If an open source tool exists, people will end up playing with it. That's categorically not the same of closed source tools - as social creatures we want to share what we're doing, so if we can't share that we stumbled on a cool closed-source tool leaked on the internet, what's the point of playing with it?

So there's that.

I would very much like to hear about your progress on this, FWIW.

Also, I'm not sure, but just in case the following things I was reminded of are directly/indirectly useful/helpful (for ideas or parts, or maybe some of the engineers may be interesting to talk to..?)...

- MARSSx86 - a cycle-accurate x86 emulator built on top of QEMU: http://www.marss86.org/~marss86/index.php/Home

- Cling - a C++ interpreter built on top of LLVM's JIT: https://root.cern.ch/cling

There are several cycle-accurate emulators out there, MARSSx86 is the first I discovered. I'm not sure if it's useful.

I'm not entirely sure why I'm mentioning Cling. It used to be based on a custom runtime (and called CINT) that was absolutely massive and was basically its own C++ implementation. Cling is effectively a very small patch/driver on top of LLVM's C++ implementation and its JIT runtime.