I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here).
I was able to extract the contents of the image using
binwalk, however I'd wish to test some executable in a "live" situation. In order to do that I tried to use QEMU.
Sadly, no matter what, I'm getting a system crash.
I started with:
$ qemu-system-arm -M vexpress-a9 -hda R8300-V184.108.40.206_1.0.82.chk Warning: Orphaned drive without device: id=scsi0-hd0,file=R8300-V220.127.116.11_1.0.82.chk,if=scsi,bus=0,unit=0 qemu: fatal: Trying to execute code outside RAM or ROM at 0x04000000
As far as I can understand QEMU has a driver but he doesn't know what do to with that. So I tried to specify more params manually:
qemu-system-arm -M vexpress-a9 \ -drive file=R8300-V18.104.22.168_1.0.82.chk,format=raw \ -device scsi-hd,id=scsi0-hd0 qemu-system-arm: -device scsi-hd,id=scsi0-hd0: No 'SCSI' bus found for device 'scsi-hd'
I tried to play with some different device type, but it seems that I can't find the correct bus.
I even tried to split the image into different pieces (kernel and filesystem), but I still got a crash.
I'm pretty new to reverse engineering, can I have some hints or suggestions on what should I do to boot my firmware image?
EDIT. Playing a little with the command I was able to get a different error message:
$ qemu-system-arm -M vexpress-a9 -cpu cortex-a9 \ -redir tcp:8888::80 -m 512 \ -drive file=R8300V22.214.171.124_1.0.82.chk,format=raw \ -device scsi id=scsi0-hd0,if=ide-hd qemu-system-arm: -device scsi: drive with bus=0, unit=0 (index=0) exists
I tried to specify a different bus, unit and index, but the error is still the same