---
# System prepended metadata

title: ARM (Advance RISC Machine
tags: [arm]

---

侯智晟-meowheckerouo@gmail.com


**Outline**
[TOC]

ARM Simulator

https://cpulator.01xz.net/?sys=arm-de1soc

ARM -> Advance RISC Machine
# Layout 面版

## Register 

![](https://hackmd.io/_uploads/H1PXMqmr3.png)

r0 ~ r6 Normal Registers

r7 -> systems call


### sp (Stack pointer)

Tell us next usable Address (Base on stack memory)

### lr (link register)

Invoke function ; 保存子例程調用完成時要返回的地址的寄存器


### pc (program counter) 
-> Trace next Instruction 的 memory address 




### Stack Memory 

Stack Memory -> Computer RAM


![圖片](https://hackmd.io/_uploads/Hyr6G67FC.png)

Address 1 = 1 Byte 

Address 0x10 -> 16 Byte
![](https://hackmd.io/_uploads/HJ58VcmSh.png)

### cpsr(current program status register )

有flag 會標示 數值 正負

### spsr (save program status register)

要不要進位
是否 overflow 



# First Program


## Assebbler Language:Basic Syntax

```
lable 
    opcode oprand1, oprand2... #Commands  
```

### Label
Address 標記

### opcode 
指令操作碼

### operand 
不同指令則有所不同個operand

![](https://hackmd.io/_uploads/r1-hGoXrh.png)

---

```
mov R1 #1
```

## Register 7 

### systems invoke

- Manage
    - input 
    - ouput 
    - process exec 
   
- Communication 
    - systems interrupt R7 #1
    - systems invoke -> 查 table ->找出對應的Instruction

用法 assign value 給 register 7

## mov

Register Assignment! 

```
.global _start
_start:
    MOV R0,#0x01
    MOV R7,#1
    SWI #0
```

![](https://hackmd.io/_uploads/HyoeTq7rn.png)


## SWI(Software Interrupt)

Interrupt Process 

```
SWI #0
```

## Little-Endian

![](https://hackmd.io/_uploads/S1VxyjmHh.png)

# Address Model


## Register Immediate Addressing (立即尋址)

表示 能夠立即的賦值 操作

![](https://hackmd.io/_uploads/H1_b7iQHn.png)

## Register Indirect Addressing 

類似 Pointer  

![](https://hackmd.io/_uploads/SJiNtjXH3.png)

r0 -> stack Address 


## Stack 

把data 放在 Stack memory 中


```
.global _start
_start:

.data

list: 
.word 1,2,3,4,5,-1,-2
```


.data  定義 Memory 的數據段

list -> Varaiable 
.word -> 為Data type -> 32 bit 


### LDR 

From Stack to Register 


Syntax  

```
LDR R1 R2(Address), #offset  
```
R2 #4 == *(R2) +1 

Offest 1 = One Bytes

```
.global _start     @ 定义 _start 符号为全局符号
_start:            @ 定义 _start 标签
LDR R0,=list       @ 把list的地址装载到寄存器R0中
.data              @ 定义数据段
list:              @ 定义一个名为 list 的符号，用于访问数据段中的数据
    .word 1,2,3,4,5,-1,-2  @ 在 list 符号指向的位置定义一些整数值
```

=list Return memory Address



![](https://hackmd.io/_uploads/BkuDVdOrh.png)


![](https://hackmd.io/_uploads/SkAd4_urh.png)


code 2

```
.global _start
_start:

	LDR R0,=list  #=list like list[]
	LDR R1,[R0]

.data

list: 
.word 1,2,3,4,5,-1,-2
```


[] -> 取value 


*R0 -> R1 Regitser 


![](https://hackmd.io/_uploads/rJeO9udB3.png)

![](https://hackmd.io/_uploads/HyPKq_drh.png)

code3

```
.global _start
_start:

	LDR R0,=list   @ RO = *(list[]);
	LDR R1,[R0]    @ *R1=*(R0);
	LDR R2,[R0,#4] @ *(R2)=*(R1+1)

.data

list: 
.word 1,2,3,4,5,-1,-2
```

![](https://hackmd.io/_uploads/By6Pj_dSh.png)

![](https://hackmd.io/_uploads/SkmFsduS2.png)


### Pre Increase

syntax 
```
LDR R2, [R0 #4]!
```
先對 R0 做偏移取值 再存到R2這個 Register  

![](https://hackmd.io/_uploads/Sk7N6d_B2.png)

