Qiling: A true instrumentable binary emulation framework

github.com

52 points·matthberg··5 comments

I don't understand what "emulating executables" means and reading through the text didn't clear that up.

So it's an emulator that emulates whole platforms so one could run windows executables on other platforms, without any required extras? Like having WINE combined with an actual emulator?

I'm confused. Is this a tool for 80s style crackers to write the modern equivalent of trainers?

Anyone experienced with this? How well does it work?

I use it to help validate the reverse engineering of some 2000s, 2010s game security components (DLLs, etc). Support for windows is pretty good with other platforms lagging behind but still usable.

For usermode fuzzing it's pretty nice and easy to get running, but for more advanced cases I ended up using the underlying unicorn-afl directly. IIRC it wasn't loading some ELF correctly (this was some years ago).

I integrated Unicorn, the underlying qemu-as-a-library, into my emulator project:

https://neugierig.org/software/blog/2023/11/retrowin32-unico...

My experience with it was that it was a lot slower than my (not very good) emulator, I imagine because I was some using it wrong somehow (? qemu is high quality software). And also as I was using it I was managing to corrupt state somehow in a way that meant it didn't end up ultimately helping with the thing I was trying to debug.

Reply on news.ycombinator.com