Qiling Framework vs RetDec

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.

RetDec is a free machine-code decompiler based on LLVM that reconstructs functions, types, and higher-level constructs as C or a Python-like language. It supports ELF, PE, Mach-O, COFF, AR archives, Intel HEX, and raw machine code, plus 32-bit Intel x86, ARM, MIPS, PIC32, and PowerPC, and 64-bit x86-64 and ARM64. Analysis includes static executable inspection, compiler and packer detection, and loading and instruction decoding. RetDec can use DWARF and PDB debugging information, reconstruct C++ class hierarchies from RTTI and vtables, and demangle GCC, MSVC, and Borland symbols. An integrated disassembler can generate call graphs, control-flow graphs, and statistics. It can be downloaded as a pre-built package, built from source, or run in Docker; related repositories provide IDA and Radare2 plugins. The project lists Windows 7 or later, Linux, and macOS, with experimental FreeBSD support. Installation requires about 5 to 6 GB of free disk space. The project says development is very limited, with issue responses potentially delayed up to one quarter.