Qiling Framework vs uncompyle6

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.

uncompyle6 is a free, GPL-3.0-licensed tool for translating compiled Python bytecode into equivalent Python source code. It runs on `.pyc` and `.pyo` files from the command line, and can also deparse code fragments or return source information around a bytecode offset. The README lists bytecode from Python 1.0 through 3.8, Dropbox Python 2.5 bytecode, and some PyPy bytecode as accepted inputs. Fragment deparsing is used in trepan debuggers to show source at runtime and can provide more stack-trace detail than a line number. The `--syntax-verify` option checks decompiled syntax when used with the matching bytecode version. Control-flow handling remains a major challenge, and some incorrect decompilations may be detected and reported. The tool does not handle obfuscated code, Cython, or MicroPython, and cannot directly decompile Py2EXE executables. Python 3.7 and 3.8 support is generally better in the related decompile3 project. Installation is through PyPI for Python 3.11 and later, or a GitHub Releases file for earlier Python versions. Platforms listed include Linux, macOS, Windows, and self-hosted use.