Skip to content

Commit 81b847a

Browse files
authored
Merge pull request #1578 from xwings/dev
Update new README.md
2 parents b18cc88 + b10c3eb commit 81b847a

File tree

1 file changed

+99
-103
lines changed

1 file changed

+99
-103
lines changed

README.md

Lines changed: 99 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[![Documentation Status](https://readthedocs.org/projects/qilingframework/badge/?version=latest)](https://docs.qiling.io)
1+
[![Documentation Status](https://github.com/qilingframework/qiling/wiki)](https://github.com/qilingframework/qiling/wiki)
22
[![Downloads](https://pepy.tech/badge/qiling)](https://pepy.tech/project/qiling)
33
[![Chat on Telegram](https://img.shields.io/badge/Chat%20on-Telegram-brightgreen.svg)](https://t.me/qilingframework)
44

@@ -8,24 +8,43 @@
88
<img width="150" height="150" src="https://raw.githubusercontent.com/qilingframework/qiling/master/docs/qiling2_logo_small.png">
99
</p>
1010

11-
[Qiling's use case, blog and related work](https://github.com/qilingframework/qiling/issues/134)
12-
13-
Qiling is an advanced binary emulation framework, with the following features:
14-
15-
- Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR.
16-
- Emulate multi-architectures: 8086, X86, X86_64, ARM, ARM64, MIPS, RISC-V, PowerPC.
17-
- Support multiple file formats: PE, Mach-O, ELF, COM, MBR.
18-
- Support Windows Driver (.sys), Linux Kernel Module (.ko) & macOS Kernel (.kext) via [Demigod](https://groundx.io/demigod/).
19-
- Emulates & sandbox code in an isolated environment.
20-
- Provides a fully configurable sandbox.
21-
- Provides in-depth memory, register, OS level and filesystem level API.
22-
- Fine-grain instrumentation: allows hooks at various levels
23-
(instruction/basic-block/memory-access/exception/syscall/IO/etc.)
24-
- Provides virtual machine level API such as saving and restoring the current execution state.
25-
- Supports cross architecture and platform debugging capabilities.
26-
- Built-in debugger with reverse debugging capability.
27-
- Allows dynamic hot patch on-the-fly running code, including the loaded library.
28-
- True framework in Python, making it easy to build customized security analysis tools on top.
11+
# Qiling Framework
12+
13+
Qiling is an advanced binary emulation framework that allows you to emulate and sandbox code in an isolated environment across multiple platforms and architectures. Built on top of Unicorn Engine, Qiling provides a higher-level framework that understands operating system contexts, executable formats, and dynamic linking.
14+
15+
## Table of Contents
16+
17+
- [Features](#features)
18+
- [Appearance](#Appearance)
19+
- [Use Cases](#use-cases)
20+
- [Quick Start](#quick-start)
21+
- [Installation](#installation)
22+
- [Basic Usage](#basic-usage)
23+
- [Qiling vs. Other Emulators](#qiling-vs-other-emulators)
24+
- [Qiling vs. Unicorn Engine](#qiling-vs-unicorn-engine)
25+
- [Qiling vs. QEMU User Mode](#qiling-vs-qemu-user-mode)
26+
- [Examples](#examples)
27+
- [Qltool](#qltool)
28+
- [Contributing](#contributing)
29+
- [License](#license)
30+
- [Contact](#contact)
31+
- [Core Developers & Contributors](#core-developers--contributors)
32+
33+
## Features
34+
35+
- **Multi-platform Emulation**: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR.
36+
- **Multi-architecture Emulation**: 8086, X86, X86_64, ARM, ARM64, MIPS, RISC-V, PowerPC.
37+
- **Multiple File Format Support**: PE, Mach-O, ELF, COM, MBR.
38+
- **Kernel Module Emulation**: Supports Windows Driver (.sys), Linux Kernel Module (.ko) & macOS Kernel (.kext) via [Demigod](https://groundx.io/demigod/).
39+
- **Isolated Sandboxing**: Emulates & sandboxes code in an isolated environment with a fully configurable sandbox.
40+
- **In-depth API**: Provides in-depth memory, register, OS level, and filesystem level API.
41+
- **Fine-grain Instrumentation**: Allows hooks at various levels (instruction/basic-block/memory-access/exception/syscall/IO/etc.).
42+
- **Virtual Machine Level API**: Supports saving and restoring the current execution state.
43+
- **Debugging Capabilities**: Supports cross-architecture and platform debugging, including a built-in debugger with reverse debugging capability.
44+
- **Dynamic Hot Patching**: Allows dynamic hot patching of on-the-fly running code, including loaded libraries.
45+
- **Python Framework**: A true framework in Python, making it easy to build customized security analysis tools.
46+
47+
## Appearance
2948

