The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository.
Another option could be to dump the flash and analyze it.
I'm not sure how much of a spoiler you want, so I'll keep it fairly short for now.
The buffer is too short
Your main problem is somewhat a hint towards the solution. The logic is, if your buffer is too small, then make a new one that can fit your entire payload.
By this, I mean you need to set up a stack pivot. A stack pivot allows you to move the stack ...
A simpler way, since you have the firmware image, is to chroot into the device's root file system (e.g. # chroot path/to/firmware /bin/sh). This will alleviate any dynamic loading issues that may be tedious to fix.
The only requirement is that you have the qemu binary installed for the correct architecture.
It is possible that the address is relocated.
The relocation table, typically named .reloc contains address "translations" for the loader, placing bytes in file offsets in different addresses in runtime.
Yes, this is called Position Independent Executable (PIE). It randomizes the base address of the executable. It is enabled by default nowadays in most cases by gcc/the linker.
There are several ways to statically determine whether a binary is built with PIE. One method is to use file; a PIE binary reports "shared object" (since that's what it is) compared ...
Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to figure out how to unpack/pack the image manually (maybe the verbose option will provide more info on the steps taken). I realize this is a generic sounding answer, ...
I recommend to use IDA for this task but you can try something other. There are dozens of disassemblers.
Open your app in the disassebmler, locate something like that:
Scroll up and find XRef with 'qt_metacast(char const*)' (in case the binary is not stripped):
.rodata:00069B90 aMainwindow_0 db 'MainWindow',0 ; DATA XREF: MainWindow::qt_metacast(...