![](https://hackmd.io/_uploads/HkiE6_urn.png)



### Post Increase

syntax 
```
LDR R2,[R0],#
```


```
.global _start
_start:

	LDR R0,=list   @ RO = *(list[]);
	LDR R1,[R0]    @ *R1=*(R0);
	LDR R2,[R0],#4 @ *(R2)=*(R1+1);

.data

list: 
.word 1,2,3,4,5,-1,-2
```

![](https://hackmd.io/_uploads/SyiYC_dBh.png)


![](https://hackmd.io/_uploads/Skj_RO_rh.png)

# Arithmetic CPSR 
(Current programe status register )

```
.global _start
_start:
	
	MOV R0,#6
	MOV R1,#9
	
	ADD R2,R1,R0
	SUB R3,R1,R2 @-3
	MOV R4,#-3
	
MOV R5,#0xffffffff
```

## CPSR

CPST -> 4 bit 

- negative 

- zero 

- carry 

- overflow 



![](https://hackmd.io/_uploads/HJPNBYdSh.png)


### Negative flag 

![](https://hackmd.io/_uploads/H1Qj4KuB2.png)

當有 SUB command -> N flag 會根據計算結果來設定flag

![](https://hackmd.io/_uploads/ry6zBF_Bn.png)

### Zero flag 

![](https://hackmd.io/_uploads/ByxslUYOr3.png)

### Carry flag

0xffffffff + 0x00000000a 

= 1(carry -> carry flag set 1 ) + 0x000000009

![](https://hackmd.io/_uploads/ByTD8Furh.png)

### ADC 

ADD oprand + carray 操作

![](https://hackmd.io/_uploads/Hk9noKurn.png)


# Logical Operation 


## And Operation

```
.global _start
_start 

    MOV R0, #0xffffffff
    MOV R1, #0x21
    AND R2, R0, R1 
```

R2 -> 0x21


![](https://hackmd.io/_uploads/rJlUlTF_H2.png)


## OR Operation 



![](https://hackmd.io/_uploads/BkSBhFuBn.png)



## EOR Operation 

Exclusive OR 

1 0 -> 1
0 1 -> 1
0 0 -> 0
1 1 -> 0



![](https://hackmd.io/_uploads/Hk-V6K_H3.png)


## MVN 

Move Negative 

0x000000ff --Negative--> 0xffffff00
255 -> -256

---

-256 原因
0x80000100 -> remote 符號未 再取補數 ->0xfffffEff-> 補數+1 ->0xffffff00 (逆推)



![](https://hackmd.io/_uploads/BJlq1cdS2.png)


![](https://hackmd.io/_uploads/Hy-F15uH3.png)


## Remove 特定的Bit(And operation)

And Op

Remote bit -> set 0
reserve bit -> set 1 



# Logical Shift/Rotaion

## Shfit 

```
.global _start
_start:
	
	@logical shifting 
	
	@left
	MOV R0,#10
	LSL R0,#1   //R0*2 
	
	@right
	MOV R1,#10
LSR R1,#1   //R1/2
```

### LSL (logical shift left)

value * 2 

00000101 -> 0001010

5 -> 10

```	
MOV R0,#10
MOV R1,R0,LSR #1  //R1 = R0/2
```




### LSR (logical shift right)

value / 2
00000101 -> 00000010
5 -> 2.5 -> 2
00000011 -> 00000001
3 - > 1.5 -> 1

## Rotation 

![](https://hackmd.io/_uploads/B1L2u5OSh.png)
LSR 最小的bit 有消失的問題 

### ROR
```

.global _start
_start:

	MOV R0,#0x0f
    ROR R0,#1

```


# Condiction and Branch


## CMP 

compare 但不跳轉 (條件句大哥)

syntax 
```
CMP R0, R1
```

(R0 - R1) -> 如果為 Negative -> CPSR: N flag = 1 

## Cmpare and Jump to Branch

會去看 CPSR flag 來去執行其他操作


### BGT (Branch if greater than) ">"


```

.global _start
_start:
	
	MOV R0,#3
	MOV R1,#2
	
	CMP R0,R1 //R0-R1
	
	BGT greater
	
	MOV R2,#2
	
greater:
MOV R2,#1
```

如果 jump 到 greater label(Branch) -> MOV R2, #2 會被skip掉

![](https://hackmd.io/_uploads/Bye3ZjdB2.png)


### BLT (Branch if less than ) "<"


### BLE "<="


### BEQ "="


### BNE "!="




## Jump to Branch 

### BAL (branch and link)

Notice: 他不會把 Next instruction Address 純在LR 裡面

![](https://hackmd.io/_uploads/ryrPGj_r2.png)

![](https://hackmd.io/_uploads/ByAdfs_Hn.png)

# Loop And Branch 

## BAL

```
.global _start
_start:

	LDR R0,=list  @Ro == list 入口 
	
.data 
list:
.word 1,2,3,4,5,6,7
```
![](https://hackmd.io/_uploads/SJXOXs3r3.png)



類似於 C Language "\n"

```
.equ endlist 0xaaaaaaaa
```

![](https://hackmd.io/_uploads/S1Ir4ohS2.png)


C language 

![](https://hackmd.io/_uploads/r1XnNj2r3.png)

```
for (int i =0; i< array/size of (int);i++){

    if (array[i] != "\0"){
        a=a+i;
        i++;
    }

}
```

ARM 
```
.global _start
.equ EOF, 0xaaaaaaaa  //save in the memory 

_start:
	
	LDR R0,=list
	LDR R3,=EOF
	LDR R1,[R0]
	ADD R2,R2,R1
	
loop:
	LDR R1,[R0,#4]!   @gat memory value 
	CMP R1,R3
	BEQ exit 
	ADD R2,R2,R1
	BAL loop
	
exit:

.data

list:
.word 1,2,3,4,5,6,7,8,9,10
```

![](https://hackmd.io/_uploads/HydlIo3Bh.png)


# Condiction Instriction Execution


c Laguage

```
if(a<b){
    add(a,b)
}
```


```
.global _start
.equ EOF, 0xaaaaaaaa  //save in the memory 

_start:
	
	MOV R0,#10
	MOV R1,#9
	
	CMP R0,R1
	
	BLT addR1R2
	BAL exit

addR1R2:
	ADD R3,R2,R1

exit:
```

# Branch with Link Register and Return

## Function

BL 跟 BX (Return 一個 Address )

## BL (Branch Link

在跳轉到另一個Branch時 會記錄下一個 Instruction Address 直接存到 Link Register (但她不會直接回去)

```
.global _start
_start:

	MOV R0,#1
	MOV R1,#1
	BL add2
	MOV R5,#9
	
add2:
	ADD R2,R0,R1
```

![](https://hackmd.io/_uploads/B1KspanB3.png)

## BX (Branch Return)

回到LR存的Address 

```
.global _start
_start:


	MOV R0,#1
	MOV R1,#1
	BL add2
	MOV R5,#9
	
	
	
add2:
	ADD R2,R0,R1
	BX lr

```

BX -> LR 有點像 Pointer , BX oprand 就會讓 Instruction 回到LR 的位置



![](https://hackmd.io/_uploads/Syk_RT2B3.png)

# Preserving and Retrieving Data from Stack Memory

保留和取出 data From Stack Memory


## Stack Memory 

Compiler 會去 Register assign (Register 的賦值 由compiler 分配)

Push 跟 PoP value -> 要考慮 stack 結構 (FILO)

## link Register 

BL (branch link) LR - recording Next instruction and waiting function invoke finishing 
## Local Register 

![](https://hackmd.io/_uploads/rkb76OyLn.png)


## Push 

Preserving Data into Stack 

```
.global _start

_start:


	MOV R0,#1
	MOV R1,#1
	PUSH {R0,R1}
	BL add2
	POP {R0,R1}
	BL end 
	
add2:
	MOV R0,#5
	MOV R1,#6
	ADD R2,R1,R2
	BX lr
	
end:

```

![](https://hackmd.io/_uploads/BJXYKuyIh.png)

push -> register value -> stack 裡面
push 完 sp(Stack Pointer) 會指向 push 進去的Initial Address 


## PoP

Getting Register value form stack Memory 

```
.global _start

_start:


	MOV R0,#1
	MOV R1,#1
	PUSH {R0,R1}
	BL add2
	POP {R0,R1}
	BL end 
	
add2:
	MOV R0,#5
	MOV R1,#6
	ADD R2,R1,R2
	BX lr
	
end:

```

## Function Return 

利用stack -> 來 implement Function 

```arm

.global _start

_start:
	MOV R0,#1
	MOV R1,#1
	PUSH {R0,R1}
	BL add2
	POP {R9}  @R9 = function return value 
	POP {R0,R1} 
	MOV R3,R9
	B end 
	
add2:
	MOV R0,#5
	MOV R1,#6
	ADD R2,R0,R1
	PUSH {R2} @return value
	BX lr
	
end:

```


![](https://hackmd.io/_uploads/Sk9zCdJL3.png)

### Observe

stack address 越push -> (sp) Address 愈小

![](https://hackmd.io/_uploads/rkDuROk82.png)


# Hardware Interactions

Arm CPU 與 Device 

![](https://hackmd.io/_uploads/Hy8QeY1Ln.png)

## Switch 

CPU 可以透過 Switch (Device) 取得 Value 
可以放到 Register 中

### .equ

用於定位 可以想成 Declare Pointer 


```
.equ switchAddress, 0xff20040

.global _start

_start:
LDR R1,=switchAddress
```

![](https://hackmd.io/_uploads/BkJREteU2.png)

根據上圖 可以知道Switches Device Address 是多少

![](https://hackmd.io/_uploads/HJlfrKlLh.png)

```
.equ switchAddress, 0xff200040

.global _start

_start:
	LDR R0,=switchAddress
    LDR R1,[R0]  @ *(RO)
```

![](https://hackmd.io/_uploads/HJo6BFg8n.png)

![](https://hackmd.io/_uploads/r1txUYeUn.png)

RO -> switch Address 

## LED Device

### STR

將src Register 32 bit value 送到 處存器的Address 

syntax 
```
STR srcR [Raddress] 
```

```
.equ switchAddress, 0xff200040 @switch pointer 
.equ ledAddress ,0xff200000  @led pointer

.global _start

_start:
	LDR R0,=switchAddress
	LDR R1,[R0]   @ value 1111 
	
	LDR R0,=ledAddress
    STR R1,[R0] @STR "register value ->　led"

```

![](https://hackmd.io/_uploads/HJ31iFgI2.png)


# Setting up Qemu for ARM Programming 

## Raspberrypi ->Run ARM program


Part 1


http://downloads.raspberrypi.org/raspbian/images/raspbian-2017-04-10/

![](https://hackmd.io/_uploads/BJ-QFTxrh.png)

模擬操作系統 -> 模擬 Raspberrypi systems


Part 2 

Install operating systems kernel 

https://github.com/dhruvvyas90/qemu-rpi-kernel/blob/master/kernel-qemu-4.4.34-jessie
---


## Install QEMU

QEMU（quick Emulator）

允許了為一種架構編譯的程式在另外一種架構上面執行

![](https://hackmd.io/_uploads/SyyD5gZB3.png)


```
root@ubuntu:/home/user/Desktop/arm # sudo apt install qemu-system
```

## RUN Raspberrypi on the qume

Setting.sh

```
qemu-system-arm -kernel kernel-qemu-4.4.34-jessie -cpu arm1176 -m 256 -M versatilepb -serial stdio -append "root=/dev/sda2 rootfstype=ext4 rw" -hda 2017-04-10-raspbian-jessie.img -nic user,hostfwd=tcp::5022-:22 -no-reboot
```


cup -> arm1176

m -> virtual RAM (allocate memory size)

M -> Machine type 


-append "root=/dev/sda2 rootfstype=ext4 rw" -> 建立file systems

-hda 讓東西? 指向 raspberrypi

-nic user,hostfwd=tcp::5022-:22 -no-reboot -> 透過SSH 進入 我們虛擬的機器 port 5022 -> port 22



## Using ssh connect to  raspberry pi


![](https://hackmd.io/_uploads/rkE2BbGB2.png)

```
sudo service ssh start 
```


Ubuntu 登入
```
ssh pi@localhost -p 5022

```

password: raspberry 


# Print String to Terminal (On Raspberry pi)


```arm
.global _start 
_start:

	MOV R0,#1 @standard in -> out put on terminal
	LDR R1,=message @memory Address 
	LDR R2,=stringLen @data length
	MOV R7,#7 @tell to os system out put result on the screen
	SWI 0 @interrupt os systems 

	MOV R7,#1 @interrupte process 
	SWI 0     @interrupte os systems 

.data
message:
	.asciz "Meowhecker \n"
stringLen =.-message 
```


.asciz 會自動加上 控字符串 (類似 /0 符號) 
定義 他為一個string 

也可以寫成 .string 

## Main()

1. Define 讓 message 要寫到哪

2. 要有一個reference Address (找到欲輸出位置)

