Reverse engineering · Firmware · Emulation
NETGEAR firmware emulation
A local ARM environment for taking router firmware apart, reproducing its runtime assumptions, and debugging its binaries with familiar desktop tools.
- Status
- Active investigation
- Started
- March 2025
- Role
- Firmware extraction, emulation and reverse engineering
Project outline
Moving router debugging onto the workstation
Embedded firmware is difficult to inspect when every experiment depends on opaque packaging, unfamiliar hardware, and services that expect an entire router around them. This project builds a repeatable host-side environment for NETGEAR firmware so individual programs can be observed and changed without using the router as the only test bench.
From firmware image to ARM userspace
The workflow uses Binwalk and UBI tooling to locate and extract the filesystem from a firmware image. QEMU user-mode emulation and Linux binary-format support then make it possible to enter the ARM filesystem with a chroot and run its executables from an x86 Linux host.
Recreating the missing system
Extracted applications still assume device nodes, mounted filesystems, configuration data, a serial console, and router-specific services. Shell tooling prepares mounts and startup state, while a small C shim supplies selected firmware behaviours so more of the original userspace can run in isolation.
Making closed binaries observable
GDB and GEF launchers support live debugging under emulation. Ghidra helpers, binary-search utilities, rebuild scripts, and cross-compilation tooling shorten the loop between static analysis, a firmware modification, and the next controlled run.