How to emulate Windows RT

Question

How can I run Windows RT (the restricted ARM version of Windows 8) in an emulator, for development purposes? This question contains two parts:

• Obtaining the image: Does an installation image exist (for vendors, in MSDN, ...)? Can I take a snapshot of the Surface RT disk (how?), or can I extract it somehow from recovery data (I don't know how the recovery system works, but there's a function to wipe and reinstall the software on the Surface completely).
• Running the image: What can I emulate it on? I've heard about QEMU, but it has the reputation of being slow. Also, the program must emulate the neccessary hardware (Tegra-3).

Answer 1

I'm aware this question was asked 7 years ago, but now it's possible to emulate Windows on ARM in the latest QEMU 4.2.0.

Steps to follow:

1. Patch QEMU to report EL3 TrustZone available: https://github.com/TeoIzAwezome/rtemu/commit/0f8b8ec18725cd0f66a39b5520fb6a435a757f95 - if you're using Windows and don't want to build QEMU from source, you can patch qemu-system-arm.exe : replace this hex sequence with NOPs 4531C931D24C8D05BE515C004889F1E87AD82E00 => 9090909090909090909090909090909090909090 - it replaces this part:

2. Download Linaro firmware for QEMU 32-bit ARM platform, specifically 15.12 version which is the last one that boots Windows on ARM without problems: https://releases.linaro.org/components/kernel/uefi-linaro/15.12/release/qemu/QEMU_EFI.fd
3. Download an ESD image of Windows RT 8.1, these are publicly available from Microsoft. You can find download links here https://tech.myonlylonely.com/wimboot-for-surface-2-en/ or by using Google with this string: 9600.17053.winblue_refresh.141120-0031_woafre_client_CoreARM_O15_en-us-IR5_CCSA_WOAFRER_EN-US_ESD_2F1E1C773E39C4672F52B1F3A0AE7844FD837B23.esd
4. Either convert ESD to ISO or just extract it with esd-decrypter-wimlib-8.7z : https://www.tenforums.com/software-apps/27180-windows-10-recovery-tools-bootable-rescue-disk-2.html
5. You will need VirtIO drivers for QEMU compiled for 32-bit ARM platform, precompiled viostor.sys driver is available here https://www.betaarchive.com/forum/viewtopic.php?f=62&t=40522 - if you built drivers yourself in Visual Studio, make sure to create catalog files by using Inf2Cat /driver:C:\Drivers\ /os:8_ARM,6_3_ARM and test-sign them (all .cat and .sys files); once drivers are ready, you can slipstream them into boot.wim and install.wim by using dism /Mount-Wim + /Add-Driver + /Unmount-Wim
6. If you don't want to boot and install from ISO, you can create a VHD/VHDX disk image and format/partition it the same way as it's done for Windows installation on UEFI systems — GPT partitioning: EFI partition - FAT32, MSR partition, Primary partition - NTFS. Use dism /Apply-Image with install.wim to install Windows files to created disk, and bcdboot to install EFI files
7. Since you're using test-signed drivers, you need to tweak BCD file on EFI partition:

set BCD=E:\EFI\Microsoft\Boot\BCD
bcdedit /store %BCD% /set {globalsettings} testsigning on
bcdedit /store %BCD% /set {globalsettings} nointegritychecks on

8. Once everything is done, start QEMU with these parameters:

set HDD=windows-on-arm.vhd
set ISO=en_windows_8.1_ir4_ARM_dvd.iso

qemu-system-arm ^
-M virt ^
-cpu cortex-a15 ^
-smp 2 ^
--accel tcg,thread=multi ^
-m 2G ^
-bios QEMU_EFI_1512.fd ^
-device VGA ^
-device ich9-usb-ehci1 ^
-device usb-kbd ^
-device usb-tablet ^
-drive if=virtio,file=%HDD% ^
-device virtio-scsi-pci,id=scsi0 ^
-device scsi-cd,drive=install,bus=scsi0.0 ^
-drive if=none,format=raw,id=install,file=%ISO%,readonly=on ^
-rtc base="2013-07-15",clock=vm

Notes:

• There is known problem with PCI MMIO area, and USB input wouldn't work because of it. You can workaround that by replacing -M virt with -M virt,highmem=false however with this option Windows 8.1 RT will throw BSOD with code SYSTEM_THREAD_EXCEPTION_NOT_HANDLED.

• It's known Windows 10 for ARM does not throw this BSOD code and works in QEMU pretty well with -M virt,highmem=false. You can use Google to get it: 10.0.15035.0.rs2_release.170209-1535_armfre_client-enterprise_volume_en-us :

• Also note that full emulation of 32-bit ARM is very slow even on Intel Core i7-8700 @ 3.2 GHz, so it's better to use some modern ARM board like Raspberry Pi 4 that have hardware accelerated KVM hypervisor.

• Windows for 32-bit ARM is already considered legacy, better switch to AArch64 aka Windows for ARM64, see https://withinrafael.com/2018/02/12/boot-arm64-builds-of-windows-10-in-qemu/