Home

Qiling Framework

Qiling is an advanced binary emulation framework, with the following features:

Key Features

• Multi-platform Emulation: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR
• Multi-architecture Support: 8086, X86, X86_64, ARM, ARM64, MIPS, RISC-V, PowerPC
• Multiple File Formats: PE, Mach-O, ELF, COM, MBR
• Kernel Module Support: Linux Kernel Module (.ko), Windows Driver (.sys) & macOS Kernel (.kext) via Demigod
• Isolated Sandbox Environment: Emulates & sandboxes code in an isolated environment
• Cross-platform Debugging: Supports cross architecture and platform debugging capabilities
• Built-in Debugger: Advanced debugger with reverse debugging capability
• Fine-grain Instrumentation: Hooks at various levels (instruction/basic-block/memory-access/exception/syscall/IO/etc)
• Dynamic Hot Patching: Allows dynamic hot patch on-the-fly running code, including loaded libraries
• Python Framework: True framework in Python, making it easy to build customized security analysis tools

What's New in v1.4.8

• Enhanced MCU emulation support
• Improved debugging capabilities
• Better performance optimizations
• Extended architecture support
• Updated dependencies and compatibility

Quick Start

from qiling import Qiling

# Emulate a binary
ql = Qiling(['/path/to/binary'], '/path/to/rootfs')
ql.run()

# Emulate shellcode
ql = Qiling(code=shellcode, rootfs='/path/to/rootfs', 
           archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX)
ql.run()

Getting Help

• 📖 Documentation: docs.qiling.io
• 💬 Telegram: t.me/qilingframework
• 🐛 Issues: GitHub Issues
• 🌐 Website: qiling.io

Powered By

Qiling is backed by Unicorn Engine.

---

License

This project is released and distributed under free software license GPLv2.

Core Developers

See CREDITS.md for the complete list of contributors.