Emulating Non-Linux Firmware Image of Embedded Devices

Question

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware of embedded devices using QEMU using the extracted image file.

At this moment, I've been trying multiple time using something like:

qemu-system-arm -machine versatilepb -m 128M -option-rom MspApp.bin 

However, in every case, I end up with a similar crash:

R00=00000000 R01=00000000 R02=00000000 R03=00000000
R04=00000000 R05=00000000 R06=00000000 R07=00000000
R08=00000000 R09=00000000 R10=00000000 R11=00000000
R12=00000000 R13=00000000 R14=00000000 R15=08000000
PSR=400001d3 -Z-- A svc32
s00=00000000 s01=00000000 d00=0000000000000000
s02=00000000 s03=00000000 d01=0000000000000000
s04=00000000 s05=00000000 d02=0000000000000000
s06=00000000 s07=00000000 d03=0000000000000000
s08=00000000 s09=00000000 d04=0000000000000000
s10=00000000 s11=00000000 d05=0000000000000000
s12=00000000 s13=00000000 d06=0000000000000000
s14=00000000 s15=00000000 d07=0000000000000000
s16=00000000 s17=00000000 d08=0000000000000000
s18=00000000 s19=00000000 d09=0000000000000000
s20=00000000 s21=00000000 d10=0000000000000000
s22=00000000 s23=00000000 d11=0000000000000000
s24=00000000 s25=00000000 d12=0000000000000000
s26=00000000 s27=00000000 d13=0000000000000000
s28=00000000 s29=00000000 d14=0000000000000000
s30=00000000 s31=00000000 d15=0000000000000000
FPSCR: 00000000
Aborted

Understanding that the execution won't go very far given that I do not emulate any of the required hardware - a problem for later - I would a least like to have the device boot up.

Currently, I've been trying on a firmware for pool automation, which from the static analysis reveals that it runs on Nucleus RTOS on a i.MX28 board from NXP, based on ARM9. The firmware is composed of two files, one appears to contain the OS, a set of XML files - likely used for the user interface - and possibly a U-boot bootloader. All of these components are in the MspApp.bin file, which I assume is the ROM image.

So my questions are: 1) is it possible to partially emulate embedded devices from firmware ROM images using QEMU and if so 2) what information/commands/modification would I need to have QEMU partially emulate the extracted firmware?

Answer 1

It is possible, but emulating the raw .bin file is almost never going to work unless it's laid out exactly like the QEMU platform you're using expects. If the binary you want to run is statically-linked and is in a binary format that QEMU knows, you may be able to use QEMU user mode to run it, but you'll need to extract it from your binary image. Binwalk may be very useful for that. The bootloader is probably a good candidate for user-mode emulation, or again, anything in the filesystem that is statically-linked. A good guide is here: QEMU usermode, howto.

For anything that's dynamically linked and depends on the Nucleus RTOS, you'll likely have to hack on QEMU for the OS support. That could be a timely undertaking. If you know the memory layout and where everything in MspApp.bin is loaded to start up, you might be able to make some forward progress using the Unicorn Framework (sorry, don't yet have enough rep to post more than 2 links), although you will very quickly run into issues where the board-specific hardware isn't modeled which can quickly lead you down the rabbit hole.

Good luck, embedded system emulation is a frustrating but rewarding undertaking. Regardless of whether you get it working or not, you will have learned a lot by the time you're done.