diff --git a/sim/src/api.rs b/sim/src/api.rs
new file mode 100644
index 0000000..71d4643
--- /dev/null
+++ b/sim/src/api.rs
@@ -0,0 +1,34 @@
+//! HAL api for MyNewt applications
+
+use flash::{Result, Flash};
+use libc;
+use std::slice;
+
+// This isn't meant to call directly, but by a wrapper.
+
+#[no_mangle]
+pub extern fn sim_flash_erase(dev: *mut Flash, offset: u32, size: u32) -> libc::c_int {
+    let mut dev: &mut Flash = unsafe { &mut *dev };
+    map_err(dev.erase(offset as usize, size as usize))
+}
+
+#[no_mangle]
+pub extern fn sim_flash_read(dev: *const Flash, offset: u32, dest: *mut u8, size: u32) -> libc::c_int {
+    let dev: &Flash = unsafe { &*dev };
+    let mut buf: &mut[u8] = unsafe { slice::from_raw_parts_mut(dest, size as usize) };
+    map_err(dev.read(offset as usize, &mut buf))
+}
+
+#[no_mangle]
+pub extern fn sim_flash_write(dev: *mut Flash, offset: u32, src: *const u8, size: u32) -> libc::c_int {
+    let mut dev: &mut Flash = unsafe { &mut *dev };
+    let buf: &[u8] = unsafe { slice::from_raw_parts(src, size as usize) };
+    map_err(dev.write(offset as usize, &buf))
+}
+
+fn map_err(err: Result<()>) -> libc::c_int {
+    match err {
+        Ok(()) => 0,
+        Err(_) => -1,
+    }
+}
diff --git a/sim/src/area.rs b/sim/src/area.rs
new file mode 100644
index 0000000..9bb7d57
--- /dev/null
+++ b/sim/src/area.rs
@@ -0,0 +1,161 @@
+//! Describe flash areas.
+
+use flash::{Flash, Sector};
+use std::marker::PhantomData;
+use std::ptr;
+
+/// Structure to build up the boot area table.
+#[derive(Debug)]
+pub struct AreaDesc {
+    areas: Vec<Vec<FlashArea>>,
+    whole: Vec<FlashArea>,
+    sectors: Vec<Sector>,
+}
+
+impl AreaDesc {
+    pub fn new(flash: &Flash) -> AreaDesc {
+        AreaDesc {
+            areas: vec![],
+            whole: vec![],
+            sectors: flash.sector_iter().collect(),
+        }
+    }
+
+    /// Add a slot to the image.  The slot must align with erasable units in the flash device.
+    /// Panics if the description is not valid.  There are also bootloader assumptions that the
+    /// slots are SLOT0, SLOT1, and SCRATCH in that order.
+    pub fn add_image(&mut self, base: usize, len: usize, id: FlashId) {
+        let nid = id as usize;
+        let orig_base = base;
+        let orig_len = len;
+        let mut base = base;
+        let mut len = len;
+
+        while nid > self.areas.len() {
+            self.areas.push(vec![]);
+            self.whole.push(Default::default());
+        }
+
+        if nid != self.areas.len() {
+            panic!("Flash areas not added in order");
+        }
+
+        let mut area = vec![];
+
+        for sector in &self.sectors {
+            if len == 0 {
+                break;
+            };
+            if base > sector.base + sector.size - 1 {
+                continue;
+            }
+            if sector.base != base {
+                panic!("Image does not start on a sector boundary");
+            }
+
+            area.push(FlashArea {
+                flash_id: id,
+                device_id: 42,
+                pad16: 0,
+                off: sector.base as u32,
+                size: sector.size as u32,
+            });
+
+            base += sector.size;
+            len -= sector.size;
+        }
+
+        if len != 0 {
+            panic!("Image goes past end of device");
+        }
+
+        self.areas.push(area);
+        self.whole.push(FlashArea {
+            flash_id: id,
+            device_id: 42,
+            pad16: 0,
+            off: orig_base as u32,
+            size: orig_len as u32,
+        });
+    }
+
+    pub fn get_c(&self) -> CAreaDesc {
+        let mut areas: CAreaDesc = Default::default();
+
+        assert_eq!(self.areas.len(), self.whole.len());
+
+        for (i, area) in self.areas.iter().enumerate() {
+            if area.len() > 0 {
+                areas.slots[i].areas = &area[0];
+                areas.slots[i].whole = self.whole[i].clone();
+                areas.slots[i].num_areas = area.len() as u32;
+                areas.slots[i].id = area[0].flash_id;
+            }
+        }
+
+        areas.num_slots = self.areas.len() as u32;
+
+        areas
+    }
+}
+
+/// The area descriptor, C format.
