Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

Question

I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it.

I am wondering if there are any emulators that are capable of running a flash dump directly that targets the same architecture on the device it was dumped from? So for instance, if the dump was taken from a device(via JTAG) running a Broadcom MIPS CPU, and it contained the entire system(bootloader, firmware, filesystem, NVRAM, etc.) is there anything where I could mount(or should I say, load it into memory) the raw image directly, memory and all, and run it, similar to how I could flash it onto a different device with the same chip?

I have been looking into different software such as OVPsim(which is a "full system simulator" and Qemu, though I am unsure if they can run the full dump directly.

Can anyone shed some light on this, it can be confusing looking at everything.

Answer 1

In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for both the SOC you're dealing with and the hardware board you're going to have to reverse engineer the firmware of the device. This will allow you to figure out how the software expects the hardware to behave. As QEMU has MIPS support, you can then make QEMU emulate said peripherals. The mode you're after under QEMU is called system emulation. The combination of peripherals is generally referred to as a board. You need to set up a board which matches the device you took the dump from or one which is at least compatible with the support compiled into the boot loaders and kernel. Hopefully you're dealing with some Linux based system and the manufacturer is GPL compliant so that you can download the source code of the software running on the device.

Figuring out everything in order to create an emulated environment that can boot your entire image can be a lot of work. I would say we could be talking years of reverse engineering and implementation work depending on what level of documentation you have available.

There are companies that specialize in creating this sort of emulation environment, such as Lauterbach. Setting up an environment using commercially available tools can be very expensive.

TL;DR This is going to be a lot of work and is probably not worth it. You may want to look into using a small subset of your image instead. Such as maybe the data partitions and not the full kernel.