Qiling Framework vs Rizin

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.

Rizin is a free, open-source framework for reverse engineering and binary analysis. Its tools include a disassembler, hexadecimal editor, debugger, binary inspection, emulation, and binary diffing. Command-line utilities support analyzing, disassembling, patching, comparing, searching, replacing, and visualizing data. Users can write scripts in languages including Python, Haskell, OCaml, and JavaScript. Cutter is Rizin’s official graphical interface and uses Rizin as its backend. The framework supports plugins, which rz-pm can compile and install; the package manager is described as early in development. Rizin can match unnamed functions against FLIRT signatures from sigdb to help identify common code in stripped binaries. The project also lists decompilation, firmware analysis, hybrid analysis, and a plugin API. Installation routes are provided for Linux, Windows, macOS, OpenBSD, and Android. The project says its work is currently in beta, and community discussion and support are available through Mattermost, Telegram, and IRC.