QEMU emulation package question

[aserper]

Hi,
I'm trying to understand but I couldn't find it in the docs:
When EMBA is trying to do a full system qemu emulation, what determines the amount of attempts that are made to generate an emulation package? Usually, EMBA generates more than one package - what is it based on?

Thanks

[m-1-k-3]

EMBA generates for every working (TCP or ICMP) emulation attempt one package. If some open port is detected EMBA will stop trying. If a port is opened then you usually would use this package. You get a final overview of all the emulation results:

[aserper]

Thanks for clarifying. Is there any documentation somewhere (which isn't the code itself 😉) to how emba tries to build the package?

[m-1-k-3]

There is some basic information on the emulator in the wiki here. But these details are not that detailed as you probably needed it.

At the end the following steps are performed:

• EMBA tries to emulate the firmware in a default config to identify the network configuration
• Next step is to emulate the system multiple times with different possible configs
• On every run it tries to identify the reachability with ICMP and network services
• If the system is reachable via a network service EMBA stops and generates an archive
• If the system is reachable only via ICMP an archive is generated but EMBA tries the next config with the goal to get the system with another config further

The archive is quite simple. It is just the kernel EMBA was using, the filesystem EMBA generated and a startup wrapper script (run.sh) which configures the network and starts the emulation process. You can also just copy the steps to a terminal and it should work.

Hope that helps a bit.

[m-1-k-3]

Missed this detail. EMBA checks for more than 1 TCP service as stop criteria. If only ICMP and one TCP service is detected via the network EMBA will also check the other configs to improve the results.

[aserper]

Perfect, that's what I was looking for! Thank you.