JEB vs Qiling Framework

JEB is a reverse-engineering platform for disassembly, decompilation, debugging, and analysis of code and document files. Its Android tools support static and dynamic app analysis, including multi-dex decompilation, resource reconstruction, and debugging of Dalvik and native code. Other modules address Intel x86 and x86-64, ARM, MIPS, RISC-V, WebAssembly, Ethereum contracts, Siemens S7 PLC programs, and PDF documents. Python or Java scripts and plugins can automate analysis, including through headless front ends. The GUI runs on Windows, Linux, and macOS for x64 and arm64 systems and requires JDK 21 or above. JEB Community Edition is free and described as suitable for researchers, students, hobbyists, and nonprofit reverse engineers; its listed plan covers x86 and x86-64 decompilation. The separate demo restricts decompilation, disables project saving and loading and clipboard use, limits session time, and requires an internet connection. Paid plans include Android modules from $140 per user per month and JEB Pro from $2,000 per user per year. PNF Software was founded in 2013 and is based in Silicon Valley, California.

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.