3049
Qiling also made its way to various international conferences.
3150

@@ -49,79 +68,37 @@ Qiling also made its way to various international conferences.
4968
- [Nullcon](https://nullcon.net/website/goa-2020/speakers/kaijern-lau.php)
5069

5170
2019:
52-
5371
- [DEFCON, USA](https://www.defcon.org/html/defcon-27/dc-27-demolabs.html#QiLing)
5472
- [Hitcon](https://hitcon.org/2019/CMT/agenda)
5573
- [Zeronights](https://zeronights.ru/report-en/qiling-io-advanced-binary-emulation-framework/)
5674

75+
## Use Cases
5776

58-
Qiling is backed by [Unicorn Engine](http://www.unicorn-engine.org).
59-
60-
Visit our [website](https://www.qiling.io) for more information.
61-
62-
---
63-
#### License
64-
65-
This program is free software; you can redistribute it and/or modify
66-
it under the terms of the GNU General Public License as published by
67-
the Free Software Foundation; either version 2 of the License, or
68-
(at your option) any later version.
69-
70-
---
71-
72-
#### Qiling vs. other Emulators
73-
74-
There are many open-source emulators, but two projects closest to Qiling
75-
are [Unicorn](http://www.unicorn-engine.org) & [QEMU user mode](https://qemu.org).
76-
This section explains the main differences of Qiling against them.
77-
78-
##### Qiling vs. Unicorn engine
77+
Qiling has been presented at various international conferences, showcasing its versatility in:
7978

80-
Built on top of Unicorn, but Qiling & Unicorn are two different animals.
79+
- Binary analysis and reverse engineering.
80+
- Malware analysis and sandboxing.
81+
- Firmware analysis and emulation.
82+
- Security research and vulnerability discovery.
83+
- CTF challenges and exploit development.
8184

82-
- Unicorn is just a CPU emulator, so it focuses on emulating CPU instructions,
83-
that can understand emulator memory.
84-
Beyond that, Unicorn is not aware of higher level concepts, such as dynamic
85-
libraries, system calls, I/O handling or executable formats like PE, Mach-O
86-
or ELF. As a result, Unicorn can only emulate raw machine instructions,
87-
without Operating System (OS) context.
88-
- Qiling is designed as a higher level framework, that leverages Unicorn to
89-
emulate CPU instructions, but can understand OS: it has executable format
90-
loaders (for PE, Mach-O & ELF currently), dynamic linkers (so we can
91-
load & relocate shared libraries), syscall & IO handlers. For this reason,
92-
Qiling can run executable binary without requiring its native OS.
93-
94-
##### Qiling vs. QEMU user mode
95-
96-
QEMU user mode does a similar thing to our emulator, that is, to emulate whole
97-
executable binaries in a cross-architecture way.
98-
However, Qiling offers some important differences against QEMU user mode:
85+
For more details on Qiling's use cases, blog posts, and related work, please refer to [Qiling's use case, blog and related work](https://github.com/qilingframework/qiling/issues/134).
9986

100-
- Qiling is a true analysis framework,
101-
that allows you to build your own dynamic analysis tools on top (in Python).
102-
Meanwhile, QEMU is just a tool, not a framework.
103-
- Qiling can perform dynamic instrumentation, and can even hot patch code at
104-
runtime. QEMU does neither.
105-
- Not only working cross-architecture, Qiling is also cross-platform.
106-
For example, you can run Linux ELF file on top of Windows.
107-
In contrast, QEMU user mode only runs binary of the same OS, such as Linux
108-
ELF on Linux, due to the way it forwards syscall from emulated code to
109-
native OS.
110-
- Qiling supports more platforms, including Windows, macOS, Linux & BSD. QEMU
111-
user mode can only handle Linux & BSD.
87+
## Quick Start
11288