+#[repr(C)]
+#[derive(Debug, Default)]
+pub struct CAreaDesc<'a> {
+    slots: [CArea<'a>; 16],
+    num_slots: u32,
+}
+
+#[repr(C)]
+#[derive(Debug)]
+pub struct CArea<'a> {
+    whole: FlashArea,
+    areas: *const FlashArea,
+    num_areas: u32,
+    id: FlashId,
+    phantom: PhantomData<&'a AreaDesc>,
+}
+
+impl<'a> Default for CArea<'a> {
+    fn default() -> CArea<'a> {
+        CArea {
+            areas: ptr::null(),
+            whole: Default::default(),
+            id: FlashId::BootLoader,
+            num_areas: 0,
+            phantom: PhantomData,
+        }
+    }
+}
+
+/// Flash area map.
+#[repr(u8)]
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
+#[allow(dead_code)]
+pub enum FlashId {
+    BootLoader = 0,
+    Image0 = 1,
+    Image1 = 2,
+    ImageScratch = 3,
+    Nffs = 4,
+    Core = 5,
+    RebootLog = 6
+}
+
+impl Default for FlashId {
+    fn default() -> FlashId {
+        FlashId::BootLoader
+    }
+}
+
+#[repr(C)]
+#[derive(Debug, Clone, Default)]
+pub struct FlashArea {
+    flash_id: FlashId,
+    device_id: u8,
+    pad16: u16,
+    off: u32,
+    size: u32,
+}
+
diff --git a/sim/src/c.rs b/sim/src/c.rs
new file mode 100644
index 0000000..7ddb21b
--- /dev/null
+++ b/sim/src/c.rs
@@ -0,0 +1,50 @@
+/// Interface wrappers to C API entering to the bootloader
+
+use area::AreaDesc;
+use flash::Flash;
+use libc;
+
+/// Invoke the bootloader on this flash device.
+pub fn boot_go(flash: &mut Flash, areadesc: &AreaDesc) -> i32 {
+    unsafe { raw::invoke_boot_go(flash as *mut _ as *mut libc::c_void,
+                                 &areadesc.get_c() as *const _) as i32 }
+}
+
+/// Setter/getter for the flash counter.  This isn't thread safe.
+pub fn get_flash_counter() -> i32 {
+    unsafe { raw::flash_counter as i32 }
+}
+
+/// Set the flash counter.  Zero indicates the flash should not be interrupted.  The counter will
+/// then go negative for each flash operation.
+pub fn set_flash_counter(counter: i32) {
+    unsafe { raw::flash_counter = counter as libc::c_int };
+}
+
+pub fn boot_trailer_sz() -> u32 {
+    unsafe { raw::boot_trailer_sz(raw::sim_flash_align) }
+}
+
+pub fn get_sim_flash_align() -> u8 {
+    unsafe { raw::sim_flash_align }
+}
+
+pub fn set_sim_flash_align(align: u8) {
+    unsafe { raw::sim_flash_align = align };
+}
+
+mod raw {
+    use area::CAreaDesc;
+    use libc;
+
+    extern "C" {
+        // This generates a warning about `CAreaDesc` not being foreign safe.  There doesn't appear to
+        // be any way to get rid of this warning.  See https://github.com/rust-lang/rust/issues/34798
+        // for information and tracking.
+        pub fn invoke_boot_go(flash: *mut libc::c_void, areadesc: *const CAreaDesc) -> libc::c_int;
+        pub static mut flash_counter: libc::c_int;
+
+        pub static mut sim_flash_align: u8;
+        pub fn boot_trailer_sz(min_write_sz: u8) -> u32;
+    }
+}
diff --git a/sim/src/flash.rs b/sim/src/flash.rs
new file mode 100644
index 0000000..8cf267c
--- /dev/null
+++ b/sim/src/flash.rs
@@ -0,0 +1,230 @@
+//! A flash simulator
+//!
+//! This module is capable of simulating the type of NOR flash commonly used in microcontrollers.
+//! These generally can be written as individual bytes, but must be erased in larger units.
