Unable to boot ARM disk image

Question

I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here).

I was able to extract the contents of the image using binwalk, however I'd wish to test some executable in a "live" situation. In order to do that I tried to use QEMU.

Sadly, no matter what, I'm getting a system crash.
I started with:

$ qemu-system-arm -M vexpress-a9 -hda R8300-V1.0.2.100_1.0.82.chk 
Warning: Orphaned drive without device: id=scsi0-hd0,file=R8300-V1.0.2.100_1.0.82.chk,if=scsi,bus=0,unit=0
qemu: fatal: Trying to execute code outside RAM or ROM at 0x04000000

As far as I can understand QEMU has a driver but he doesn't know what do to with that. So I tried to specify more params manually:

qemu-system-arm -M vexpress-a9 \
   -drive file=R8300-V1.0.2.100_1.0.82.chk,format=raw \
   -device scsi-hd,id=scsi0-hd0

qemu-system-arm: -device scsi-hd,id=scsi0-hd0: No 'SCSI' bus found for device 'scsi-hd'

I tried to play with some different device type, but it seems that I can't find the correct bus.
I even tried to split the image into different pieces (kernel and filesystem), but I still got a crash.

I'm pretty new to reverse engineering, can I have some hints or suggestions on what should I do to boot my firmware image?

EDIT. Playing a little with the command I was able to get a different error message:

$ qemu-system-arm -M vexpress-a9 -cpu cortex-a9 \
   -redir tcp:8888::80 -m 512 \
   -drive file=R8300V1.0.2.100_1.0.82.chk,format=raw \
   -device scsi id=scsi0-hd0,if=ide-hd

qemu-system-arm: -device scsi: drive with bus=0, unit=0 (index=0) exists  

I tried to specify a different bus, unit and index, but the error is still the same

Answer 1

I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g 10000 ./myTargetBinary.

See slides 27+ in my presentation https://files.sans.org/summit/hackfest2015/PDFs/IoT-Devices-Fall-Like-Backward-Capacitors-Or-the-Month-Josh-Was-Forced-to-Wear-Pants-Josh-Wright.pdf. You may need to setup the appropriate chroot for the necessary libraries in myTargetBinary. Often, errors in running a binary requires more analysis to identify missing conf files, necessary environment variables, specific hardware access, etc., requiring some preliminary static disassembly prior to runtime analysis.