In contrast, Qemu usermode only run binary of the same OS, such as Linux ELF on Linux, due to the way it forwards syscall from emulated code to native OS.

Not only working cross-architecture, Qiling is also cross-platform, so for example you can run Linux ELF file on top of Windows.

Qiling can perform dynamic instrumentation, and can even hotpatch code at runtime.

Meanwhile, Qemu is just a tool, not a framework.

Qiling is a true analysis framework, that allows you to build your own dynamic analysis tools on top (in friendly Python language).However, Qiling offers some important differences against Qemu usermode. Qemu usermode does similar thing to our emulator, that is to emulate whole executable binaries in cross-architecture way. For this reason, Qiling can run executable binary without requiring its native OS. Qiling is designed as a higher level framework, that leverages Unicorn to emulate CPU instructions, but can understand OS: it has executable format loaders (for PE, MachO & ELF at the moment), dynamic linkers (so we can load & relocate shared libraries), syscall & IO handlers.As a result, Unicorn can only emulate raw machine instructions, without Operating System (OS) context. Beyond that, Unicorn is not aware of higher level concepts, such as dynamic libraries, system calls, I/O handling or executable formats like PE, MachO or ELF. Unicorn is just a CPU emulator, so it focuses on emulating CPU instructions, that can understand emulator memory.Qiling vs Unicorn engineīuilt on top of Unicorn, but Qiling & Unicorn are two different animals. This section explains the main differences of Qiling against them.

There are many open source emulators, but two projects closest to Qiling are Unicorn & Qemu usermode. True framework in Python, making it easy to build customized security analysis tools on top.

Allow dynamic hotpatch on-the-fly running code, including the loaded library.Fine-grain instrumentation: allow hooks at various levels (instruction/basic-block/memory-access/exception/syscall/IO/etc).Provide high level API to setup & configure the sandbox.Emulate & sandbox machine code in a isolated environment.Cross architecture: X86, X86_64, Arm, Arm64, Mips.Cross platform: Windows, MacOS, Linux, BSD.Qiling is an advanced binary emulation framework, with the following features:

Sandbox emulator mac