How qilingframework/qiling works
Qiling is a Python binary-emulation and analysis framework built on Unicorn. A user configures a Qiling instance with a binary, root filesystem, platform, and architecture; the core coordinates loading, machine state, and emulation, while OS services and optional hardware models support the guest. Instrumentation, debugging, patching, and analysis extensions build on that runtime. The README documents broad platform, format, and analysis capabilities; some subsystem links below rely on that documentation because their implementation was not sampled.
Main entry points: core.py Qiling runtime · os.py OS runtime · loader.py Binary loaders · memory.py Guest memory
Components 22
Emulation runtime
- Qiling runtime
qiling/core.py - CPU architectures
qiling/arch - Guest memory
qiling/os/memory.py - Core structures
qiling/os/struct.py - Binary loaders
qiling/loader/loader.py - Executable formats
qiling/loader - Hook dispatch
qiling/core_hooks.py
Guest platforms
- OS runtime
qiling/os/os.py - Linux services
qiling/os/linux - Windows services
qiling/os/windows - macOS services
qiling/os/macos - MCU platforms
qiling/os/mcu - UEFI services
qiling/os/uefi
Device emulation
- Virtual hardware
qiling/hw/hw.py - MCU models
qiling/extensions/mcu
Analysis tools
- Debuggers
qiling/debugger - Coverage tools
qiling/extensions/coverage - Execution tracing
qiling/extensions/tracing - IDA integration
qiling/extensions/idaplugin/qilingida.py
Extensions
- AFL fuzzing
qiling/extensions/afl - Heap sanitizer
qiling/extensions/sanitizers/heap.py
Other components
- Framework user
Connections 24
- Framework user → Qiling runtime: configures and runs
README.md - Qiling runtime → CPU architectures: initializes
qiling/core.py - Qiling runtime → Guest memory: initializes
qiling/core.py - Qiling runtime → Binary loaders: runs loader
qiling/core.py - Qiling runtime → OS runtime: initializes
qiling/core.py - Qiling runtime → Virtual hardware: initializes
qiling/core.py - Qiling runtime → Hook dispatch: inherits hooks
qiling/core.py - Core structures → Guest memory: reads and writes
qiling/os/struct.py - Binary loaders → Executable formats: loads binaries
README.md - Binary loaders → Guest memory: maps images
- OS runtime → Linux services: selects platform
README.md - OS runtime → Windows services: selects platform
README.md - OS runtime → macOS services: selects platform
README.md - OS runtime → MCU platforms: selects platform
README.md - OS runtime → UEFI services: selects platform
README.md - MCU platforms → MCU models: models boards
- MCU models → Virtual hardware: uses peripherals
- Framework user → Debuggers: debugs execution
README.md - Framework user → Coverage tools: analyzes coverage
README.md - Framework user → Execution tracing: traces execution
README.md - Framework user → IDA integration: integrates analysis
qiling/extensions/idaplugin/qilingida.py - Framework user → AFL fuzzing: fuzzes binaries
README.md - Framework user → Heap sanitizer: checks heap use
- Qiling runtime → Hook dispatch: dispatches callbacks
qiling/core_hooks.py