pycdc vs Qiling Framework

pycdc is the command-line decompiler in Decompyle++, a free C++ project that converts compiled Python bytecode into readable Python source. The pycdc command accepts a PYC file and prints source to standard output. Its companion, pycdas, disassembles a PYC file and prints bytecode. Both commands handle Python marshalled code objects, but those objects do not contain version metadata, so the Python version must be supplied. The project seeks compatibility with bytecode from any Python version and focuses on bytecode rather than native-code decompilation. Decompyle++ runs on Linux, macOS, and Windows. Building uses CMake to generate a project or makefile, followed by compilation; the README describes MSVC for Windows projects and makefile instructions for Unix-like systems or MSYS. CMake is the named build-system requirement, with no product integrations listed. The project is GPL version 3, credits Michael Hansen and Darryl Pogue, and has no packaged GitHub releases. Its listed plan is free.

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.