I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware of embedded devices using QEMU using the extracted image file. 

At this moment, I've been trying multiple time using something like:

    qemu-system-arm -machine versatilepb -m 128M -option-rom MspApp.bin 

However, in every case, I end up with a similar crash:

    R00=00000000 R01=00000000 R02=00000000 R03=00000000
    R04=00000000 R05=00000000 R06=00000000 R07=00000000
    R08=00000000 R09=00000000 R10=00000000 R11=00000000
    R12=00000000 R13=00000000 R14=00000000 R15=08000000
    PSR=400001d3 -Z-- A svc32
    s00=00000000 s01=00000000 d00=0000000000000000
    s02=00000000 s03=00000000 d01=0000000000000000
    s04=00000000 s05=00000000 d02=0000000000000000
    s06=00000000 s07=00000000 d03=0000000000000000
    s08=00000000 s09=00000000 d04=0000000000000000
    s10=00000000 s11=00000000 d05=0000000000000000
    s12=00000000 s13=00000000 d06=0000000000000000
    s14=00000000 s15=00000000 d07=0000000000000000
    s16=00000000 s17=00000000 d08=0000000000000000
    s18=00000000 s19=00000000 d09=0000000000000000
    s20=00000000 s21=00000000 d10=0000000000000000
    s22=00000000 s23=00000000 d11=0000000000000000
    s24=00000000 s25=00000000 d12=0000000000000000
    s26=00000000 s27=00000000 d13=0000000000000000
    s28=00000000 s29=00000000 d14=0000000000000000
    s30=00000000 s31=00000000 d15=0000000000000000
    FPSCR: 00000000
    Aborted

Understanding that the execution won't go very far given that I do not emulate any of the required hardware - a problem for later - I would a least like to have the device boot up.

Currently, I've been trying on a firmware for pool automation, which from the static analysis reveals that it runs on [Nucleus RTOS][1] on a [i.MX28 board][2] from NXP, based on ARM9. The firmware is composed of two files, one appears to contain the OS, a set of XML files - likely used for the user interface - and possibly a U-boot bootloader. All of these components are in the *MspApp.bin* file, which I assume is the ROM image.

So my questions are: 1) is it possible to partially emulate embedded devices from firmware ROM images using QEMU and if so 2) what information/commands/modification would I need to have QEMU partially emulate the extracted firmware?

  [1]: https://www.mentor.com/embedded-software/nucleus/
  [2]: http://www.nxp.com/products/microcontrollers-and-processors/arm-processors/i.mx-applications-processors/i.mx28-applications-processors-integrated-power-management-unit-pmu-arm9-core:IMX28_FAMILY