After gaining root access to the device in the first post of this series, we will have a closer look at the device and its firmware.

This post is documenting some internals of the device which is not the most exciting stuff to read. I mainly collected it here for documentation purposes.

All information in this post has been collected from a device running firmware version NTGX55_12.04.12.00.

Netgear’s firmware is Linux-based and uses quite a lot of common open-source tools. They provide all modifications to GPL licensed code via their support area: NETGEAR Open Source Software for Programmers.

From what I can tell only their user interface and configuration management is developed by Netgear themself apart from a bunch of binary blobs provided by Qualcomm which contains the modem firmware which gets loaded to the baseband processor.

One curiosity caught my eye: there is a running X server on the device. It is used by the front-panel display of the device. A custom application developed by Netgear uses Webkit’s engine to render the touch screen interface which just like the web UI is based on HTML and Javascript.

Here is an almost complete list of open source software components which I found on the device:

• atk (v2.28)
• Avahi (v0.7)
• bash (v4.4.23)
• base-files (v3.0.14)
• BusyBox (v1.29.3)
• conntrack-tools (v1.0.1)
• D-Bus (v1.12.10)
• ddclient (v3.8.1)
• dhcpcd (v5.2.10)
• DiG (v9.11.5-P4)
• Dnsmasq (v2.85)
• ethtool (v4.19)
• font-config (v2.12.6)
• freetype (v2.9.1)
• glib (v2.58.0)
• hostapd (v2.8-devel)
• iproute2 (iproute2-ss140804)
• iptables (v1.6.2)
• iw (v4.14)
• libcap (v2.25)
• libnfnetlink (v1.0.0)
• Linux Kernel (v4.14.117)
• miniupnpd
• mtd-utils (v2.0.2)
• nettle (v3.4)
• OpenSSL (v1.1.1b)
• pimd (v2.1.8)
• pppd (v2.4.7)
• strace (v4.24)
• SystemD (v239)
• tinyproxy (v1.8.3)
• util-linux (v2.32.1)
• wireless-tools (v30)
• wpa_supplicant (v2.9)
• Xorg (v1.20.1)
• xz (v5.2.4)

Lets first have a look at the Kernel version:

$ uname -aLinux sdxprairie 4.14.117 #1 PREEMPT Thu Aug 19 23:42:26 UTC 2021 armv7l GNU/Linux/ # cat /proc/versionLinux version 4.14.117 (oe-user@oe-host) (clang version 6.0.9 for Android NDK) #1 PREEMPT Thu Aug 19 23:42:26 UTC 2021

Apparently the firmware has been built by Open Embedded as indicated by the kernel notice “oe-user”.

There is also a /target file lying around. I assume that “sdxprairie” is Qualcomm’s name for the SDK / BSP which is used by Netgear.

$ cat /targetsdxprairie

The application processor of the Snapdragon X55 is a fairly low powered single-core ARM v7:

$ cat /proc/cpuinfoprocessor       : 0model name      : ARMv7 Processor rev 5 (v7l)BogoMIPS        : 38.40Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrmCPU implementer : 0x41CPU architecture: 7CPU variant     : 0x0CPU part        : 0xc07CPU revision    : 5Hardware        : Qualcomm Technologies, Inc SDXPRAIRIERevision        : 0000Serial          : 0000000000000000

With around 780 MB of RAM:

$ free -m             total       used       free     shared    buffers     cachedMem:           781        387        393          0          0        142-/+ buffers/cache:        245        535Swap:          109          0        109

Within the SysFS we can find some details about the SoC. More details about the meaning can be found in the Kernel documentation:

