I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware of embedded devices using QEMU using the extracted image file. At this moment, I've been trying multiple time using something like:qemu-system-arm -machine versatilepb -m 128M -option-rom MspApp.bin However, in every case, I end up with a similar crash:R00=00000000 R01=00000000 R02=00000000 R03=00000000R04=00000000 R05=00000000 R06=00000000 R07=00000000R08=00000000 R09=00000000 R10=00000000 R11=00000000R12=00000000 R13=00000000 R14=00000000 R15=08000000PSR=400001d3 -Z-- A svc32s00=00000000 s01=00000000 d00=0000000000000000s02=00000000 s03=00000000 d01=0000000000000000s04=00000000 s05=00000000 d02=0000000000000000s06=00000000 s07=00000000 d03=0000000000000000s08=00000000 s09=00000000 d04=0000000000000000s10=00000000 s11=00000000 d05=0000000000000000s12=00000000 s13=00000000 d06=0000000000000000s14=00000000 s15=00000000 d07=0000000000000000s16=00000000 s17=00000000 d08=0000000000000000s18=00000000 s19=00000000 d09=0000000000000000s20=00000000 s21=00000000 d10=0000000000000000s22=00000000 s23=00000000 d11=0000000000000000s24=00000000 s25=00000000 d12=0000000000000000s26=00000000 s27=00000000 d13=0000000000000000s28=00000000 s29=00000000 d14=0000000000000000s30=00000000 s31=00000000 d15=0000000000000000FPSCR: 00000000AbortedUnderstanding that the execution won't go very far given that I do not emulate any of the required hardware - a problem for later - I would a least like to have the device boot up.Currently, I've been trying on a firmware for pool automation, which from the static analysis reveals that it runs on Nucleus RTOS on a i.MX28 board from NXP, based on ARM9. The firmware is composed of two files, one appears to contain the OS, a set of XML files - likely used for the user interface - and possibly a U-boot bootloader. All of these components are in the MspApp.bin file, which I assume is the ROM image.So my questions are: 1) is it possible to partially emulate embedded devices from firmware ROM images using QEMU and if so 2) what information/commands/modification would I need to have QEMU partially emulate the extracted firmware?
Emulating Non-Linux Firmware Image of Embedded Devices
firmware;embedded;qemu
It is possible, but emulating the raw .bin file is almost never going to work unless it's laid out exactly like the QEMU platform you're using expects.  If the binary you want to run is statically-linked and is in a binary format that QEMU knows, you may be able to use QEMU user mode to run it, but you'll need to extract it from your binary image.  Binwalk may be very useful for that.  The bootloader is probably a good candidate for user-mode emulation, or again, anything in the filesystem that is statically-linked.  A good guide is here: QEMU usermode, howto.For anything that's dynamically linked and depends on the Nucleus RTOS, you'll likely have to hack on QEMU for the OS support.  That could be a timely undertaking.  If you know the memory layout and where everything in MspApp.bin is loaded to start up, you might be able to make some forward progress using the Unicorn Framework (sorry, don't yet have enough rep to post more than 2 links), although you will very quickly run into issues where the board-specific hardware isn't modeled which can quickly lead you down the rabbit hole.Good luck, embedded system emulation is a frustrating but rewarding undertaking.  Regardless of whether you get it working or not, you will have learned a lot by the time you're done.