+
+use std::iter::Enumerate;
+use std::slice;
+use pdump::HexDump;
+
+error_chain! {
+    errors {
+        OutOfBounds(t: String) {
+            description("Offset is out of bounds")
+            display("Offset out of bounds: {}", t)
+        }
+        Write(t: String) {
+            description("Invalid write")
+            display("Invalid write: {}", t)
+        }
+    }
+}
+
+fn ebounds<T: AsRef<str>>(message: T) -> ErrorKind {
+    ErrorKind::OutOfBounds(message.as_ref().to_owned())
+}
+
+fn ewrite<T: AsRef<str>>(message: T) -> ErrorKind {
+    ErrorKind::Write(message.as_ref().to_owned())
+}
+
+/// An emulated flash device.  It is represented as a block of bytes, and a list of the sector
+/// mapings.
+#[derive(Clone)]
+pub struct Flash {
+    data: Vec<u8>,
+    sectors: Vec<usize>,
+}
+
+impl Flash {
+    /// Given a sector size map, construct a flash device for that.
+    pub fn new(sectors: Vec<usize>) -> Flash {
+        let total = sectors.iter().sum();
+        Flash {
+            data: vec![0xffu8; total],
+            sectors: sectors,
+        }
+    }
+
+    /// The flash drivers tend to erase beyond the bounds of the given range.  Instead, we'll be
+    /// strict, and make sure that the passed arguments are exactly at a sector boundary, otherwise
+    /// return an error.
+    pub fn erase(&mut self, offset: usize, len: usize) -> Result<()> {
+        let (_start, slen) = self.get_sector(offset).ok_or_else(|| ebounds("start"))?;
+        let (end, elen) = self.get_sector(offset + len - 1).ok_or_else(|| ebounds("end"))?;
+
+        if slen != 0 {
+            bail!(ebounds("offset not at start of sector"));
+        }
+        if elen != self.sectors[end] - 1 {
+            bail!(ebounds("end not at start of sector"));
+        }
+
+        for x in &mut self.data[offset .. offset + len] {
+            *x = 0xff;
+        }
+
+        Ok(())
+    }
+
+    /// Writes are fairly unconstrained, but we restrict to only allowing writes of values that
+    /// are entirely written as 0xFF.
+    pub fn write(&mut self, offset: usize, payload: &[u8]) -> Result<()> {
+        if offset + payload.len() > self.data.len() {
+            bail!(ebounds("Write outside of device"));
+        }
+
+        let mut sub = &mut self.data[offset .. offset + payload.len()];
+        if sub.iter().any(|x| *x != 0xFF) {
+            bail!(ewrite("Write to non-FF location"));
+        }
+
+        sub.copy_from_slice(payload);
+        Ok(())
+    }
+
+    /// Read is simple.
+    pub fn read(&self, offset: usize, data: &mut [u8]) -> Result<()> {
+        if offset + data.len() > self.data.len() {
+            bail!(ebounds("Read outside of device"));
+        }
+
+        let sub = &self.data[offset .. offset + data.len()];
+        data.copy_from_slice(sub);
+        Ok(())
+    }
+
+    // Scan the sector map, and return the base and offset within a sector for this given byte.
+    // Returns None if the value is outside of the device.
+    fn get_sector(&self, offset: usize) -> Option<(usize, usize)> {
+        let mut offset = offset;
+        for (sector, &size) in self.sectors.iter().enumerate() {
+            if offset < size {
+                return Some((sector, offset));
+            }
+            offset -= size;
+        }
+        return None;
+    }
+
+    /// An iterator over each sector in the device.
+    pub fn sector_iter(&self) -> SectorIter {
+        SectorIter {
+            iter: self.sectors.iter().enumerate(),
+            base: 0,
+        }
+    }
+
+    pub fn device_size(&self) -> usize {
+        self.data.len()
+    }
+
+    pub fn dump(&self) {
+        self.data.dump();
+    }
+}
+
+/// It is possible to iterate over the sectors in the device, each element returning this.
+#[derive(Debug)]
+pub struct Sector {
+    /// Which sector is this, starting from 0.
+    pub num: usize,
+    /// The offset, in bytes, of the start of this sector.
+    pub base: usize,
+    /// The length, in bytes, of this sector.
