I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here).

I was able to extract the contents of the image using binwalk, however I'd wish to test some executable in a "live" situation. In order to do that I tried to use QEMU.

Sadly, no matter what, I'm getting a system crash.
I started with:

$ qemu-system-arm -M vexpress-a9 -hda R8300-V1.0.2.100_1.0.82.chk 
Warning: Orphaned drive without device: id=scsi0-hd0,file=R8300-V1.0.2.100_1.0.82.chk,if=scsi,bus=0,unit=0
qemu: fatal: Trying to execute code outside RAM or ROM at 0x04000000

As far as I can understand QEMU has a driver but he doesn't know what do to with that. So I tried to specify more params manually:

qemu-system-arm -M vexpress-a9 \
   -drive file=R8300-V1.0.2.100_1.0.82.chk,format=raw \
   -device scsi-hd,id=scsi0-hd0

qemu-system-arm: -device scsi-hd,id=scsi0-hd0: No 'SCSI' bus found for device 'scsi-hd'

I tried to play with some different device type, but it seems that I can't find the correct bus.
I even tried to split the image into different pieces (kernel and filesystem), but I still got a crash.

I'm pretty new to reverse engineering, can I have some hints or suggestions on what should I do to boot my firmware image?

EDIT. Playing a little with the command I was able to get a different error message:

$ qemu-system-arm -M vexpress-a9 -cpu cortex-a9 \
   -redir tcp:8888::80 -m 512 \
   -drive file=R8300V1.0.2.100_1.0.82.chk,format=raw \
   -device scsi id=scsi0-hd0,if=ide-hd

qemu-system-arm: -device scsi: drive with bus=0, unit=0 (index=0) exists  

I tried to specify a different bus, unit and index, but the error is still the same


1 Answer 1


I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g 10000 ./myTargetBinary.

See slides 27+ in my presentation https://files.sans.org/summit/hackfest2015/PDFs/IoT-Devices-Fall-Like-Backward-Capacitors-Or-the-Month-Josh-Was-Forced-to-Wear-Pants-Josh-Wright.pdf. You may need to setup the appropriate chroot for the necessary libraries in myTargetBinary. Often, errors in running a binary requires more analysis to identify missing conf files, necessary environment variables, specific hardware access, etc., requiring some preliminary static disassembly prior to runtime analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.