I'm working on a win based sansa emulator.
Until now I have done following components (rockbox used functionality only!):
 - emulate cpu
 - emulate ata (read only functionality)
 - emulate display
 - emulate memory
 - emulate keys
 - emulate timers
 - log the executed code to disassembler file (including rockbox.map infos)

I can run the compiled rockbox.bin and play some games. :-)
It is still very hackish, but works sufficiently to get an idea,
what the original/rockbox firmware does (unknown address access, program
flow, timings). Hopefully this also gives some hints, how the
DAC can be controlled (not in the near future).

Not supported yet:
 - thumb code
 - coprocessor
 - firq / audio

Untested:
 - audio codecs

If anybody is interested, I can send the source code.

Toni