+    pub size: usize,
+}
+
+pub struct SectorIter<'a> {
+    iter: Enumerate<slice::Iter<'a, usize>>,
+    base: usize,
+}
+
+impl<'a> Iterator for SectorIter<'a> {
+    type Item = Sector;
+
+    fn next(&mut self) -> Option<Sector> {
+        match self.iter.next() {
+            None => None,
+            Some((num, &size)) => {
+                let base = self.base;
+                self.base += size;
+                Some(Sector {
+                    num: num,
+                    base: base,
+                    size: size,
+                })
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::{Flash, Error, ErrorKind, Result, Sector};
+
+    #[test]
+    fn test_flash() {
+        // NXP-style, uniform sectors.
+        let mut f1 = Flash::new(vec![4096usize; 256]);
+        test_device(&mut f1);
+
+        // STM style, non-uniform sectors
+        let mut f2 = Flash::new(vec![16 * 1024, 16 * 1024, 16 * 1024, 64 * 1024,
+                                128 * 1024, 128 * 1024, 128 * 1024]);
+        test_device(&mut f2);
+    }
+
+    fn test_device(flash: &mut Flash) {
+        let sectors: Vec<Sector> = flash.sector_iter().collect();
+
+        flash.erase(0, sectors[0].size).unwrap();
+        let flash_size = flash.device_size();
+        flash.erase(0, flash_size).unwrap();
+        assert!(flash.erase(0, sectors[0].size - 1).is_bounds());
+
+        // Verify that write and erase do something.
+        flash.write(0, &[0]).unwrap();
+        let mut buf = [0; 4];
+        flash.read(0, &mut buf).unwrap();
+        assert_eq!(buf, [0, 0xff, 0xff, 0xff]);
+
+        flash.erase(0, sectors[0].size).unwrap();
+        flash.read(0, &mut buf).unwrap();
+        assert_eq!(buf, [0xff; 4]);
+
+        // Program the first and last byte of each sector, verify that has been done, and then
+        // erase to verify the erase boundaries.
+        for sector in &sectors {
+            let byte = [(sector.num & 127) as u8];
+            flash.write(sector.base, &byte).unwrap();
+            flash.write(sector.base + sector.size - 1, &byte).unwrap();
+        }
+
+        // Verify the above
+        let mut buf = Vec::new();
+        for sector in &sectors {
+            let byte = (sector.num & 127) as u8;
+            buf.resize(sector.size, 0);
+            flash.read(sector.base, &mut buf).unwrap();
+            assert_eq!(buf.first(), Some(&byte));
+            assert_eq!(buf.last(), Some(&byte));
+            assert!(buf[1..buf.len()-1].iter().all(|&x| x == 0xff));
+        }
+    }
+
+    // Helper checks for the result type.
+    trait EChecker {
+        fn is_bounds(&self) -> bool;
+    }
+
+    impl<T> EChecker for Result<T> {
+
+        fn is_bounds(&self) -> bool {
+            match *self {
+                Err(Error(ErrorKind::OutOfBounds(_), _)) => true,
+                _ => false,
+            }
+        }
+    }
+}
diff --git a/sim/src/main.rs b/sim/src/main.rs
new file mode 100644
index 0000000..6822605
--- /dev/null
+++ b/sim/src/main.rs
@@ -0,0 +1,347 @@
+extern crate docopt;
+extern crate libc;
+extern crate rand;
+extern crate rustc_serialize;
+
+#[macro_use]
+extern crate error_chain;
+
+use docopt::Docopt;
+use rand::{Rng, SeedableRng, XorShiftRng};
+use rustc_serialize::{Decodable, Decoder};
+use std::mem;
+use std::slice;
+
+mod area;
+mod c;
+mod flash;
+pub mod api;
+mod pdump;
+
+use flash::Flash;
+use area::{AreaDesc, FlashId};
+
+const USAGE: &'static str = "
+Mcuboot simulator
+
+Usage:
+  bootsim sizes
+  bootsim run --device TYPE [--align SIZE]
+  bootsim (--help | --version)
+
+Options:
+  -h, --help         Show this message
+  --version          Version
+  --device TYPE      MCU to simulate
+                     Valid values: stm32f4, k64f
+  --align SIZE       Flash write alignment
+";
+
+#[derive(Debug, RustcDecodable)]
+struct Args {
+    flag_help: bool,
+    flag_version: bool,
+    flag_device: Option<DeviceName>,
+    flag_align: Option<AlignArg>,
+    cmd_sizes: bool,
+    cmd_run: bool,
+}
+
+#[derive(Debug, RustcDecodable)]
+enum DeviceName { Stm32f4, K64f }
+
+#[derive(Debug)]
+struct AlignArg(u8);
+
+impl Decodable for AlignArg {
+    // Decode the alignment ourselves, to restrict it to the valid possible alignments.
