5

QEMU使用记录

 2 years ago
source link: https://xuanxuanblingbling.github.io/ctf/tools/2020/04/16/qemu/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

QEMU使用记录

发表于 2020-04-16

| 分类于 CTF/tools

每次看QEMU启动有一堆参数，很是害怕，所以抽出空来彻底整理一下见过的QEMU用法，从使用者的角度对QEMU做一个梳理。

What is QEMU? QEMU is a generic and open source machine emulator and virtualizer.

与KVM的关系

其他优秀文章

在Ubuntu中安装QEMU的网络教程中，经常有要apt安装一堆东西，其实不用指定那么多包也能安装所需要的所有qemu软件，首先来看一下网上教程中常见的软件包：

  • qemu：比较完整的软件包，包括了qemu-system、qemu-user以及binfmt-support
  • qemu-system：system模式的软件包，模拟完整的系统
  • qemu-user：user模式的软件包，本身是动态链接
  • qemu-user-static：user模式的软件包，本身是静态链接，用于chroot更换动态路径后仍然能运行
  • binfmt-support：根据二进制的magic number选择解析器的工具

其实只要认真看一下apt install给出的提示就能看出，qemu除了没有包含qemu-user-static，剩下都有，以下是我在ubuntu18.04的安装提示：

➜  sudo apt install qemu       
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  binfmt-support cpu-checker ibverbs-providers ipxe-qemu ipxe-qemu-256k-compat-efi-roms libaio1 libcacard0 libfdt1 libibverbs1 libiscsi7 libnl-route-3-200
  librados2 librbd1 librdmacm1 libsdl1.2debian libspice-server1 libusbredirparser1 libxen-4.9 libxenstore3.0 msr-tools qemu-block-extra qemu-slof qemu-system
  qemu-system-arm qemu-system-common qemu-system-mips qemu-system-misc qemu-system-ppc qemu-system-s390x qemu-system-sparc qemu-system-x86 qemu-user
  qemu-user-binfmt qemu-utils seabios sharutils
Suggested packages:
  qemu-user-static samba vde2 qemu-efi openbios-ppc openhackware openbios-sparc sgabios ovmf debootstrap sharutils-doc bsd-mailx | mailx

其实可以使用--install-suggests选项安装建议的包，即可安装我们需要的所有qemu功能：

➜  sudo apt install --install-suggests qemu

安装好之后我们有了如下软件：

➜  qemu-
qemu-aarch64              qemu-mipsn32el            qemu-system-cris        
qemu-aarch64-static       qemu-mipsn32el-static     qemu-system-i386        
qemu-alpha                qemu-mipsn32-static       qemu-system-lm32        
qemu-alpha-static         qemu-mips-static          qemu-system-m68k        
qemu-arm                  qemu-nbd                  qemu-system-microblaze  
qemu-armeb                qemu-nios2                qemu-system-microblazeel
qemu-armeb-static         qemu-nios2-static         qemu-system-mips        
qemu-arm-static           qemu-or1k                 qemu-system-mips64      
qemu-cris                 qemu-or1k-static          qemu-system-mips64el    
qemu-cris-static          qemu-ppc                  qemu-system-mipsel      
qemu-debootstrap          qemu-ppc64                qemu-system-moxie       
qemu-hppa                 qemu-ppc64abi32           qemu-system-nios2       
qemu-hppa-static          qemu-ppc64abi32-static    qemu-system-or1k        
qemu-i386                 qemu-ppc64le              qemu-system-ppc         
qemu-i386-static          qemu-ppc64le-static       qemu-system-ppc64       
qemu-img                  qemu-ppc64-static         qemu-system-ppc64le     
qemu-io                   qemu-ppc-static           qemu-system-ppcemb      
qemu-m68k                 qemu-s390x                qemu-system-s390x       
qemu-m68k-static          qemu-s390x-static         qemu-system-sh4         
qemu-make-debian-root     qemu-sh4                  qemu-system-sh4eb       
qemu-microblaze           qemu-sh4eb                qemu-system-sparc       
qemu-microblazeel         qemu-sh4eb-static         qemu-system-sparc64     
qemu-microblazeel-static  qemu-sh4-static           qemu-system-tricore     
qemu-microblaze-static    qemu-sparc                qemu-system-unicore32   
qemu-mips                 qemu-sparc32plus          qemu-system-x86_64      
qemu-mips64               qemu-sparc32plus-static   qemu-system-x86_64-spice
qemu-mips64el             qemu-sparc64              qemu-system-xtensa      
qemu-mips64el-static      qemu-sparc64-static       qemu-system-xtensaeb    
qemu-mips64-static        qemu-sparc-static         qemu-tilegx             
qemu-mipsel               qemu-system-aarch64       qemu-tilegx-static      
qemu-mipsel-static        qemu-system-alpha         qemu-x86_64             
qemu-mipsn32              qemu-system-arm           qemu-x86_64-static

user模式

以arm架构为例

直接运行可执行文件

静态链接的可执行文件

动态链接的可执行文件

与chroot连用

system模式

各种参数：

直接加载镜像

  1. debian_wheezy_armhf_standard.qcow2 2013-12-17 00:04 229M
  2. initrd.img-3.2.0-4-vexpress 2013-12-17 01:57 2.2M
  3. vmlinuz-3.2.0-4-vexpress 2013-09-20 18:33 1.9M
$ sudo tunctl -t tap0 -u `whoami`  # 为了与 QEMU 虚拟机通信，添加一个虚拟网卡
$ sudo ifconfig tap0 10.10.10.1/24 # 为添加的虚拟网卡配置 IP 地址

$ qemu-system-arm \
-M vexpress-a9 \
-kernel vmlinuz-3.2.0-4-vexpress \
-initrd initrd.img-3.2.0-4-vexpress \
-drive if=sd,file=debian_wheezy_armhf_standard.qcow2 \
-append "root=/dev/mmcblk0p2 console=ttyAMA0" \
-net nic \
-net tap,ifname=tap0,script=no,downscript=no \
-nographic

安装任意操作系统

PWN题中的调试


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK