Can't execute any MIPS binary

[Matteo Croce <rootkit85@yahoo.it>]

Hi,
I have a machine, an AR7 MIPS router I want to hack, but I'm unable
to run _any_ executable on that machine outside the ones in the firmware.
I tried building a static mips1 binary, but it fails so:

# /var/test.bin
/var/test.bin: 1: Syntax error: "(" unexpected

so I downloaded a binary builtin in the firmware and I compared it to my own:

$ file busybox.bin test.bin
busybox.bin: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), stripped
test.bin:    ELF 32-bit LSB executable, MIPS, version 1 (SYSV), statically linked, stripped

busybox.bin is the builtin busybox while test.bin is a static HelloWorld

I ran readelf on it:

$ readelf -h busybox.bin
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x4037e0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          337304 (bytes into file)
  Flags:                             0x5, noreorder, cpic, mips1
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         6
  Size of section headers:           40 (bytes)
  Number of section headers:         21
  Section header string table index: 20
$ readelf -h test.bin
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x400140
  Start of program headers:          52 (bytes into file)
  Start of section headers:          11780 (bytes into file)
  Flags:                             0x50001007, noreorder, pic, cpic, o32, mips32
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         3
  Size of section headers:           40 (bytes)
  Number of section headers:         17
  Section header string table index: 16
$ diff -u <(readelf -h busybox.bin) <(readelf -h test.bin)
--- /dev/fd/63  2008-02-13 00:26:48.880261477 +0100
+++ /dev/fd/62  2008-02-13 00:26:48.880261477 +0100
@@ -8,13 +8,13 @@
   Type:                              EXEC (Executable file)
   Machine:                           MIPS R3000
   Version:                           0x1
-  Entry point address:               0x4037e0
+  Entry point address:               0x400140
   Start of program headers:          52 (bytes into file)
-  Start of section headers:          337304 (bytes into file)
-  Flags:                             0x5, noreorder, cpic, mips1
+  Start of section headers:          11780 (bytes into file)
+  Flags:                             0x50001007, noreorder, pic, cpic, o32, mips32
   Size of this header:               52 (bytes)
   Size of program headers:           32 (bytes)
-  Number of program headers:         6
+  Number of program headers:         3
   Size of section headers:           40 (bytes)
-  Number of section headers:         21
-  Section header string table index: 20
+  Number of section headers:         17
+  Section header string table index: 16

The router firmware uses:
# cat /proc/version
Linux version 2.4.17_mvl21-malta-mips_fp_le (root@localhost.localdomain) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Fri Mar 18 11:00:12 EST 2005

While I have a gcc-4.2.3 toolchain with 2.6.24 headers.


How can I build a mips1 binary instead of the mips32 I make? Can I disable o32?

Best Regards,
Matteo Croce