- Home
- Reverse Engineering Tools
- Qiling Framework
Qiling Framework
What it is
Qiling Framework combines binary emulation and instrumentation for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS and 8086; supported file formats include PE, Mach-O, ELF and COM. Users can set hooks at instruction, basic block, memory access, exception, syscall and I/O levels, and use APIs for registers, memory, filesystems, operating systems, debugging and execution-state saving or restoration. Qiling can dynamically patch running code, including loaded libraries. Its IDA Pro plugin can emulate a binary in IDA, show context, run scripts, save and load snapshots, and deobfuscate code. Built on Unicorn, Qiling adds operating-system awareness, loaders, dynamic linking and syscall and I/O handling. Installation options include pip, source and Docker. It is free software under GPL version 2 or a later version at the user's option. Windows DLL files and registry data are not bundled, and some syscalls or OS APIs may need user implementation.
For and against
For
- Emulates machine code in an isolated environment.
- Supports multiple architectures and executable formats.
- Hooks cover instructions, memory, exceptions, syscalls and I/O.
- Can hot patch running code.
- Free under GPL version 2 or later.
Against
- Windows DLLs and registry data must be supplied.
- Some syscalls or OS APIs may need implementation.
The verdict
Qiling offers emulation, instrumentation and runtime patching for a broad set of architectures and file formats. Users should be prepared to supply Windows files and address unsupported system calls or APIs where needed.
Who it suits
Qiling is suited to security researchers, university students and lecturers working with binary analysis or reverse engineering.
Plans and prices
Qiling Framework (GPLv2)
Free software under GPLv2
Read 4 Oct 2026 · docs.qiling.io
On the record
- Analysis features
- It supports isolated machine-code emulation, cross-platform debugging, fine-grained hooks, and runtime hot-patching.docs.qiling.io · read 4 Oct 2026
- API
- Its API provides access to registers, memory, filesystems, operating systems, debugging, and saving or restoring execution state.qiling.io · read 4 Oct 2026
- APIs
- The framework provides APIs for registers, memory, filesystems, operating systems, debugging, and saving or restoring execution state.qiling.io · read 4 Oct 2026
- Architectures and formats
- The documentation lists x86, x86_64, ARM, ARM64, MIPS and 8086 architectures, and PE, Mach-O, ELF and COM file formats.docs.qiling.io · read 4 Oct 2026
- Deployment
- The installation guide documents pip installation, source installation, and running Qiling in Docker.docs.qiling.io · read 4 Oct 2026
- Emulation
- It emulates machine code in an isolated environment and supports cross architecture and platform debugging.docs.qiling.io · read 4 Oct 2026
- Engine
- Qiling is built on and backed by the Unicorn engine.docs.qiling.io · read 4 Oct 2026
- Hot patching
- Qiling can dynamically hot patch running code, including loaded libraries.docs.qiling.io · read 4 Oct 2026
- IDA Pro
- The Qiling IDA plugin can emulate the current binary in IDA, display live emulation context, run custom scripts, save and load snapshots, and deobfuscate code.docs.qiling.io · read 4 Oct 2026
- Install options
- The installation guide documents installation with pip, from source, and through a Docker image.docs.qiling.io · read 4 Oct 2026
- Instrumentation
- Hooks can be set at instruction, basic block, memory access, exception, syscall and I/O levels.docs.qiling.io · read 4 Oct 2026
- Integration
- The Qiling IDA Pro plugin can emulate binaries in IDA, show emulation context, run user scripts, save snapshots, and deobfuscate code.docs.qiling.io · read 4 Oct 2026
- Intended users
- The introduction identifies security researchers, university students and university lecturers as users of Qiling.qiling.io · read 4 Oct 2026
- Kernel support
- Linux kernel modules, Windows drivers, and macOS kernel extensions are supported via Demigod.docs.qiling.io · read 4 Oct 2026
- Known limitation
- The FAQ says a binary may require a syscall or OS API that is not implemented, in which case users may need to implement it.docs.qiling.io · read 4 Oct 2026
- License
- The project is free software under GPL version 2 or, at the user's option, a later version.github.com · read 4 Oct 2026
- Notable limit
- The FAQ says some syscalls and operating-system APIs are not implemented, and users may need to implement or map them.docs.qiling.io · read 4 Oct 2026
- Purpose
- Qiling combines binary emulation and instrumentation for reverse engineering and security analysis.qiling.io · read 4 Oct 2026
