Or you could link the emulator at 1MB, and have a small front-end that maps the emulator and jumps to it, and the emulator then unmaps the first 1MB of its address space.