3. 定義 輸出長度

4. 告訴Computer 把 內容印到銀幕上 

## R7 Register

R7 -> 中斷process execute 讓 OS systems 接管執行 interrupt
    -4 輸出到Screen 上
    -1 ENd proccess
    
## SWI 
SWI 0 -> 中斷 OS Systems, Back to the process 


END process 
R7,#1  靠訴OS 中斷 process 
SWI 0 -> interrupt OS 


## Assamble --> Object code --> loader --> program --> process 
```
root@raspberrypi:/home/pi# as meowhecker.s -o meowhecker.o
root@raspberrypi:/home/pi# ld meowhecker.o -o meowhecker
root@raspberrypi:/home/pi# ./meowhecker 
Meowhecker 

```
as 組裝
ld -> loader 


# Debugging ARM programs with GDB


```
root@raspberrypi:/home/pi# gdb meowhecker
```

## Break point 

syntax 
```
break "lable"
```

我們可以設置break point 來分析 program

```
(gdb) break _start
Breakpoint 1 at 0x10074
```

## Run the Program


Aftter Setting break poing finished, we could run the program


```
(gdb) run
Starting program: /home/pi/meowhecker 

Breakpoint 1, 0x00010074 in _start ()

```


## layout 

We will through layout the know the program info 

打開GDB layout 

```
layout asm 
```

![](https://hackmd.io/_uploads/B1Loxa-vh.png)


Switch layout 
Noting : (ctrl + x)幹要先按 + o 可以切換Layout 

### Register

查看register 方法

Way 1 

```
(gdb) info register r0
r0             0x0      0
```


Way 2 

直接打開Register layout 

```
(gdb) layout regs
```

![](https://hackmd.io/_uploads/Hk_kfaWw3.png)

## Next Instruction 

![](https://hackmd.io/_uploads/SyKHEabP2.png)

Stack 中 Message Address 已經load 進去R1 Register 

![](https://hackmd.io/_uploads/ryMjV6WPh.png)


## Analysis Memory (查看stack)


查看 Stack Memory slot (32-bit)

Syntax
```
x/[memory slot數量xdcu ] [initial Address]
```

x -> 16
d -> 10
d -> char

16(hexadecimal)
message -> ascii 會看不出來在幹嘛

```
(gdb) x/10x $r1
0x20098:        0x776f654d      0x6b636568      0x0a207265      0x00134100
0x200a8:        0x65610000      0x00696261      0x00000901      0x08010600
0x200b8:        0x732e0001      0x61746d79

```

x -> exam (檢查)


```
(gdb) x/15c $r1
0x20098:        77 'M'  101 'e' 111 'o' 119 'w' 104 'h' 101 'e' 99 'c'  107 'k'

0x200a0:        101 'e' 114 'r' 32 ' '  10 '\n' 0 '\000'        65 'A'  19 '\02
3'

```

\000 -> null string


# Firmware Analysis & IoT Reverse Engineering


Reference
https://www.youtube.com/watch?v=zs86OYea8Wk

Target Firemware :**TP-Link TL-WR1042NDv1** (路由器)



## Download **TP-Link TL-WR1042NDv1**


```bash 
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis]
└─# wget http://www.tp-link.com/resources/software/TL-WR1042ND_V1_130923.zip

┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis]
└─# mv wr1042nv1_en_3_15_7_up_boot\(130923\).bin routerFirmware.bin         
                                                                                              
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis]
└─# ls
routerFirmware.bin  TL-WR1042ND_V1_130923.zip

```


## Analyzing the firmware


### file 

```
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis]
└─# file routerFirmware.bin                                 
routerFirmware.bin: firmware 1042 v1 TP-LINK Technologies ver. 1.0, version 3.15.7, 8258048 bytes or less, at 0x200 998400 bytes , at 0x100000 7077888 bytes 
```


## Binwalk (Automatic Reverse Tools)

Binwalk could be used to serach  binary file  
and extract the file systems or code 