SysFS Entry	Value
/sys/devices/soc0/accessory_chip	0
/sys/devices/soc0/chip_family	0x5e
/sys/devices/soc0/chip_name	SDX55
/sys/devices/soc0/family	Snapdragon
/sys/devices/soc0/foundry_id	1
/sys/devices/soc0/hw_platform	MTP
/sys/devices/soc0/image_crm_version	:ntgrbc-fwbuild6
/sys/devices/soc0/image_variant	MAATANAZA
/sys/devices/soc0/image_version	00:BOOT.SBL.4.1-00231
/sys/devices/soc0/machine	SDXPRAIRIE
/sys/devices/soc0/ncluster_array_offset	0xb0
/sys/devices/soc0/ndefective_parts_array_offset	0xb4
/sys/devices/soc0/nmodem_supported	0xffffffff
/sys/devices/soc0/nproduct_id	0x410
/sys/devices/soc0/num_clusters	0x1
/sys/devices/soc0/num_defective_parts	0xd
/sys/devices/soc0/platform_subtype	Invalid
/sys/devices/soc0/platform_subtype_id	5
/sys/devices/soc0/platform_version	65536
/sys/devices/soc0/pmic_die_revision	131072
/sys/devices/soc0/pmic_model	65568
/sys/devices/soc0/raw_device_family	0x6
/sys/devices/soc0/raw_device_number	0xb
/sys/devices/soc0/raw_id	207
/sys/devices/soc0/raw_version	2
/sys/devices/soc0/revision	2.0
/sys/devices/soc0/select_image	0
/sys/devices/soc0/serial_number	27453XXXX
/sys/devices/soc0/soc_id	357
/sys/devices/soc0/vendor	Qualcomm

$ cat /sys/devices/soc0/images0:        CRM:            00:BOOT.SBL.4.1-00231        Variant:        MAATANAZA        Version:        :ntgrbc-fwbuild61:        CRM:            01:TZ.FU.5.9-00147        Variant:        EATAANBAA        Version:        :CRM11:        CRM:            11:MPSS.HI.2.0.c3.5-00010-SDX55_CPEALL_PACK-1.403198.3        Variant:        sdx55.gennatch.prod        Version:        :ntgrbc-fwbuild6

Kernel command line

Section titled “Kernel command line”

$ cat /proc/cmdlinenoinitrd rw rootwait console=ttyMSM0,115200,n8 androidboot.hardware=qcom msm_rtb.filter=0x237 androidboot.console=ttyMSM0 lpm_levels.sleep_disabled=1 firmware_class.path=/lib/firmware/updates service_locator.enable=1 net.ifnames=0 atlantic_fwd.rx_ring_size=1024 pci=pcie_bus_perf rootfstype=ubifs rootflags=bulk_read root=ubi0:rootfs ubi.mtd=24 androidboot.serialno=105d0dc7 androidboot.baseband=msm

Unfortunately, I was not able to capture early kernel log messages. I assume those are only printed via a serial port and lost as the circular buffer for the kernel log has not been set up.

• Full log: /stv0g/netgear-nighthawk-mobile/reveng/dmesg.txt

• Network interfaces: /stv0g/netgear-nighthawk-mobile/reveng/interfaces.txt (ip address show)

• Devices: /stv0g/netgear-nighthawk-mobile/reveng/devices.txt (ls -l /dev)

• Kernel modules: /stv0g/netgear-nighthawk-mobile/reveng/modules.txt (lsmod)

• Running processes: /stv0g/netgear-nighthawk-mobile/reveng/processes.txt (ps aux)

• Mounted filesystems: /stv0g/netgear-nighthawk-mobile/reveng/mounts.txt (mount)

• Flash partitions: /stv0g/netgear-nighthawk-mobile/reveng/mtd.txt (cat /proc/mtd)

• Open ports: /stv0g/netgear-nighthawk-mobile/reveng/ports.txt (netstat -plnt)

• Ubi devices & volumes: /stv0g/netgear-nighthawk-mobile/reveng/ubinfo.txt (ubinfo -a)

• Kernel config: /stv0g/netgear-nighthawk-mobile/reveng/config.txt (zcat /proc/config.gz)

• Devicetree source: /stv0g/netgear-nighthawk-mobile/reveng/device-tree.dts (dtc -I fs -O dts /proc/device-tree)

Feel free to contact me if I missed any particular detail which is interesting to you.