Omar-Ikram

//
//  main.m
//  EndpointSecurityDemo
//
//  Created by Omar Ikram on 17/06/2019 - macOS Catalina 10.15 Beta 1 (19A471t)
//  Updated by Omar Ikram on 15/08/2019 - macOS Catalina 10.15 Beta 5 (19A526h)
//  Updated by Omar Ikram on 01/12/2019 - macOS Catalina 10.15 (19A583)
//  Updated by Omar Ikram on 31/01/2021 - macOS Big Sur 11.1 (20C69)
//  Updated by Omar Ikram on 07/05/2021 - macOS Big Sur 11.3.1 (20E241)
//  Updated by Omar Ikram on 04/07/2021 - macOS Monterey 12 Beta 2 (21A5268h)

mrk-han

Install and Create Emulators using AVDMANAGER and SDKMANAGER

TL;DR

For an emulator that mimics a Pixel 5 Device with Google APIs and ARM architecture (for an M1/M2 Macbook):

1. List All System Images Available for Download: sdkmanager --list | grep system-images

2. Download Image: sdkmanager --install "system-images;android-30;google_atd;arm64-v8a"

extremecoders-re

Environment

The steps shown below are done on a Ubuntu VM using Qemu 3.0

$ qemu-system-arm -version
QEMU emulator version 3.0.0
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

To quit Qemu at any time press Ctrl+a x, i.e. Ctrl+a and then x

extremecoders-re

Setting up Qemu with a tap interface

There are two parts to networking within QEMU:

• The virtual network device that is provided to the guest (e.g. a PCI network card).
• The network backend that interacts with the emulated NIC (e.g. puts packets onto the host's network).

Example: User mode network

josephg

#include <sys/socket.h>
#include <sys/un.h>
#include <sys/event.h>
#include <netdb.h>
#include <assert.h>
#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>
#include <errno.h>

joswr1ght

# Get decrypted kernelcache
# URL for iOS 10 Beta 1 for iPhone 6s taken from http://pastebin.com/FRMfanmT
wget -q http://apple.co/28R9rhS -O ios10beta1-iphone6s.zip
mkdir ios10beta1
unzip -q ios10beta1-iphone6s.zip -d ios10beta1
cd ios10beta1
wget -q http://nah6.com/%7Eitsme/cvs-xdadevtools/iphone/tools/lzssdec.cpp
g++ -o lzssdec lzssdec.cpp
./lzssdec -o 439 < AssetData/boot/kernelcache.release.n71 >kernelcache.decrypted # 439 is offset byte count to 0xFFCFFAEDFE header
xxd kernelcache.decrypted | head -1

yrp604

XNU syscall path

Chart

             +------------------+
             |These push their  |                                  +-----------------------+
             |respective syscall|                                  |This overwrites the    |
             |dispatch functions|                                  |saved dispatch function|
             |onto the stack    |                                  |with hndl_alltraps     |