M33mu – Cortex-M33 emulation with TrustZone, reverse stepping, and GDB

I’ve been building m33mu, a Cortex-M33 emulator for running and debugging ARMv8-M firmware on a regular host machine.

The main reason I started it was that I wanted a tighter loop for firmware work than “flash board, reproduce bug, attach debugger, repeat”, especially for TrustZone-related behavior where secure/non-secure transitions are part of the problem.

m33mu can run firmware images directly on the host, has a built-in GDB remote server, supports multiple images for secure/non-secure setups, and has a terminal UI for inspecting execution state. One phase I care about a lot is facilitating my debugging sessions, so I also added execution recording for reverse stepping and call-trace support.

It emulates eleven different microcontrollers, covering extended SPI bus with plugins, Ethernet via tap or VDE, USB (MCU is device side, connected to real host) via GadgetFS backend

Although early, it is already usable today and I’m using it in interactive debug sessions (TUI), automated scripts and even in GitHub Actions of other projects, to boot and test real firmware images in the cloud and replace Hardware-in-the-loop in automated tests.

I’d really like feedback from people who work on embedded firmware, emulators, debuggers, or TrustZone-enabled systems.