Emulation, PowerPC, and Transition

The talk starts with why full-system emulation helps with reverse engineering and debugging bare-metal embedded systems, where hardware debuggers can be slow or limited. It explains that PowerPC remains common in automotive and aerospace equipment, and that open-source emulators of the time lacked support for newer PowerPC features such as variable-length encoding and vendor-specific floating point and vector instructions. The work sat inside a DARPA program on binary lifting, patching and assurance, where the team had to test tools against a real engine controller.

The middle of the talk covers building the framework in Python on top of the vivisect toolkit. Peripherals were added in stages, beginning with a watchdog timer, system integration and clock setup, then flash memory, interrupts, DMA and several analog and bus peripherals. Firmware was extracted from a physical board so the emulator's behavior could be checked against hardware. One flash-related problem left the emulated image marked as bad, which showed how a small state mismatch can derail an entire run. A demo showed the emulator executing firmware while it transmitted messages, and a remote GDB server allowed a debugger to attach.

Personal history about the speaker's transition is woven through the technical timeline. The closing takeaway is that building your own tool can deepen your understanding of a target and suit how you approach problems. The framework is moving toward a generic bare-metal emulator, with the remaining work mostly refinement.