Hiew vs Qiling Framework

Hiew is a Windows console program for viewing and editing files of unlimited size in text, hex, and disassembler modes. Its maker describes it as a classic since 1991. Disassembly includes x86-64 with AVX instruction support and an ArmV6 disassembler. Listed executable formats include NE, LE, LX, PE/PE32+, little-endian ELF and ELF64, Mach-O, and TE/TE64. Users can follow direct calls and jumps with a click and search instruction patterns in disassembler mode. Other listed capabilities include block operations, multi-file search and replace, keyboard macros, Unicode and UTF-8, binary templates, scripting, disk editing, plugins, and HEM modules. The free demo omits editing, crypt, assembler, 64-bit and ARM disassembly, drive support, keyboard macros, and HEM support, among other restrictions. The single-version license costs $25 as a one-time purchase with no updates. Lifetime updates cost $249 as a one-time purchase; Hiewix 32-bits costs $59, paid once with free 1-year updates.

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.