113-
---
89+
### Installation
11490

115-
#### Installation
91+
Qiling requires Python 3.8 or newer. You can install it using pip:
11692

117-
Please see [setup guide](https://docs.qiling.io/en/latest/install/) file for how to install Qiling Framework.
93+
```bash
94+
pip install qiling
95+
```
11896

119-
---
97+
For more detailed installation instructions and dependencies, please refer to the [official documentation](https://github.com/qilingframework/qiling/wiki/Installation).
12098

121-
#### Examples
99+
### Basic Usage
122100

123-
The example below shows how to use Qiling framework in the most
124-
straightforward way to emulate a Windows executable.
101+
The example below shows how to use Qiling framework in the most straightforward way to emulate a Windows executable.
125102

126103
```python
127104
from qiling import Qiling
@@ -135,8 +112,30 @@ if __name__ == "__main__":
135112
ql.run()
136113
```
137114

138-
- The following example shows how a Windows crackme may be patched dynamically
139-
to make it always display the “Congratulation” dialog.
115+
## Qiling vs. Other Emulators
116+
117+
There are many open-source emulators, but two projects closest to Qiling are [Unicorn](http://www.unicorn-engine.org) & [QEMU user mode](https://qemu.org). This section explains the main differences of Qiling against them.
118+
119+
### Qiling vs. Unicorn Engine
120+
121+
Built on top of Unicorn, but Qiling & Unicorn are two different animals.
122+
123+
- **Unicorn** is just a CPU emulator, so it focuses on emulating CPU instructions, that can understand emulator memory. Beyond that, Unicorn is not aware of higher level concepts, such as dynamic libraries, system calls, I/O handling or executable formats like PE, Mach-O or ELF. As a result, Unicorn can only emulate raw machine instructions, without Operating System (OS) context.
124+
- **Qiling** is designed as a higher level framework, that leverages Unicorn to emulate CPU instructions, but can understand OS: it has executable format loaders (for PE, Mach-O & ELF currently), dynamic linkers (so we can load & relocate shared libraries), syscall & IO handlers. For this reason, Qiling can run executable binary without requiring its native OS.
125+
126+
### Qiling vs. QEMU User Mode
127+
128+
QEMU user mode does a similar thing to our emulator, that is, to emulate whole executable binaries in a cross-architecture way.
129+
However, Qiling offers some important differences against QEMU user mode:
130+
131+
- **Qiling is a true analysis framework**, that allows you to build your own dynamic analysis tools on top (in Python). Meanwhile, QEMU is just a tool, not a framework.
132+
- **Qiling can perform dynamic instrumentation**, and can even hot patch code at runtime. QEMU does neither.
133+
- Not only working cross-architecture, **Qiling is also cross-platform**. For example, you can run Linux ELF file on top of Windows. In contrast, QEMU user mode only runs binary of the same OS, such as Linux ELF on Linux, due to the way it forwards syscall from emulated code to native OS.
134+
- **Qiling supports more platforms**, including Windows, macOS, Linux & BSD. QEMU user mode can only handle Linux & BSD.
135+
136+
## Examples
137+
138+
- The following example shows how a Windows crackme may be patched dynamically to make it always display the “Congratulation” dialog.
140139