- \- e Automatically extract important files.


```
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis]
└─# binwalk -e routerFirmware.bin --run-as=root

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             TP-Link firmware header, firmware version: 0.25336.3, image version: "", product ID: 0x0, product version: 272760833, kernel load address: 0x0, kernel entry point: 0x20000, kernel offset: 8258048, kernel length: 512, rootfs offset: 998400, rootfs length: 1048576, bootloader offset: 7077888, bootloader length: 0
5824          0x16C0          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 72992 bytes
131584        0x20200         TP-Link firmware header, firmware version: 0.0.3, image version: "", product ID: 0x0, product version: 272760833, kernel load address: 0x0, kernel entry point: 0x20000, kernel offset: 8126464, kernel length: 512, rootfs offset: 998400, rootfs length: 1048576, bootloader offset: 7077888, bootloader length: 0
142344        0x22C08         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3100784 bytes


....

WARNING: Symlink points outside of the extraction directory: /home/meowhecker/firmwareAnalysis/_routerFirmware.bin.extracted/squashfs-root/etc/passwd -> /tmp/passwd; changing link target to /dev/null for security purposes.
1180160       0x120200        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2722564 bytes, 763 inodes, blocksize: 131072 bytes, created: 2013-09-23 07:39:23


```

info
- TP-Link firmware header
- LZMA compressed data
- Squashfs 文件系統

1180160 0x120200 Squashfs 文件系統，little endian，版本 4.0，壓縮：lzma，大小：2722564 字節，763 個 inode，塊大小：131072 字節，創建時間：2013-09-23 07:39:23



## Access file systems

```
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis]
└─# cd _routerFirmware.bin.extracted 
                                                                                                
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis/_routerFirmware.bin.extracted]
└─# ls
120200.squashfs  16C0  16C0.7z  22C08  22C08.7z  squashfs-root
                                                                                                
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis/_routerFirmware.bin.extracted]
└─# cd squashfs-root                
                                                                                                
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis/_routerFirmware.bin.extracted/squashfs-root]
└─# ls
bin  dev  etc  home  init  lib  linuxrc  mnt  proc  sbin  sys  tmp  usr  var  web

```

透過進入file systems 可以研究 一些 Default setting 


e.g.

- Default credential
- Remote configuration (telnet, ssh )


```
┌──(root㉿Meowhecker)-[/home/…/firmwareAnalysis/_routerFirmware.bin.extracted/squashfs-root/etc]
└─# cat shadow   
root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
john --wordlist=/home/meowhecker/wordlists/rockyou.txt
```

## Enumerate File systems 

### / 

```
                                                                                                
┌──(root㉿Meowhecker)-[/home/meowhecker/firmwareAnalysis/_routerFirmware.bin.extracted/squashfs-root]
└─# ls -la
總用量 60
drwxrwxr-x 15  501  502 4096  9月 23  2013 .
drwxr-xr-x  3 root root 4096  6月 11 13:42 ..
drwxrwxr-x  2  501  502 4096  9月 23  2013 bin
drwxrwxr-x  5  501  502 4096  6月 11 13:42 dev
drwxrwxr-x  4  501  502 4096  6月 11 14:00 etc
drwxrwxr-x  2  501  502 4096  9月 23  2013 home
lrwxrwxrwx  1  501  502   11  9月 23  2013 init -> bin/busybox
drwxrwxr-x  3  501  502 4096  9月 23  2013 lib
lrwxrwxrwx  1  501  502   11  9月 23  2013 linuxrc -> bin/busybox
drwxrwxr-x  2  501  502 4096  9月 23  2013 mnt
drwxrwxr-x  2  501  502 4096  9月 23  2013 proc
drwxrwxr-x  2  501  502 4096  9月 23  2013 sbin
drwxrwxr-x  2  501  502 4096  9月 23  2013 sys
drwxrwxr-x  2  501  502 4096  9月 23  2013 tmp
drwxrwxr-x  5  501  502 4096  9月 23  2013 usr
drwxrwxr-x  2  501  502 4096  9月 23  2013 var
drwxrwxr-x  9  501  502 4096  9月 23  2013 web

```


lrwxrwxrwx  1  501  502   11  9月 23  2013 linuxrc -> bin/busybox

### Linuxrc
In embedded operating systems, /linuxrc is commonly designated as the init process.



### /bin 

```
┌──(root㉿Meowhecker)-[/home/…/firmwareAnalysis/_routerFirmware.bin.extracted/squashfs-root/bin]
└─# ls
acltd    chmod  egrep   grep  iptables   iwpriv  ls       ob   ping  setmib  true
auth     date   false   iapp  irf        kill    mount    od   ps    sh      umount
busybox  df     fgrep   ib    iw         lld2d   msh      orf  rm    sleep   wscd
cat      echo   getmib  idd   iwcontrol  login   ntfs-3g  ow   rssi  tc

```