+    fn decode<D: Decoder>(d: &mut D) -> Result<AlignArg, D::Error> {
+        let m = d.read_u8()?;
+        match m {
+            1 | 2 | 4 | 8 => Ok(AlignArg(m)),
+            _ => Err(d.error("Invalid alignment")),
+        }
+    }
+}
+
+fn main() {
+    let args: Args = Docopt::new(USAGE)
+        .and_then(|d| d.decode())
+        .unwrap_or_else(|e| e.exit());
+    // println!("args: {:#?}", args);
+
+    if args.cmd_sizes {
+        show_sizes();
+        return;
+    }
+
+    let (mut flash, areadesc) = match args.flag_device {
+        None => panic!("Missing mandatory argument"),
+        Some(DeviceName::Stm32f4) => {
+            // STM style flash.  Large sectors, with a large scratch area.
+            let flash = Flash::new(vec![16 * 1024, 16 * 1024, 16 * 1024, 16 * 1024,
+                                   64 * 1024,
+                                   128 * 1024, 128 * 1024, 128 * 1024]);
+            let mut areadesc = AreaDesc::new(&flash);
+            areadesc.add_image(0x020000, 0x020000, FlashId::Image0);
+            areadesc.add_image(0x040000, 0x020000, FlashId::Image1);
+            areadesc.add_image(0x060000, 0x020000, FlashId::ImageScratch);
+            (flash, areadesc)
+        }
+        Some(DeviceName::K64f) => {
+            // NXP style flash.  Small sectors, one small sector for scratch.
+            let flash = Flash::new(vec![4096; 128]);
+
+            let mut areadesc = AreaDesc::new(&flash);
+            areadesc.add_image(0x020000, 0x020000, FlashId::Image0);
+            areadesc.add_image(0x040000, 0x020000, FlashId::Image1);
+            areadesc.add_image(0x060000, 0x001000, FlashId::ImageScratch);
+            (flash, areadesc)
+        }
+    };
+
+    // println!("Areas: {:#?}", areadesc.get_c());
+
+    // Install the boot trailer signature, so that the code will start an upgrade.
+    let primary = install_image(&mut flash, 0x020000, 32779);
+
+    // Install an upgrade image.
+    let upgrade = install_image(&mut flash, 0x040000, 41922);
+
+    // Set an alignment, and position the magic value.
+    c::set_sim_flash_align(args.flag_align.map(|x| x.0).unwrap_or(1));
+    let trailer_size = c::boot_trailer_sz();
+
+    // Mark the upgrade as ready to install.  (This looks like it might be a bug in the code,
+    // however.)
+    mark_upgrade(&mut flash, 0x060000 - trailer_size as usize);
+
+    let (fl2, total_count) = try_upgrade(&flash, &areadesc, None);
+    println!("First boot, count={}", total_count);
+    assert!(verify_image(&fl2, 0x020000, &upgrade));
+
+    let mut bad = 0;
+    // Let's try an image halfway through.
+    for i in 1 .. total_count {
+        println!("Try interruption at {}", i);
+        let (fl3, total_count) = try_upgrade(&flash, &areadesc, Some(i));
+        println!("Second boot, count={}", total_count);
+        if !verify_image(&fl3, 0x020000, &upgrade) {
+            println!("FAIL");
+            bad += 1;
+        }
+        if !verify_image(&fl3, 0x040000, &primary) {
+            println!("Slot 1 FAIL");
+            bad += 1;
+        }
+    }
+    println!("{} out of {} failed {:.2}%",
+             bad, total_count,
+             bad as f32 * 100.0 / total_count as f32);
+
+    println!("Try revert");
+    let fl2 = try_revert(&flash, &areadesc);
+    assert!(verify_image(&fl2, 0x020000, &primary));
+
+    println!("Try norevert");
+    let fl2 = try_norevert(&flash, &areadesc);
+    assert!(verify_image(&fl2, 0x020000, &upgrade));
+
+    /*
+    // show_flash(&flash);
+
+    println!("First boot for upgrade");
+    // c::set_flash_counter(570);
+    c::boot_go(&mut flash, &areadesc);
+    // println!("{} flash ops", c::get_flash_counter());
+
+    verify_image(&flash, 0x020000, &upgrade);
+
+    println!("\n------------------\nSecond boot");
+    c::boot_go(&mut flash, &areadesc);
+    */
+}
+
+/// Test a boot, optionally stopping after 'n' flash options.  Returns a count of the number of
+/// flash operations done total.
