qilingframework/qiling

Health v2 · maintenance only

Adoption not part of the score

6075 stars · 795 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Qiling is a Python-based binary emulation framework built on Unicorn Engine that emulates executables across multiple platforms (Windows, macOS, Linux, BSD, UEFI, DOS) and architectures (x86, ARM, MIPS, RISC-V, PowerPC). It provides fine-grained instrumentation hooks, a configurable sandbox, and OS-level APIs for building custom security analysis tools.

Use cases

• emulate malware samples in a sandbox for analysis
• reverse engineer binaries across different CPU architectures
• emulate IoT firmware for security research
• hook syscalls and instructions during binary execution
• analyze Windows drivers and kernel rootkits
• debug cross-platform and cross-architecture binaries
• hot patch running code during emulation

When to choose

• you need instrumentable, scriptable binary emulation in Python
• analyzing malware or firmware in an isolated sandbox
• you need multi-architecture and multi-OS emulation support
• building custom security analysis tooling on top of an emulator

When to avoid

• you only need fast full-system virtualization to run software, not analysis (use QEMU/KVM)
• you need a GUI disassembler rather than a programmable framework
• you require a permissive license for proprietary products (GPL-2.0)

Facets

framework · maturity active

simulation reverse-engineering security security reverse-engineering embedded-systems operating-systems python cross-platform windows binary-emulation malware-analysis unicorn-engine sandbox firmware-emulation instrumentation uefi debugging linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="qilingframework/qiling")