---
# System prepended metadata

title: Greenhouse Codebase Notes

---

## Greenhouse QEMU

Modifications to their fork of QEMU 5

- hackproc
  - when enabled redirect `/proc/*` to `/ghproc/*` and `/dev/*` to `/ghdev/*`
  - applies to: openat, 
- hackbind
  - setsockopt is forced to return 0 for level=SOL_IPV6 and most values of optname
  - `socket` syscall forces `AF_INET6` to `AF_INET`
  - bind syscall..
    - do nothing to IPv4 aside from printing out IP/port
    - force IPv6 to bind on IPv4 0.0.0.0:port
    - attempt up to 3 retries
    - try a new port each time
      - if port is 0 or negative, bind on 80
      - increment the port and only actually retry when finding an unused port
- hacksysinfo
  - set 1, 5, and 15 minute load averages to 0
- execve
  - you can pass an executable using `-execve [path]` in order to have all execves pass through the given program
- pconly
  - doesn't log events outside of the given executable

## Greenhouse Core

Description of the behavior of their rehosting framework.

- Log Trace
    - All of the logs (syscall tracing, qemu logs, etc) are merged
    - regex is used to parse out missing files and add them
        - syscalls: open(at), access(at), stat, chdir
    - Also used to find missing nvram values
- FirmAE Wrapper
    - Nothing special here, just used to get args/nvram values like it says in the paper
- "BinTrunk" (Angr-based CFG reconstruction)
    - Searches for an entrypoint
        - "main" symbol -> "__libc_start_main" -> binary entrypoint
    - Detects exits
        - process returns
        - anything with "no successor" according to angr
    - Marks exits for pruning
- "Planter"
    - Removes device files and replaces them with its own
        - `/dev/random` and `/dev/urandom` are hardcoded strings
    - Runs `file` to determine architecture
    - Sets up all the greenhouse-specific files
        - nvram replacement
        - `/ghdev`, `/greenhouse`, etc 
    - Searches for binaries of interest to run based on user-input as to type of rehosting
        - types of rehosting: HTTP, UPNP, DNS, DHCP
        - then scans for a hardcoded list of binaries based on the given type
        - checks if binary is networking-facing based on if it "links" against the "symbols" of `listen` or `bind` (according to angr)
- Plugins
    - 