Qiling Framework vs Vivisect

Qiling Framework is free software for emulating and instrumenting binaries for reverse engineering and security analysis. It runs machine code in an isolated environment and supports debugging across architectures and platforms. Listed architectures include x86, x86_64, ARM, ARM64, MIPS, and 8086; supported formats include PE, Mach-O, ELF, and COM. Hooks can observe instructions, basic blocks, memory access, exceptions, system calls, and I/O. APIs provide access to registers, memory, filesystems, operating systems, debugging, and execution-state saving and restoration. Qiling can also hot patch running code, including loaded libraries. Its IDA Pro plugin can emulate binaries in IDA, display live context, run scripts, save and load snapshots, and deobfuscate code. Qiling uses Unicorn for CPU emulation and adds operating-system awareness, executable loading, dynamic linking, and syscall and I/O handling. Installation options include pip, source, and Docker. It is licensed under GPL version 2 or a later version at the user's option. Some syscalls or operating-system APIs may not be implemented, and users may need to implement or map them.

Vivisect is a free, Apache-2.0 static analysis platform for binaries, with the related Vdb tool providing cross-platform debugging. Its pure-Python tools perform static and dynamic analysis, including built-in static and symbolic analysis, in a hybrid workflow. Analysis can run through an extensible UI, scripts, an API, or headlessly; command-line bulk processing can save a .viv workspace. Distributed analysis is available through cobra. Vivisect runs on Linux, macOS, and Windows, and lists i386, amd64, ARMv7, Thumb16, Thumb, AArch64, MSP430, and H8 architectures. Python 3.6 and newer are supported and installation is available through pip. The gui extra adds PyQt5 dependencies. Workspaces can be shared between instances or served over a network or localhost, with connected updates propagating as events arrive. Vdb can attach by process ID or command-line substring, or start and attach to a process.