141140
```python
142141
from qiling import Qiling
@@ -177,15 +176,13 @@ The below YouTube video shows how the above example works.
177176

178177
#### Emulating ARM router firmware on Ubuntu x64 host
179178

180-
Qiling Framework hot-patches and emulates an ARM router's `/usr/bin/httpd` on
181-
an x86_64 Ubuntu host.
179+
Qiling Framework hot-patches and emulates an ARM router's `/usr/bin/httpd` on an x86_64 Ubuntu host.
182180

183-
[![Qiling Tutorial: Emulating and Fuzz ARM router firmware](https://github.com/qilingframework/theme.qiling.io/blob/master/source/img/fuzzer.jpg?raw=true)](https://www.youtube.com/watch?v=e3_T3KLh2NU)
181+
[![Qiling Tutorial: Emulating and Fuzz ARM router firmware](https://github.com/qilingframework/theme.qiling.io/blob/master/source/img/fuzzer.jpg?raw=true)](https://www.youtube.com/watch?v=e3_T3KLhNUs)
184182

185183
#### Qiling's IDA Pro Plugin: Instrument and Decrypt Mirai's Secret
186184

187-
This video demonstrates how Qiling's IDA Pro plugin can make IDA Pro run with
188-
Qiling instrumentation engine.
185+
This video demonstrates how Qiling's IDA Pro plugin can make IDA Pro run with Qiling instrumentation engine.
189186

190187
[![Qiling's IDA Pro Plugin: Instrument and Decrypt Mirai's Secret](http://img.youtube.com/vi/ZWMWTq2WTXk/0.jpg)](http://www.youtube.com/watch?v=ZWMWTq2WTXk)
191188

@@ -195,63 +192,62 @@ Solving a simple CTF challenge with Qiling Framework and IDA Pro
195192

196193
[![Solving a simple CTF challenge with Qiling Framework and IDA Pro](https://i.ytimg.com/vi/SPjVAt2FkKA/0.jpg)](https://www.youtube.com/watch?v=SPjVAt2FkKA)
197194

198-
199195
#### Emulating MBR
200196

201197
Qiling Framework emulates MBR
202198

203199
[![Qiling DEMO: Emulating MBR](https://github.com/qilingframework/theme.qiling.io/blob/master/source/img/mbr.png?raw=true)](https://github.com/qilingframework/theme.qiling.io/blob/master/source/img/mbr.png?raw=true)
204200

205-
---
206-
207-
#### Qltool
201+
## Qltool
208202

209203
Qiling also provides a friendly tool named `qltool` to quickly emulate shellcode & executable binaries.
210204

211205
With qltool, easy execution can be performed:
212206

213-
214207
With shellcode:
215208

216-
```
209+
```bash
217210
$ ./qltool code --os linux --arch arm --format hex -f examples/shellcodes/linarm32_tcp_reverse_shell.hex
218211
```
219212

220213
With binary file:
221214

222-
```
215+
```bash
223216
$ ./qltool run -f examples/rootfs/x8664_linux/bin/x8664_hello --rootfs examples/rootfs/x8664_linux/
224217
```
225218

226219
With binary and GDB debugger enabled:
227220

228-
```
221+
```bash
229222
$ ./qltool run -f examples/rootfs/x8664_linux/bin/x8664_hello --gdb 127.0.0.1:9999 --rootfs examples/rootfs/x8664_linux
230223
```
231224

232225
With code coverage collection (UEFI only for now):
233226

234-
```
227+
```bash
235228
$ ./qltool run -f examples/rootfs/x8664_efi/bin/TcgPlatformSetupPolicy --rootfs examples/rootfs/x8664_efi --coverage-format drcov --coverage-file TcgPlatformSetupPolicy.cov
236229
```
237230

238231
With JSON output (Windows, mainly):
239232

240-
```
233+
```bash
241234
$ ./qltool run -f examples/rootfs/x86_windows/bin/x86_hello.exe --rootfs examples/rootfs/x86_windows/ --console False --json
242235
```
243-
---
244236

237+
## Contributing
245238

246-
#### Contact
239+
We welcome contributions from the community! If you're interested in contributing to Qiling Framework, please check out our [GitHub repository](https://github.com/qilingframework/qiling) and look for open issues or submit a pull request.
247240

248-
Get the latest info from our website https://www.qiling.io
241+
## License
249242

250-
Contact us at email [email protected],
251-
via Twitter [@qiling_io](https://twitter.com/qiling_io).
243+
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
252244

253-
---
245+
## Contact
246+
247+
Get the latest info from our website [https://www.qiling.io](https://www.qiling.io)
248+
249+
Contact us at email [[email protected]](mailto:[email protected]), or via Twitter [@qiling_io](https://twitter.com/qiling_io).
254250

255-
#### Core developers, Key Contributors and etc.
251+
## Core Developers & Contributors
256252

257-
Please refer to [CREDITS.md](https://github.com/qilingframework/qiling/blob/dev/CREDITS.md).
253+
Please refer to [CREDITS.md](https://github.com/qilingframework/qiling/blob/dev/CREDITS.md).

0 commit comments

Comments
 (0)