# qilingframework/qiling

A True Instrumentable Binary Emulation Framework

Repository: https://github.com/qilingframework/qiling
Canonical: https://ross.abutalabs.com/products/qiling
Homepage: https://qiling.io
Language: Python
License: GPL-2.0
License Family: copyleft
Topics: binary, emulator, framework, unicorn-emulator, malware, analysis, qiling, reverse-engineering, cross-architecture, uefi, unicorn-engine
Last push: 2026-07-22T14:09:44+00:00

## Health v2 (maintenance only)
Score: 79/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 93, release rhythm 49, longevity 100
- inputs: {"age_days": 2568, "days_push": 42, "days_rel": 127, "gap_med": 416, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6075, forks 795 (observed 2026-08-28T04:09:34.792029+00:00)

## What it is
Qiling is a Python-based binary emulation framework built on Unicorn Engine that emulates executables across multiple platforms (Windows, macOS, Linux, BSD, UEFI, DOS) and architectures (x86, ARM, MIPS, RISC-V, PowerPC). It provides fine-grained instrumentation hooks, a configurable sandbox, and OS-level APIs for building custom security analysis tools.

## Use cases
- emulate malware samples in a sandbox for analysis
- reverse engineer binaries across different CPU architectures
- emulate IoT firmware for security research
- hook syscalls and instructions during binary execution
- analyze Windows drivers and kernel rootkits
- debug cross-platform and cross-architecture binaries
- hot patch running code during emulation

## When to choose
- you need instrumentable, scriptable binary emulation in Python
- analyzing malware or firmware in an isolated sandbox
- you need multi-architecture and multi-OS emulation support
- building custom security analysis tooling on top of an emulator

## When to avoid
- you only need fast full-system virtualization to run software, not analysis (use QEMU/KVM)
- you need a GUI disassembler rather than a programmable framework
- you require a permissive license for proprietary products (GPL-2.0)

## Facets
- artifact type: framework
- maturity: active
- function: simulation, reverse-engineering, security
- domain: security, reverse-engineering, embedded-systems, operating-systems
- platform: python, cross-platform, windows
- tags: binary-emulation, malware-analysis, unicorn-engine, sandbox, firmware-emulation, instrumentation, uefi, debugging, linux, macos

## Member repositories
- qilingframework/qiling (main) score 79

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:34.792029+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:48:21.768633+00:00, confidence not recorded.
  - readme: https://github.com/qilingframework/qiling (fetched 2026-08-28T04:09:34.792029+00:00, sha 7bb7fcd66555)
  - homepage: https://qiling.io (fetched 2026-08-29T08:46:06.785726+00:00, sha 155ef4d57503)
- Data as of 2026-08-30T08:39:29.467469+00:00.