I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware of embedded devices using QEMU using the extracted image file.

At this moment, I've been trying multiple time using something like:

qemu-system-arm -machine versatilepb -m 128M -option-rom MspApp.bin 

However, in every case, I end up with a similar crash:

R00=00000000 R01=00000000 R02=00000000 R03=00000000
R04=00000000 R05=00000000 R06=00000000 R07=00000000
R08=00000000 R09=00000000 R10=00000000 R11=00000000
R12=00000000 R13=00000000 R14=00000000 R15=08000000
PSR=400001d3 -Z-- A svc32
s00=00000000 s01=00000000 d00=0000000000000000
s02=00000000 s03=00000000 d01=0000000000000000
s04=00000000 s05=00000000 d02=0000000000000000
s06=00000000 s07=00000000 d03=0000000000000000
s08=00000000 s09=00000000 d04=0000000000000000
s10=00000000 s11=00000000 d05=0000000000000000
s12=00000000 s13=00000000 d06=0000000000000000
s14=00000000 s15=00000000 d07=0000000000000000
s16=00000000 s17=00000000 d08=0000000000000000
s18=00000000 s19=00000000 d09=0000000000000000
s20=00000000 s21=00000000 d10=0000000000000000
s22=00000000 s23=00000000 d11=0000000000000000
s24=00000000 s25=00000000 d12=0000000000000000
s26=00000000 s27=00000000 d13=0000000000000000
s28=00000000 s29=00000000 d14=0000000000000000
s30=00000000 s31=00000000 d15=0000000000000000
FPSCR: 00000000
Aborted

Understanding that the execution won't go very far given that I do not emulate any of the required hardware - another problem for later - I would a least like to have the device boot up.

Currently, I've been trying on a firmware for pool automation, which from the static analysis reveals that it runs on Nucleus RTOS on a i.MX28 board from NXP, based on ARM9.

So my question is 1) is it possible to emulate firmware from embedded devices from QEMU and if so 2) what information/commands/modification would I need to have QEMU partially emulate the extracted firmware?

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware of embedded devices using QEMU using the extracted image file.

At this moment, I've been trying multiple time using something like:

qemu-system-arm -machine versatilepb -m 128M -option-rom MspApp.bin 

However, in every case, I end up with a similar crash:

R00=00000000 R01=00000000 R02=00000000 R03=00000000
R04=00000000 R05=00000000 R06=00000000 R07=00000000
R08=00000000 R09=00000000 R10=00000000 R11=00000000
R12=00000000 R13=00000000 R14=00000000 R15=08000000
PSR=400001d3 -Z-- A svc32
s00=00000000 s01=00000000 d00=0000000000000000
s02=00000000 s03=00000000 d01=0000000000000000
s04=00000000 s05=00000000 d02=0000000000000000
s06=00000000 s07=00000000 d03=0000000000000000
s08=00000000 s09=00000000 d04=0000000000000000
s10=00000000 s11=00000000 d05=0000000000000000
s12=00000000 s13=00000000 d06=0000000000000000
s14=00000000 s15=00000000 d07=0000000000000000
s16=00000000 s17=00000000 d08=0000000000000000
s18=00000000 s19=00000000 d09=0000000000000000
s20=00000000 s21=00000000 d10=0000000000000000
s22=00000000 s23=00000000 d11=0000000000000000
s24=00000000 s25=00000000 d12=0000000000000000
s26=00000000 s27=00000000 d13=0000000000000000
s28=00000000 s29=00000000 d14=0000000000000000
s30=00000000 s31=00000000 d15=0000000000000000
FPSCR: 00000000
Aborted

Understanding that the execution won't go very far given that I do not emulate any of the required hardware - a problem for later - I would a least like to have the device boot up.

Currently, I've been trying on a firmware for pool automation, which from the static analysis reveals that it runs on Nucleus RTOS on a i.MX28 board from NXP, based on ARM9. The firmware is composed of two files, one appears to contain the OS, a set of XML files - likely used for the user interface - and possibly a U-boot bootloader. All of these components are in the MspApp.bin file, which I assume is the ROM image.

So my questions are: 1) is it possible to partially emulate embedded devices from firmware ROM images using QEMU and if so 2) what information/commands/modification would I need to have QEMU partially emulate the extracted firmware?