Qiling Framework - Advanced Binary Emulation Framework
1–10 of 14 posts
Re: Qiling Framework - Advanced Binary Emulation Framework
#2Sounds like a nice project, but the descriptions are a bit strange. First, it talks a bit about securing IoT, but then it goes on to say it supports emulating Windows, macOS, Linux, and FreeBSD? Second, on the comparisons page it lists a number of projects but seems to miss some of the most obvious competitors and instead compares itself to things that are related to binary emulation but not really relevant? For example, angr (disclaimer: I have worked with multiple people that contribute to and use the project heavily) does binary emulation as well (using Unicorn, no less; Nguyen Anh Quynh knows this because he gets contributions to the project, especially for the Python bindings, to keep angr working), has a number of loader backends, and has a bunch of fancy hooking and tracing features very similar to the ones mentioned here (among other things), all available through a Python API just like Qiling.
Re: Qiling Framework - Advanced Binary Emulation Framework
#3How does this compare to angr?
Re: Qiling Framework - Advanced Binary Emulation Framework
#4I would like to see a tool that combines "version control" and executable tracing, where you can take a snapshot of stack/heap and registers and allows you to move through each snapshot and see what changed, essentially allowing you to replay the execution instruction by instruction (with "proper" I/O result code/data simulation).
I know George Hotz was working on something like this before he got into the Comma AI thing and it really caught my eye, but I don't think there is anything out there that is "production ready" like say, IDA Pro or Ghidra or whatever.
Anyone know if such a tool exists? I imagine it would make mapping out vtables and such trivial.
Re: Qiling Framework - Advanced Binary Emulation Framework
#5I would like to see a tool that combines "version control" and executable tracing, where you can take a snapshot of stack/heap and registers and allows you to move through each snapshot and see what changed, essentially allowing you to replay the execution instruction by instruction (with "proper" I/O result code/data simulation). I know George Hotz was working on something like this before he got into the Comma AI t…
Perhaps you're thinking of QIRA (https://qira.me)?
Re: Qiling Framework - Advanced Binary Emulation Framework
#6I would like to see a tool that combines "version control" and executable tracing, where you can take a snapshot of stack/heap and registers and allows you to move through each snapshot and see what changed, essentially allowing you to replay the execution instruction by instruction (with "proper" I/O result code/data simulation). I know George Hotz was working on something like this before he got into the Comma AI t…
Perhaps you're thinking of QIRA ( https://qira.me )?
Yes - is there one for Windows by any chance?
Edit: This is the tool by George Hotz that I was referring to. I doubt it's really production ready given he likes to start and stop projects.
Re: Qiling Framework - Advanced Binary Emulation Framework
#7Earlier quoted context omitted.
Perhaps you're thinking of QIRA ( https://qira.me )?
Yes - is there one for Windows by any chance? Edit: This is the tool by George Hotz that I was referring to. I doubt it's really production ready given he likes to start and stop projects.
Not that I know of. However, either Qiling or angr (which I mentioned in another comment) both have a fairly decent Python API, so while they are often used for binary emulation they are often not too hard to hook up in a way that might be useful to you.
Re: Qiling Framework - Advanced Binary Emulation Framework
#8Earlier quoted context omitted.
Perhaps you're thinking of QIRA ( https://qira.me )?
Yes - is there one for Windows by any chance? Edit: This is the tool by George Hotz that I was referring to. I doubt it's really production ready given he likes to start and stop projects.
> I doubt it's really production ready given he likes to start and stop projects
A likely good strategy for success in startups is productizing projects started by George Hotz. :-P
Re: Qiling Framework - Advanced Binary Emulation Framework
#9I would like to see a tool that combines "version control" and executable tracing, where you can take a snapshot of stack/heap and registers and allows you to move through each snapshot and see what changed, essentially allowing you to replay the execution instruction by instruction (with "proper" I/O result code/data simulation). I know George Hotz was working on something like this before he got into the Comma AI t…
[deleted]
Re: Qiling Framework - Advanced Binary Emulation Framework
#10How does this compare to angr?
Angr is a static analysis and symbolic execution framework. It contains many components. It's built around Valgrind's VEX IR and provides an API that allows for lifting binaries from various architectures to a common IL. Angr also provides libraries to aid in CFG recovery, concolic testing, and other program analysis techniques. Angr does not do software emulation and is used mostly for static analysis.
Qiling is almost entirely dynamic. Qiling provides an API that allows you to instrument and emulate binaries. It's an extra layer on top of Unicorn (a library that can emulate CPU instructions using QEMU). Qiling contains ELF/PE/etc loaders and kernel syscall emulation. Think of it as qemu-user but with a Python API allowing you to install hooks, set breakpoints, read/write to memory, etc...