Lion Cipher Lab
Emulate a whole router firmware with FirmAE — boot the real web UI in a full-system emulator (no hardware)
- Penetration Testing / Red Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
In the QEMU user-mode lab you made a single embedded binary run on your x86 box — but the moment that binary was a real router daemon, it died on `nvram_get`, opened `/dev/mtd0` to nothing, and never came up, because user-mode fakes no hardware. Full-system emulation is the answer: it boots the firmware's entire kernel and root filesystem inside an emulated machine, so NVRAM, flash, and the network interfaces the device expects all exist. FirmAE automates that end to end — extract the image, infer its network config, boot it, and bring its web services up — so you can open the device's actual…
What you'll learn
- Full-system firmware emulation
- FirmAE (clone, download, install, run)
- booting a whole emulated kernel + rootfs
- NVRAM/network arbitration heuristics
- reaching an emulated device's web UI over a virtual network
- user-mode vs full-system emulation judgment
- scanning a live emulated device with nmap/nikto
- recognising when emulation cannot work and the hardware fallback
Steps in this lab
- From one binary to the whole device — the wall user-mode left you at
- User-mode vs full-system — the judgment that decides which tool you reach for
- Meet FirmAE — and why it exists (firmadyne + arbitration)
- Ground rules — only emulate firmware you're allowed to, in an isolated box
- Install FirmAE (clone, download.sh, install.sh) — or use the Docker path
- Initialise FirmAE and get a permitted firmware image
- Check emulation first — `run.sh -c`
- Run it for real — `run.sh -r`, then ping the assigned IP
- Open the device's real web UI in your browser
- Prove it's a live target — scan it with nmap, then nikto
- When emulation still won't boot — the honest limits, and your fallback
- What you just did — and where it leads