Miasm vs Qiling Framework
Miasm
miasm.reQiling Framework
qiling.ioSide by side
| Figure | Miasm | Qiling Framework |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 0 | 1 |
| Spec score · Reverse Engineering Tools | 7.2 (#40) | 8.3 (#8) |
| Analysis features | It represents assembly semantics in an intermediate language and supports emulation, symbolic execution, and expression simplification for automatic de-obfuscation. | It supports isolated machine-code emulation, cross-platform debugging, fine-grained hooks, and runtime hot-patching. |
| Emulation | It uses JIT to emulate shellcode and some or all of binaries, and Python callbacks can interact with execution. | It emulates machine code in an isolated environment and supports cross architecture and platform debugging. |
| License | Miasm is distributed under the GPLv2 license. | The project is free software under GPL version 2 or, at the user's option, a later version. |
| Purpose | Miasm is a free and open source reverse engineering framework for analyzing, modifying, and generating binary programs. | Qiling combines binary emulation and instrumentation for reverse engineering and security analysis. |
Plans
In their own words
Qiling Framework
Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.