Qiling Framework vs rev.ng

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.

rev.ng is a decompiler for reverse engineering that turns supported binaries into syntactically valid, standard-compliant C. Its data-structure recovery uses information across functions to identify linked lists, structs, arrays, and arrays of structs. The listed default architectures are x86, x86-64, ARM, AArch64, MIPS, and S390X; supported imports include ELF, PE/COFF, Mach-O, DWARF, PDB, and IDB. Users can define functions, edit prototypes, and rename items in YAML files, or interact through an HTTP API. The interface is described as available in a browser or standalone app, with cloud and standalone use offering the same experience. Collaborators can share a project URL; public projects include two collaborators. The rev.ng decompilation pipeline is Free Software, while the UI is intended for commercial cloud and standalone versions. The service is free and lists API, Linux, macOS, web, and Windows platforms. The site invites users to join a closed beta for the UI.