docker容器中搭建qemu运行时环境

〇、写在前面

笔者近期想练习下CTF的arm pwn类型的题目，发现别人写的一篇writeup中要使用qemu模拟运行时，于是开始了搭建docker+qemu的环境搭建工作，包括编译链，调试器，本文目的是简单记录下里面踩过的坑，便于后面搭建新环境时再次采坑。

一、容器中安装arm运行时环境

1. 直接运行arm binary

参考writeup文章：Codegate 2018 Writeup
运行binary：

qemu-arm  -g 1234 -L /usr/arm-linux-gnueabi ./melong

发现我的环境里面没有arm-linux-gnueabi，于是去掉这个命令执行：

qemu-arm  -g 1234 ./melong

提示找不到ELF解释器"No such file:/lib/ld-linux.so.3"，原因是没有安装arm的运行时环境，首先查找哪个包包含这个文件，执行：

apt-file search "/usr/arm-linux-gnueabihf/lib/ld-linux.so.3"
libc6-armhf-cross: /usr/arm-linux-gnueabihf/lib/ld-linux.so.3

安装好该包，即可运行成功，注意该命令是模拟用户程序，不会模拟arm架构的系统。

2. 运行arm版本gdb

接着按照writeup运行gdb：

arm-none-eabi-gdb melong

发现我的环境里面无该指令，于是安装该指令的包，无脑安装gcc-arm-linux-gnueabi后发现还是没有gdb程序，问题未解决。
寻找他法，google说是要手动下载arm toolchains，于是下载arm官方的toolchains
解压，安装，设置PATH环境变量一系列操作后成功运行了gdb：

⇒  /opt/cross-compile-chains/gcc-arm-none-eabi-10-2020-q4-major/bin/arm-none-eabi-gdb
GNU gdb (GNU Arm Embedded Toolchain 10-2020-q4-major) 10.1.90.20201028-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-linux-gnu --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
/root/.gdbinit:1: Error in sourced command file:
/root/.gdbinit-gef.py:58: Error in sourced command file:
Undefined command: "from".  Try "help".
(gdb)
(gdb) show configuration
This GDB was configured as follows:
   configure --host=x86_64-linux-gnu --target=arm-none-eabi
             --with-auto-load-dir=$debugdir:$datadir/auto-load
             --with-auto-load-safe-path=$debugdir:$datadir/auto-load
             --with-expat
             --with-gdb-datadir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-48_20201124_1606180641/install-native/arm-none-eabi/share/gdb (relocatable)
             --with-jit-reader-dir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-48_20201124_1606180641/install-native/lib/gdb (relocatable)
             --without-libunwind-ia64
             --without-lzma
             --without-babeltrace
             --without-intel-pt
             --with-mpfr
             --without-xxhash
             --without-python
             --without-python-libdir
             --without-debuginfod
             --without-guile
             --disable-source-highlight
             --with-separate-debug-dir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-48_20201124_1606180641/install-native/lib/debug (relocatable)
             --with-system-gdbinit=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-48_20201124_1606180641/install-native/x86_64-linux-gnu/arm-none-eabi/lib/gdbinit (relocatable)

("Relocatable" means the directory can be moved with the GDB installation
tree, and GDB will still find it.)
(gdb)

很无奈，官方的包并无python支持，gef等攻防要用到的python插件用不了，于是手动编译。

3. 手动编译arm版gdb

参照: 编译arm版本gdb
漫长地编译完成后报错：

⇒  ~/.local/bin/arm-none-eabi-gdb
GNU gdb (GDB) 9.1
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-pc-linux-gnu --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
  File "/root/.gdbinit-gef.py", line 929
    pattern_libc_ver = re.compile(rb"glibc (\d+)\.(\d+)")
                                                       ^
SyntaxError: invalid syntax
(gdb) show configuration
This GDB was configured as follows:
   configure --host=x86_64-pc-linux-gnu --target=arm-none-eabi
             --with-auto-load-dir=$debugdir:$datadir/auto-load
             --with-auto-load-safe-path=$debugdir:$datadir/auto-load
             --with-expat
             --with-gdb-datadir=/root/.local/share/gdb (relocatable)
             --with-jit-reader-dir=/root/.local/lib/gdb (relocatable)
             --without-libunwind-ia64
             --with-lzma
             --without-babeltrace
		             --without-intel-pt
             --without-mpfr
             --without-xxhash
             --with-python=/usr
             --without-guile
             --disable-source-highlight
             --with-separate-debug-dir=/root/.local/lib/debug (relocatable)

("Relocatable" means the directory can be moved with the GDB installation
tree, and GDB will still find it.)
(gdb)

由上可知，python已经集成了，但是语法解析错误。
首先想到最简单的方法，测试是不是python版本问题，执行下面命令可知是gdb集成的是python2。

⇒  ldd ~/.local/bin/arm-none-eabi-gdb | grep python
	libpython2.7.so.1.0 => /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0 (0x00007fc1c3b16000)

为保险起见， 使用python3执行报错语句没问题，找到了问题根源，于是我狠心卸载了python2。

apt remove python
apt remove python-minimal

再次执行gdb仍然报错，仍然使用Python2，问题未得到解决。看来只能重编切python版本了，只需要更改一个编译参数：

--with-python=/usr/bin/python3

重新编译后再次运行gdb就集成python3了，验证如下：

⇒  ldd ~/.local/bin/arm-none-eabi-gdb | grep python
	libpython3.6m.so.1.0 => /usr/lib/x86_64-linux-gnu/libpython3.6m.so.1.0 (0x00007f9f3f2e6000)

再次运行gdb，不出意外又报错：

⇒  ~/.local/bin/arm-none-eabi-gdb
GNU gdb (GDB) 9.1
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-pc-linux-gnu --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
GEF for linux ready, type `gef' to start, `gef config' to configure
77 commands loaded for GDB 9.1 using Python engine 3.6
[*] 3 commands could not be loaded, run `gef missing` to know why.
Python Exception <class 'UnicodeEncodeError'> 'ascii' codec can't encode character '\u27a4' in position 12: ordinal not in range(128):
(gdb) get missing
Undefined command: "get".  Try "help".
Python Exception <class 'UnicodeEncodeError'> 'ascii' codec can't encode character '\u27a4' in position 12: ordinal not in range(128):
(gdb) quit

gef的脚本加载失败了，原因是编码问题，设置系统编码类型：

export LC_CTYPE=C.UTF-8

再次运行gdb，问题解决。

二、小结

1.分析嵌入式架构的程序要搭建好一个系统环境，支持toolchains，以及跨架构的gdb，后续会考虑集成到我的docker镜像中，方便环境迁移后复用。
2.如果qemu缺乏arm版本的ELF解析器，要安装libc6-armhf-cross，而不是gcc-arm-linux-gnueabi，前者是运行时依赖套件，后者只是嵌入式开发套件，要分清楚。
3.最后是有时间就将各种架构的gdb编译一次，放到git上永久存储使用，不用再各种折腾。
4.小的事情往往耽搁大量的时间，记得随时记录留存是非常非常必要的，可以提升效率。