qilingframework/qiling
Qiling
A True Instrumentable Binary Emulation Framework
Features
- Instrumentable Binary Emulators - An instrumentable framework that emulates executable files across multiple operating systems and CPU architectures.
- Binary and Reverse Engineering - Emulates and debugs binaries across architectures with reverse execution and state snapshots.
- Emulated Code Hotpatching Engines - Provides a dynamic code hotpatching engine that modifies emulated code at runtime without restarting the binary.
- Configurable Execution Sandboxes - Ships a fully configurable sandbox controlling memory, registers, OS, and filesystem interactions.
- Multi-OS - Emulates binaries for Windows, macOS, Linux, Android, BSD, UEFI, DOS, and MBR without requiring the native OS.
- Multi-Platform Binary Runners - Runs binaries for Windows, macOS, Linux, Android, BSD, UEFI, DOS, and MBR without requiring the native OS.
- Instrumentable Emulation Engines - Hooks into instructions, basic blocks, memory accesses, syscalls, and I/O to inspect or modify behavior during emulation.
- Multi-Level Execution Instrumentation - Hooks into instructions, basic blocks, memory accesses, exceptions, syscalls, and I/O to inspect or modify behavior during emulation.
- Multi-Format Binary Loaders - Parses and loads multiple executable formats such as PE, ELF, and Mach-O into the emulated address space.
- Emulated Syscall Handlers - Maps guest OS syscalls to emulated handlers, replicating kernel behavior without the native OS.
- Cross-Platform Binary Emulators - Runs binaries compiled for one architecture or OS on a completely different host platform, such as ARM firmware on x86 Linux.
- Binary Instrumentation - Emulates and instruments binary code across multiple architectures and operating systems for analysis and debugging.
- CPU Emulation Libraries - Emulates machine code via the Unicorn engine for cross-architecture execution and analysis.
- Unicorn-Based Emulators - Emulates machine code by translating guest instructions into host instructions via the Unicorn engine.
- Binary Execution Sandboxes - Runs executable files in a virtual environment that intercepts all system interactions.
- Machine State Restoration - Captures and restores full CPU, memory, and peripheral state for repeatable analysis and reverse execution.
- Emulator State Snapshots - Captures and restores the full emulated state for repeatable analysis and debugging sessions.
- Reverse Execution Debuggers - Provides a built-in debugger that steps backward through emulated code execution.
- Hook-Based Plugin Systems - Attaches user-defined callbacks to execution events like instructions, memory access, and syscalls via a modular hook system.
- Execution Event Hooks - Attaches user-defined callbacks to execution events like instructions, memory access, and syscalls.
- Reverse Execution Debuggers - Steps through emulated code forward and backward with support for saving and restoring execution state.
- Multi-Architecture Firmware Emulators - Emulates and analyzes firmware binaries for UEFI, MBR, and embedded systems across different CPU architectures.
- Cross-Platform Malware Sandboxes - Runs untrusted executables from different operating systems in a fully configurable isolated environment.
- Emulated Code Patching and Hooking - Modifies executable code and library behavior on-the-fly during emulation for testing and analysis.
- Cross-Platform Debuggers - Debugs code across different operating systems and CPU architectures without switching tools or environments.
- Kernel Module and Driver Emulators - Emulates kernel modules, drivers, and extensions across operating systems for security research and vulnerability testing.
- Emulated Code Hotpatching - Modifies instructions or data in memory during execution, including within loaded libraries, without restarting the process.
- Kernel and Driver Security Analysis - Emulates and analyzes kernel modules, drivers, and firmware for vulnerability research and security testing.
- Multi-Architecture Execution Sandboxes - Runs untrusted executables from multiple architectures in a fully configurable isolated environment.
- Cross-Platform Malware Runners - Runs and analyzes malware samples from different operating systems without needing the native platform.
- Shellcode Emulation Tools - Provides a command-line utility to quickly emulate shellcode or executable files with debugging options.
- Binary Analysis - Provides an advanced framework for binary emulation.
- Firmware Emulation Frameworks - Advanced binary emulation framework for cross-platform analysis.
