Qiling Framework
Qiling Framework is free software for emulating and instrumenting binaries in reverse engineering and security analysis.
What Qiling Framework is
Qiling Framework is free software for emulating and instrumenting binaries in reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; file formats include PE, Mach-O, ELF, and COM. Hooks can be set for instructions, memory access, exceptions, system calls, and I/O, among other levels. Its APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving or restoration. Qiling can patch running code, including loaded libraries, and its IDA Pro plugin can emulate binaries, show context, run scripts, save snapshots, and deobfuscate code. It uses Unicorn for CPU emulation and adds operating-system awareness and executable handling. Installation is documented through pip, source, or Docker. The project is licensed under GPL version 2 or later at the user's option.
Good
- Emulates machine code in an isolated environment
- Supports six listed processor architectures
- Offers hooks at instruction, memory, syscall, and I/O levels
- IDA Pro plugin includes emulation and snapshot tools
Watch out
- Some syscalls and OS APIs are not implemented
- Windows DLL files and registry data must be supplied
Who it suits
Qiling is intended for security researchers, university students, and lecturers working with binary analysis. It also suits users who need isolated emulation, detailed instrumentation, or cross-platform debugging.
Verdict
Qiling offers broad emulation and instrumentation features for security analysis, with installation options including pip, source, and Docker. Be prepared to supply Windows system files when needed and implement or map unsupported calls.
Plans and prices
From Qiling Framework's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Qiling Framework (GPLv2) | Free | Free software under GPLv2 |
The facts
Each one read from Qiling Framework's own pages, with the date it was checked.
What it does
- Analysis features
- It supports isolated machine-code emulation, cross-platform debugging, fine-grained hooks, and runtime hot-patching.checked 4 Oct 2026
- API
- Its API provides access to registers, memory, filesystems, operating systems, debugging, and saving or restoring execution state.checked 4 Oct 2026
- APIs
- The framework provides APIs for registers, memory, filesystems, operating systems, debugging, and saving or restoring execution state.checked 4 Oct 2026
- Architectures and formats
- The documentation lists x86, x86_64, ARM, ARM64, MIPS and 8086 architectures, and PE, Mach-O, ELF and COM file formats.checked 4 Oct 2026
- Deployment
- The installation guide documents pip installation, source installation, and running Qiling in Docker.checked 4 Oct 2026
- Emulation
- It emulates machine code in an isolated environment and supports cross architecture and platform debugging.checked 4 Oct 2026
- Engine
- Qiling is built on and backed by the Unicorn engine.checked 4 Oct 2026
- Hot patching
- Qiling can dynamically hot patch running code, including loaded libraries.checked 4 Oct 2026
- IDA Pro
- The Qiling IDA plugin can emulate the current binary in IDA, display live emulation context, run custom scripts, save and load snapshots, and deobfuscate code.checked 4 Oct 2026
- Install options
- The installation guide documents installation with pip, from source, and through a Docker image.checked 4 Oct 2026
- Instrumentation
- Hooks can be set at instruction, basic block, memory access, exception, syscall and I/O levels.checked 4 Oct 2026
- Integration
- The Qiling IDA Pro plugin can emulate binaries in IDA, show emulation context, run user scripts, save snapshots, and deobfuscate code.checked 4 Oct 2026
- Intended users
- The introduction identifies security researchers, university students and university lecturers as users of Qiling.checked 4 Oct 2026
- Kernel support
- Linux kernel modules, Windows drivers, and macOS kernel extensions are supported via Demigod.checked 4 Oct 2026
- Known limitation
- The FAQ says a binary may require a syscall or OS API that is not implemented, in which case users may need to implement it.checked 4 Oct 2026
- License
- The project is free software under GPL version 2 or, at the user's option, a later version.checked 4 Oct 2026
- Notable limit
- The FAQ says some syscalls and operating-system APIs are not implemented, and users may need to implement or map them.checked 4 Oct 2026
- Purpose
- Qiling combines binary emulation and instrumentation for reverse engineering and security analysis.checked 4 Oct 2026
- Security model
- The documentation describes emulating and sandboxing machine code in an isolated environment.checked 4 Oct 2026
- Support and contact
- The project lists [email protected] and @qiling_io as contact channels.checked 4 Oct 2026
- Underlying engine
- Qiling uses Unicorn to emulate CPU instructions and adds operating system awareness, executable loaders, dynamic linking, syscall handling and I/O handling.checked 4 Oct 2026
Where it runs
- Windows files
- The installation guide says Qiling does not bundle Microsoft Windows DLL files or registry data due to distribution restrictions; users must provide them.checked 4 Oct 2026
- Windows setup requirement
- Windows DLL files and registry data are not bundled; the installation guide instructs users to copy them from a Microsoft Windows system.checked 4 Oct 2026
Alternatives to Qiling Framework
- 1
Binary Ninja
Free planWebAPILinuxmacOS7.8$199 one-time - 2
Frida
Free planOpen sourceAndroidiOSAPILinux7.7Free plan - 3
rev.ng
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4
JEB
Free planAPILinuxmacOSSelf-hosted7.6From $1,200 a year - 5
Ghidra
Free planOpen sourceAPIExtensionLinuxmacOS7.3Free plan - 6
IDA Pro
Free planLinuxmacOSWindows7.0From $1,099 a year