Qiling: A true instrumentable binary emulation framework

https://github.com/qilingframework/qiling

by matthberg • 2 years ago

52 5 2 years ago

Anyone experienced with this? How well does it work?

russdill• 2 years ago

I use it to help validate the reverse engineering of some 2000s, 2010s game security components (DLLs, etc). Support for windows is pretty good with other platforms lagging behind but still usable.

kuroguro• 2 years ago

For usermode fuzzing it's pretty nice and easy to get running, but for more advanced cases I ended up using the underlying unicorn-afl directly. IIRC it wasn't loading some ELF correctly (this was some years ago).

evmar• 2 years ago

I integrated Unicorn, the underlying qemu-as-a-library, into my emulator project:

https://neugierig.org/software/blog/2023/11/retrowin32-unico...

My experience with it was that it was a lot slower than my (not very good) emulator, I imagine because I was some using it wrong somehow (? qemu is high quality software). And also as I was using it I was managing to corrupt state somehow in a way that meant it didn't end up ultimately helping with the thing I was trying to debug.

MrYellowP• 2 years ago

I don't understand what "emulating executables" means and reading through the text didn't clear that up.

So it's an emulator that emulates whole platforms so one could run windows executables on other platforms, without any required extras? Like having WINE combined with an actual emulator?

I'm confused. Is this a tool for 80s style crackers to write the modern equivalent of trainers?

Qiling: A true instrumentable binary emulation framework

Related Stories