Package: qiling
Qiling's usecase, blog and related workQiling is an advanced binary emulation framework, with the following features:Emulate multi-platforms: Windows, MacOS, Linux, Android, BSD, UEFI, DOS, MBR, Ethereum Virtual MachineEmulate multi-architectures: 8086, X86, X86_64, ARM, ARM64, MIPS, RISCV, PowerPCSupport multiple file formats: PE, MachO, ELF, COM, MBRSupport Windows Driver (.sys), Linux Kernel Module (.ko) & MacOS Kernel (.kext) viaDemigodEmulates & sandbox code in an isolated environmentProvides a fully configurable sandboxProvides in-depth memory, register, OS level and filesystem level APIFine-grain instrumentation: allows hooks at various levels (instruction/basic-block/memory-access/exception/syscall/IO/etc)Provides virtual machine level API such as save and restore current execution stateSupports cross architecture and platform debugging capabilitiesBuilt-in debugger with reverse debugging capabilityAllows dynamic hotpatch on-the-fly running code, including the loaded libraryTrue framework in Python, making it easy to build customized security analysis tools on topQiling also made its way to various international conferences.2022:Black Hat, EUBlack Hat, MEA2021:Black Hat, USAHack In The Box, AmsterdamBlack Hat, Asia2020:Black Hat, EuropeBlack Hat, USABlack Hat, USA (Demigod)Black Hat, AsiaHack In The Box, Lockdown 001Hack In The Box, Lockdown 002Hack In The Box, CyberweekNullcon2019:Defcon, USAHitconZeronightsQiling is backed byUnicorn engine.Visit our websitehttps://www.qiling.iofor more information.LicenseThis project is released and distributed underfree software license GPLv2and later version.Qiling vs other EmulatorsThere are many open source emulators, but two projects closest to Qiling areUnicorn&Qemu usermode. This section explains the main differences of Qiling against them.Qiling vs Unicorn engineBuilt on top of Unicorn, but Qiling & Unicorn are two different animals.Unicorn is just a CPU emulator, so it focuses on emulating CPU instructions, that can understand emulator memory. Beyond that, Unicorn is not aware of higher level concepts, such as dynamic libraries, system calls, I/O handling or executable formats like PE, MachO or ELF. As a result, Unicorn can only emulate raw machine instructions, without Operating System (OS) contextQiling is designed as a higher level framework, that leverages Unicorn to emulate CPU instructions, but can understand OS: it has executable format loaders (for PE, MachO & ELF at the moment), dynamic linkers (so we can load & relocate shared libraries), syscall & IO handlers. For this reason, Qiling can run executable binary without requiring its native OSQiling vs Qemu usermodeQemu usermode does similar thing to our emulator, that is to emulate whole executable binaries in cross-architecture way. However, Qiling offers some important differences against Qemu usermode.Qiling is a true analysis framework, that allows you to build your own dynamic analysis tools on top (in friendly Python language). Meanwhile, Qemu is just a tool, not a frameworkQiling can perform dynamic instrumentation, and can even hotpatch code at runtime. Qemu does not do eitherNot only working cross-architecture, Qiling is also cross-platform, so for example you can run Linux ELF file on top of Windows. In contrast, Qemu usermode only run binary of the same OS, such as Linux ELF on Linux, due to the way it forwards syscall from emulated code to native OSQiling supports more platforms, including Windows, MacOS, Linux & BSD. Qemu usermode can only handle Linux & BSDInstallationPlease seesetup guidefile for how to install Qiling Framework.ExamplesThe example below shows how to use Qiling framework in the most striaghtforward way to emulate a Windows executable.fromqilingimportQilingif__name__=="__main__":# initialize Qiling instance, specifying the executable to emulate and the emulated system root.# note that the current working directory is assumed to be Qiling homeql=Qiling([r'examples/rootfs/x86_windows/bin/x86_hello.exe'],r'examples/rootfs/x86_windows')# start emulationql.run()The following example shows how a Windows crackme may be patched dynamically to make it always display the "Congratulation" dialog.fromqilingimportQilingdefforce_call_dialog_func(ql:Qiling):# get DialogFunc address from current stack framelpDialogFunc=ql.stack_read(-8)# setup stack memory for DialogFuncql.stack_push(0)ql.stack_push(1001)# IDS_APPNAMEql.stack_push(0x111)# WM_COMMANDql.stack_push(0)# push return addressql.stack_push(0x0401018)# resume emulation from DialogFunc addressql.arch.regs.eip=lpDialogFuncif__name__=="__main__":# initialize Qiling instanceql=Qiling([r'rootfs/x86_windows/bin/Easy_CrackMe.exe'],r'rootfs/x86_windows')# NOP out some codeql.patch(0x004010B5,b'\x90\x90')ql.patch(0x004010CD,b'\x90\x90')ql.patch(0x0040110B,b'\x90\x90')ql.patch(0x00401112,b'\x90\x90')# hook at an address with a callbackql.hook_address(force_call_dialog_func,0x00401016)ql.run()The below Youtube video shows how the above example works.Emulating ARM router firmware on Ubuntu X64 machineQiling Framework hot-patch and emulates ARM router's /usr/bin/httpd on a X86_64Bit UbuntuQiling's IDAPro Plugin: Instrument and Decrypt Mirai's SecretThis video demonstrate how Qiling's IDAPro plugin able to make IDApro run with Qiling instrumentation engineGDBserver with IDAPro demoSolving a simple CTF challenge with Qiling Framework and IDAProEmulating MBRQiling Framework emulates MBRQltoolQiling also provides a friendly tool namedqltoolto quickly emulate shellcode & executable binaries.With qltool, easy execution can be performed:With shellcode:$ ./qltool code --os linux --arch arm --format hex -f examples/shellcodes/linarm32_tcp_reverse_shell.hexWith binary file:$ ./qltool run -f examples/rootfs/x8664_linux/bin/x8664_hello --rootfs  examples/rootfs/x8664_linux/With binary and GDB debugger enable:$ ./qltool run -f examples/rootfs/x8664_linux/bin/x8664_hello --gdb 127.0.0.1:9999 --rootfs examples/rootfs/x8664_linuxWith code coverage collection (UEFI only for now):$ ./qltool run -f examples/rootfs/x8664_efi/bin/TcgPlatformSetupPolicy --rootfs examples/rootfs/x8664_efi --coverage-format drcov --coverage-file TcgPlatformSetupPolicy.covWith json output (Windows mainly):$ ./qltool run -f examples/rootfs/x86_windows/bin/x86_hello.exe --rootfs  examples/rootfs/x86_windows/ --console False --jsonContactGet the latest info from our websitehttps://www.qiling.ioContact us at emailinfo@qiling.io, or via Twitter@qiling_ioorWeiboCore developers, Key Contributors and etcPlease refer toCREDITS.md