dnSpyEx vs Qiling Framework

dnSpyEx is an unofficial continuation of dnSpy, a debugger and .NET assembly editor for working with assemblies without source code. It can debug .NET Framework, .NET, and Unity game assemblies, with breakpoints, tracepoints, conditional breakpoints, exception breakpoints, and multiple-process debugging. Editing covers metadata and methods or classes in C# and Visual Basic, plus low-level IL method bodies. The project lists C# and Visual Basic decompilers using the ILSpy engine, along with a BAML decompiler and disassembler. Assembly search, class and method usage analysis, caller finding, bookmarks, and project export are also included. A public API supports extensions, and the C# Interactive window can control or script dnSpyEx. The latest stable release listed is v6.6.0, which adds a .NET 10 distribution. It is free under GPLv3. Release notes describe Wine compatibility adjustments for Linux, not native Linux support. Dynamic methods cannot be debugged because of CLR limitations.

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.