Lion Cipher Lab
Emulate a firmware binary with QEMU user-mode — run a MIPS/ARM embedded binary on your x86 PC
- Penetration Testing / Red Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Almost all router, camera, and IoT firmware is compiled for MIPS or ARM CPUs — not the x86/x86-64 chip in your laptop. So when the static-extraction lab hands you a suspicious embedded binary, you cannot just type `./binary` to watch it run: your machine literally can't execute those instructions. QEMU user-mode emulation translates the foreign CPU instructions on the fly, letting a MIPS or ARM binary run as a normal process on your PC — so you can actually exercise the service, watch its syscalls, fuzz it, or attach a debugger, all without owning the physical device. This 'make the embedded…
What you'll learn
- QEMU user-mode emulation
- cross-architecture (MIPS/ARM) binaries
- identifying architecture & endianness with file/readelf
- running dynamically-linked foreign binaries with qemu -L
- chroot + static-qemu firmware emulation
- user-mode vs system-mode emulation judgment
- dynamic analysis of embedded services
Steps in this lab
- Why emulate firmware at all — and the wall you hit first
- QEMU user-mode vs system-mode — pick the right tool now
- Ground rules — only run firmware you're allowed to
- Install QEMU user-mode and a cross-compiler
- Build your own foreign-architecture binary (zero legal ambiguity)
- Identify architecture and endianness before you run
- Run the static binary — proof the CPU translation works
- The real-world case — a dynamically-linked binary, and why it fails
- Fix it with `qemu-mips -L` — point QEMU at the firmware's own root
- The classic chroot + static-qemu recipe (firmadyne/FirmAE style)
- When user-mode isn't enough — and where full-system takes over
- What you just did — and where it leads