Cutter vs Qiling Framework

Cutter is a free, open-source reverse-engineering platform for Linux, macOS, and Windows. Its Qt and C++ interface is powered by Rizin, and releases integrate the native Ghidra decompiler without Java. Other decompiler plugin options include RetDec and JSDec; Cutter developers officially maintain RzGhidra. For navigation, it provides a full graph view and a mini-graph, while its hex view can display and modify files. A Python scripting engine supports task automation, and plugins can be written in C++ or Python. Cutter also includes emulation for automation, cryptographic algorithms, and malware analysis. Its native and remote debugger supports dynamic analysis and is marked beta. Supported architectures include 6502, ARM, AVR, Dalvik, Game Boy, Java bytecode, and many others. Cutter is licensed under GPLv3, with official downloads for all three listed operating systems. Developer and community contact options include Telegram, IRC, and Twitter.

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.