+fn try_upgrade(flash: &Flash, areadesc: &AreaDesc, stop: Option<i32>) -> (Flash, i32) {
+    // Clone the flash to have a new copy.
+    let mut fl = flash.clone();
+
+    c::set_flash_counter(stop.unwrap_or(0));
+    let (first_interrupted, cnt1) = match c::boot_go(&mut fl, &areadesc) {
+        -0x13579 => (true, stop.unwrap()),
+        0 => (false, -c::get_flash_counter()),
+        x => panic!("Unknown return: {}", x),
+    };
+    c::set_flash_counter(0);
+
+    if first_interrupted {
+        // fl.dump();
+        match c::boot_go(&mut fl, &areadesc) {
+            -0x13579 => panic!("Shouldn't stop again"),
+            0 => (),
+            x => panic!("Unknown return: {}", x),
+        }
+    }
+
+    let cnt2 = cnt1 - c::get_flash_counter();
+
+    (fl, cnt2)
+}
+
+fn try_revert(flash: &Flash, areadesc: &AreaDesc) -> Flash {
+    let mut fl = flash.clone();
+    c::set_flash_counter(0);
+
+    assert_eq!(c::boot_go(&mut fl, &areadesc), 0);
+    assert_eq!(c::boot_go(&mut fl, &areadesc), 0);
+    fl
+}
+
+fn try_norevert(flash: &Flash, areadesc: &AreaDesc) -> Flash {
+    let mut fl = flash.clone();
+    c::set_flash_counter(0);
+    let align = c::get_sim_flash_align() as usize;
+
+    assert_eq!(c::boot_go(&mut fl, &areadesc), 0);
+    // Write boot_ok
+    fl.write(0x040000 - align, &[1]).unwrap();
+    assert_eq!(c::boot_go(&mut fl, &areadesc), 0);
+    fl
+}
+
+/// Show the flash layout.
+#[allow(dead_code)]
+fn show_flash(flash: &Flash) {
+    println!("---- Flash configuration ----");
+    for sector in flash.sector_iter() {
+        println!("    {:2}: 0x{:08x}, 0x{:08x}",
+                 sector.num, sector.base, sector.size);
+    }
+    println!("");
+}
+
+/// Install a "program" into the given image.  This fakes the image header, or at least all of the
+/// fields used by the given code.  Returns a copy of the image that was written.
+fn install_image(flash: &mut Flash, offset: usize, len: usize) -> Vec<u8> {
+    let offset0 = offset;
+
+    // Generate a boot header.  Note that the size doesn't include the header.
+    let header = ImageHeader {
+        magic: 0x96f3b83c,
+        tlv_size: 0,
+        _pad1: 0,
+        hdr_size: 32,
+        key_id: 0,
+        _pad2: 0,
+        img_size: len as u32,
+        flags: 0,
+        ver: ImageVersion {
+            major: 1,
+            minor: 0,
+            revision: 1,
+            build_num: 1,
+        },
+        _pad3: 0,
+    };
+
+    let b_header = header.as_raw();
+    /*
+    let b_header = unsafe { slice::from_raw_parts(&header as *const _ as *const u8,
+                                                  mem::size_of::<ImageHeader>()) };
+                                                  */
+    assert_eq!(b_header.len(), 32);
+    flash.write(offset, &b_header).unwrap();
+    let offset = offset + b_header.len();
+
+    // The core of the image itself is just pseudorandom data.
+    let mut buf = vec![0; len];
+    splat(&mut buf, offset);
+    flash.write(offset, &buf).unwrap();
+    let offset = offset + buf.len();
+
+    // Copy out the image so that we can verify that the image was installed correctly later.
+    let mut copy = vec![0u8; offset - offset0];
+    flash.read(offset0, &mut copy).unwrap();
+
+    copy
+}
+
+/// Verify that given image is present in the flash at the given offset.
