无法在 qemu 中运行 MIPS 二进制文件

如何解决无法在 qemu 中运行 MIPS 二进制文件

我正在尝试在 qemu 中的完整系统仿真上运行 MIPS 二进制文件，以搜索路由器固件中的漏洞。 我正在使用以下命令启动 qemu：qemu-system-mips -M malta -m 256 -hda hda.img -kernel vmlinux-4.19.0-14-4kc-malta -initrd initrd.img-4.19.0-14-4kc-malta -append "root=/dev/sda1 console=ttyS0 nokaslr" -nographic -netdev user,id=net0 -device e1000-82545em,netdev=net0,id=net0,mac=52:54:00:c9:18:27 -net user -redir tcp:2222::22 -net nic

机器启动，我确实获得了网络连接，并且能够安装 gdb、binwalk 等。

当我尝试运行二进制文件时出现问题，例如 ./busybox，我得到输出 -bash: ./busybox: No such file or directory 。

但是当我运行 strace busyboox 时，我得到：

execve("/usr/bin/busybox",["busybox"],0x7f7ffa70 /* 20 vars */) = 0
brk(NULL)                               = 0x55aae000
mmap2(NULL,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x77f07000
access("/etc/ld.so.preload",R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD,"/etc/ld.so.cache",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3,{st_mode=S_IFREG|0644,st_size=24625,...}) = 0
mmap2(NULL,24625,PROT_READ,MAP_PRIVATE,3,0) = 0x77f00000
close(3)                                = 0
openat(AT_FDCWD,"/lib/mips-linux-gnu/libresolv.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3,"\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\10\0\0\0\1\0\0%\320\0\0\0004"...,512) = 512
prctl(PR_GET_FP_MODE)                   = 0
_llseek(3,724,[724],SEEK_SET)        = 0
read(3,"\0\0\0\4\0\0\0\20\0\0\0\1GNU\0\0\0\0\0\0\0\0\3\0\0\0\2\0\0\0\0",32) = 32
fstat64(3,st_size=83944,153808,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_DENYWRITE,0) = 0x77eb0000
mprotect(0x77ec3000,61440,PROT_NONE)  = 0
mmap2(0x77ed2000,MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE,0x12000) = 
0x77ed2000
mmap2(0x77ed4000,6352,MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS,0) = 
0x77ed4000
close(3)                                = 0
openat(AT_FDCWD,"/lib/mips-linux-gnu/libc.so.6","\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\10\0\0\0\1\0\1\244d\0\0\0004"...,520,[520],"\0\0\0\4\0\0\0\24\0\0\0\3GNU\0\30\335\354\235\fM\241r\346\26\317\341R\305\363\23"...,36) = 
36
_llseek(3,828,[828],{st_mode=S_IFREG|0755,st_size=1668292,1642000,0) = 0x77d1f000
mprotect(0x77e98000,PROT_NONE)  = 0
mmap2(0x77ea7000,28672,0x178000) = 
0x77ea7000
mmap2(0x77eae000,7696,0) = 
0x77eae000
close(3)                                = 0
mmap2(NULL,0) = 0x77efe000
set_thread_area(0x77f054a0)             = 0
mprotect(0x77ea7000,16384,PROT_READ)  = 0
mprotect(0x77ed2000,4096,PROT_READ)   = 0
mprotect(0x55728000,PROT_READ)   = 0
mprotect(0x77f09000,PROT_READ)   = 0
munmap(0x77f00000,24625)               = 0
getuid()                                = 0
ioctl(2,TIOCGWINSZ,0x7f9faddc)        = 0
dup2(1,2)                              = 2
write(2,"BusyBox v1.30.1 (Debian 1:1.30.1"...,35BusyBox v1.30.1 (Debian 1:1.30.1-4)) = 35
write(2," multi-call binary.\n",20 multi-call binary.
)   = 20
write(2,"BusyBox is copyrighted by many a"...,568BusyBox is copyrighted by many authors between 
1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --show SCRIPT
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable.  Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
) = 568
write(2,"\t",1    )                       = 1
write(2,"[",1[)                        = 1
write(2,",2,)                       = 2
write(2,"[[",2[[)                       = 2
write(2,"acpid",5acpid)                    = 5
write(2,"adjtimex",8adjtimex)                 = 8
write(2,"ar",2ar)                       = 2
write(2,"arch",4arch)                     = 4
write(2,"arp",3arp)                      = 3
...
...
exit_group(0)                           = ?
+++ exited with 0 +++

看起来 strace 给出了想要的输出，但我无法弄清楚正常执行时的问题是什么。感谢您的帮助