firmware-analysis-toolkit icon indicating copy to clipboard operation
firmware-analysis-toolkit copied to clipboard

Attempts to use loopback network address (127.0.0.0) instead of a valid interface?

Open djmccarthy12 opened this issue 5 years ago • 5 comments

Not sure what would be causing this, everything appears to be working correctly aside from the fact that it tries to spin up the connection on 127.0.0.0 (see the output below) rather than on one of the two other available interfaces.

[+] Firmware: R6950.bin [+] Extracting the firmware... [+] Image ID: 2 [+] Identifying architecture... [+] Architecture: mipsel [+] Building QEMU disk image... [+] Setting up the network connection, please standby... [+] Network interfaces: [('lo', '127.0.0.0')] [+] All set! Press ENTER to run the firmware... [+] When running, press Ctrl + A X to terminate qemu

djmccarthy12 avatar Mar 31 '20 23:03 djmccarthy12

Maybe a bug in Firmadyne particularly in the script scripts/makeNetwork.py

Firmadyne identifies the network interface by parsing the kernel bootlog which you can find in the file qemu.initial.serial.log.

In the file you will find lines of the following type.

[    2.508000] firmadyne: __inet_insert_ifa[PID: 49 (ifconfig)]: device:lo ifa:0x0100007f
--- [ snip] ---
[    4.300000] firmadyne: __inet_insert_ifa[PID: 193 (ifconfig)]: device:br0 ifa:0x0101a8c0

In this example , 0x0100007f is 127.0.0.1 little endian byte order and interface name is lo. Firmadyne doesn't create the interface if it's address is 127.0.0.1 or 0.0.0.0.

0x0101a8c0 is 192.168.1.1 and the interface name is br0. Firmadyne will create this interface.

Likewise, you can go through the file and find all those lines containing the word __inet_insert_ifa.

extremecoders-re avatar Apr 02 '20 06:04 extremecoders-re

Corresponding code in makeNetwork.py

# Get the netwokr interfaces in the router, except 127.0.0.1
def findNonLoInterfaces(data, endianness):
    #lines = data.split("\r\n")
    lines = stripTimestamps(data)
    candidates = filter(lambda l: l.startswith("__inet_insert_ifa"), lines) # logs for the inconfig process
    if debug:
        print("Candidate ifaces: %r" % candidates)
    result = []
    if endianness == "eb":
        fmt = ">I"
    elif endianness == "el":
        fmt = "<I"
    for c in candidates:
        g = re.match(r"^__inet_insert_ifa\[[^\]]+\]: device:([^ ]+) ifa:0x([0-9a-f]+)", c)
        if g:
            (iface, addr) = g.groups()
            addr = socket.inet_ntoa(struct.pack(fmt, int(addr, 16)))
            if addr != "127.0.0.1" and addr != "0.0.0.0":
                result.append((iface, addr))
    return result

extremecoders-re avatar Apr 02 '20 06:04 extremecoders-re

Hey there - Apologies for the delay in getting back here - life got in the way. I reinstalled FAT and tried this again, having the same issue. I went through the log and found only two lines that matched the above:

[ 6.160000] firmadyne: __inet_insert_ifa[PID: 198 (ifconfig)]: device:lo ifa:0x0000007f [ 6.160000] firmadyne: __inet_insert_ifa[PID: 198 (ifconfig)]: device:lo ifa:0x0100007f

Seems like its unable to find an interfact other than lo. Here is my ifconfig output:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:5f:52:61 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp0s3
       valid_lft 79852sec preferred_lft 79852sec
    inet6 fe80::f2d7:f469:27ec:4c2e/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:82:26:90 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.4/24 brd 192.168.1.255 scope global dynamic noprefixroute enp0s8
       valid_lft 79853sec preferred_lft 79853sec
    inet6 fe80::7fe8:32c1:4f6f:372e/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

djmccarthy12 avatar May 21 '20 18:05 djmccarthy12

I was able to get it working by updating my /etc/hosts config such that localhost was mapped to some IP address other than 127.0.0.1.

k4m4 avatar Nov 12 '22 19:11 k4m4

@k4m4 I would like to know how you updated /etc/hosts? I always get br0 0x000000

Abib-web avatar Jan 08 '23 20:01 Abib-web