+fn verify_image(flash: &Flash, offset: usize, buf: &[u8]) -> bool {
+    let mut copy = vec![0u8; buf.len()];
+    flash.read(offset, &mut copy).unwrap();
+
+    if buf != &copy[..] {
+        for i in 0 .. buf.len() {
+            if buf[i] != copy[i] {
+                println!("First failure at {:#x}", offset + i);
+                break;
+            }
+        }
+        false
+    } else {
+        true
+    }
+}
+
+/// The image header
+#[repr(C)]
+pub struct ImageHeader {
+    magic: u32,
+    tlv_size: u16,
+    key_id: u8,
+    _pad1: u8,
+    hdr_size: u16,
+    _pad2: u16,
+    img_size: u32,
+    flags: u32,
+    ver: ImageVersion,
+    _pad3: u32,
+}
+
+impl AsRaw for ImageHeader {}
+
+#[repr(C)]
+pub struct ImageVersion {
+    major: u8,
+    minor: u8,
+    revision: u16,
+    build_num: u32,
+}
+
+/// Write out the magic so that the loader tries doing an upgrade.
+fn mark_upgrade(flash: &mut Flash, offset: usize) {
+    let magic = vec![0x77, 0xc2, 0x95, 0xf3,
+                     0x60, 0xd2, 0xef, 0x7f,
+                     0x35, 0x52, 0x50, 0x0f,
+                     0x2c, 0xb6, 0x79, 0x80];
+    flash.write(offset, &magic).unwrap();
+}
+
+// Drop some pseudo-random gibberish onto the data.
+fn splat(data: &mut [u8], seed: usize) {
+    let seed_block = [0x135782ea, 0x92184728, data.len() as u32, seed as u32];
+    let mut rng: XorShiftRng = SeedableRng::from_seed(seed_block);
+    rng.fill_bytes(data);
+}
+
+/// Return a read-only view into the raw bytes of this object
+trait AsRaw : Sized {
+    fn as_raw<'a>(&'a self) -> &'a [u8] {
+        unsafe { slice::from_raw_parts(self as *const _ as *const u8,
+                                       mem::size_of::<Self>()) }
+    }
+}
+
+fn show_sizes() {
+    // This isn't panic safe.
+    let old_align = c::get_sim_flash_align();
+    for min in &[1, 2, 4, 8] {
+        c::set_sim_flash_align(*min);
+        let msize = c::boot_trailer_sz();
+        println!("{:2}: {} (0x{:x})", min, msize, msize);
+    }
+    c::set_sim_flash_align(old_align);
+}
diff --git a/sim/src/pdump.rs b/sim/src/pdump.rs
new file mode 100644
index 0000000..dbb42d5
--- /dev/null
+++ b/sim/src/pdump.rs
@@ -0,0 +1,76 @@
+// Printable hexdump.
+
+pub trait HexDump {
+    // Output the data value in hex.
+    fn dump(&self);
+}
+
+struct Dumper {
+    hex: String,
+    ascii: String,
+    count: usize,
+    total_count: usize,
+}
+
+impl Dumper {
+    fn new() -> Dumper {
+        Dumper {
+            hex: String::with_capacity(49),
+            ascii: String::with_capacity(16),
+            count: 0,
+            total_count: 0,
+        }
+    }
+
+    fn add_byte(&mut self, ch: u8) {
+        if self.count == 16 {
+            self.ship();
+        }
+        if self.count == 8 {
+            self.hex.push(' ');
+        }
+        self.hex.push_str(&format!(" {:02x}", ch)[..]);
+        self.ascii.push(if ch >= ' ' as u8 && ch <= '~' as u8 {
+            ch as char
+        } else {
+            '.'
+        });
+        self.count += 1;
+    }
+
+    fn ship(&mut self) {
+        if self.count == 0 {
+            return;
+        }
+
+        println!("{:06x} {:-49} |{}|", self.total_count, self.hex, self.ascii);
+
+        self.hex.clear();
+        self.ascii.clear();
+        self.total_count += 16;
+        self.count = 0;
+    }
+}
+
+impl<'a> HexDump for &'a [u8] {
+    fn dump(&self) {
+        let mut dump = Dumper::new();
+        for ch in self.iter() {
+            dump.add_byte(*ch);
+        }
+        dump.ship();
+    }
+}
+
+impl HexDump for Vec<u8> {
+    fn dump(&self) {
+        (&self[..]).dump()
+    }
+}
+
+#[test]
+fn samples() {
+    "Hello".as_bytes().dump();
+    "This is a much longer string".as_bytes().dump();
+    "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f".as_bytes().dump();
+}