我正在尝试在 qemu 中的完整系统仿真上运行 MIPS 二进制文件，以搜索路由器固件中的漏洞。
我正在使用以下命令启动 qemu：qemu-system-mips -M malta -m 256 -hda hda.img -kernel vmlinux-4.19.0-14-4kc-malta -initrd initrd.img-4.19.0-14-4kc-malta -append "root=/dev/sda1 console=ttyS0 nokaslr" -nographic -netdev user,id=net0 -device e1000-82545em,netdev=net0,id=net0,mac=52:54:00:c9:18:27 -net user -redir tcp:2222::22 -net nic
机器启动，我确实获得了网络连接，并且能够安装 gdb、binwalk 等。
当我尝试运行二进制文件时出现问题，例如 ./busybox，我得到输出 -bash: ./busybox: No such file or directory 。
但是当我运行 strace busyboox 时，我得到：
execve("/usr/bin/busybox", ["busybox"], 0x7f7ffa70 /* 20 vars */) = 0
brk(NULL) = 0x55aae000
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x77f07000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=24625, ...}) = 0
mmap2(NULL, 24625, PROT_READ, MAP_PRIVATE, 3, 0) = 0x77f00000
close(3) = 0
openat(AT_FDCWD, "/lib/mips-linux-gnu/libresolv.so.2", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\10\0\0\0\1\0\0%\320\0\0\0004"..., 512) = 512
prctl(PR_GET_FP_MODE) = 0
_llseek(3, 724, [724], SEEK_SET) = 0
read(3, "\0\0\0\4\0\0\0\20\0\0\0\1GNU\0\0\0\0\0\0\0\0\3\0\0\0\2\0\0\0\0", 32) = 32
fstat64(3, {st_mode=S_IFREG|0644, st_size=83944, ...}) = 0
mmap2(NULL, 153808, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x77eb0000
mprotect(0x77ec3000, 61440, PROT_NONE) = 0
mmap2(0x77ed2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12000) =
0x77ed2000
mmap2(0x77ed4000, 6352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) =
0x77ed4000
close(3) = 0
openat(AT_FDCWD, "/lib/mips-linux-gnu/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\10\0\0\0\1\0\1\244d\0\0\0004"..., 512) = 512
prctl(PR_GET_FP_MODE) = 0
_llseek(3, 520, [520], SEEK_SET) = 0
read(3, "\0\0\0\4\0\0\0\24\0\0\0\3GNU\0\30\335\354\235\fM\241r\346\26\317\341R\305\363\23"..., 36) =
36
_llseek(3, 828, [828], SEEK_SET) = 0
read(3, "\0\0\0\4\0\0\0\20\0\0\0\1GNU\0\0\0\0\0\0\0\0\3\0\0\0\2\0\0\0\0", 32) = 32
fstat64(3, {st_mode=S_IFREG|0755, st_size=1668292, ...}) = 0
mmap2(NULL, 1642000, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x77d1f000
mprotect(0x77e98000, 61440, PROT_NONE) = 0
mmap2(0x77ea7000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x178000) =
0x77ea7000
mmap2(0x77eae000, 7696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) =
0x77eae000
close(3) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x77efe000
set_thread_area(0x77f054a0) = 0
mprotect(0x77ea7000, 16384, PROT_READ) = 0
mprotect(0x77ed2000, 4096, PROT_READ) = 0
mprotect(0x55728000, 8192, PROT_READ) = 0
mprotect(0x77f09000, 4096, PROT_READ) = 0
munmap(0x77f00000, 24625) = 0
getuid() = 0
ioctl(2, TIOCGWINSZ, 0x7f9faddc) = 0
dup2(1, 2) = 2
write(2, "BusyBox v1.30.1 (Debian 1:1.30.1"..., 35BusyBox v1.30.1 (Debian 1:1.30.1-4)) = 35
write(2, " multi-call binary.\n", 20 multi-call binary.
) = 20
write(2, "BusyBox is copyrighted by many a"..., 568BusyBox is copyrighted by many authors between
1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.
Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --show SCRIPT
or: busybox --install [-s] [DIR]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
) = 568
write(2, "\t", 1 ) = 1
write(2, "[", 1[) = 1
write(2, ", ", 2, ) = 2
write(2, "[[", 2[[) = 2
write(2, ", ", 2, ) = 2
write(2, "acpid", 5acpid) = 5
write(2, ", ", 2, ) = 2
write(2, "adjtimex", 8adjtimex) = 8
write(2, ", ", 2, ) = 2
write(2, "ar", 2ar) = 2
write(2, ", ", 2, ) = 2
write(2, "arch", 4arch) = 4
write(2, ", ", 2, ) = 2
write(2, "arp", 3arp) = 3
...
...
exit_group(0) = ?
+++ exited with 0 +++
看起来 strace 给出了想要的输出，但我无法弄清楚正常执行时的问题是什么。感谢您的帮助