I think emulators have virtual TPMs which you can definitely inspect and manipulate the internal state of, and the specs are freely available so presumably anyone with some microcontroller/embedded experience can make one. The problem is that software is able to determine whether that TPM is an "approved" one, and that process being cryptographic, is going to be pretty hard to get past: https://en.wikipedia.org/wiki/Trusted_Platform_Module#Endors...

Ever since the beginning I have maintained the strong and unchanging opinion that everything TPM and "trusted computing" related is ultimately user-hostile and a threat to freedom, and it's disturbing to see that the worst nightmares are slowing becoming reality. It used to be drugs and terrorism. Now it's "security".