qiling

qilingframework/qiling

Fork 0

mirror of https://github.com/qilingframework/qiling.git synced 2026-10-12 02:21:40 +00:00

T

naq 85851e263e Readme: add a license section

2019-09-15 22:29:40 +08:00

docs

import

2019-08-23 01:30:01 +08:00

AUTHORS.TXT

Update AUTHORS.TXT

2019-09-09 00:39:01 +08:00

COPYING

import

2019-08-23 01:30:01 +08:00

README.md

Readme: add a license section

2019-09-15 22:29:40 +08:00

requirements.txt

import

2019-08-23 01:30:01 +08:00

setup.py

Update setup.py

2019-08-23 01:36:20 +08:00

README.md

Qiling - Advanced Binary Emulation framework

Qiling is an advanced binary emulation framework, with the following features:

Cross platform: Windows, MacOS, Linux, BSD
Cross architecture: X86, X86_64, Arm, Arm64, Mips
Multiple file formats: PE, MachO, ELF
Emulate & sandbox machine code in a isolated enviroment
Provide high level API to setup & configure the sandbox
Fine-grain instrumentation: allow hooks at various levels (instruction/basic-block/memory-access/exception/syscall/IO/etc)
Allow dynamic hotpatch on-the-fly running code, including the loaded library
True framework in Python, making it easy to build customized security analysis tools on top

Qiling is backed by Unicorn engine.

Visit our website https://www.qiling.io for more information.

Announcement

We are currently in Alpha test phase, that will be followed by public beta release.

This is a call for testers: please email your short instroduction, with github/gitlab ID to [email protected] for shortlisting.

Evaluation will be based on your open source participation.

License

This project is released and distributed under free software license GPLv2.

Install

Run below command line to install Qiling (NOTE: you may need sudo on your platform to install to system directory).

python3 setup.py install

Examples

Below example shows how to use Qiling framework to emulate a Windows EXE on a Linux machine.

from qiling import *

# sandbox to emulate the EXE
def my_sandbox(path, rootfs):
    # setup Qiling engine
    ql = Qiling(path, rootfs)
    # now emulate the EXE
    ql.run()

if __name__ == "__main__":
    # execute Windows EXE under our rootfs
    my_sandbox(["examples/rootfs/x86_windows/bin/x86-windows-hello.exe"], "examples/rootfs/x86_windows")

Below example shows how to use Qiling framework to dynamically patch a Windows crackme, make it always display "Congratulation" dialog.

from qiling import *

def force_call_dialog_func(ql):
    # get DialogFunc address
    lpDialogFunc = ql.unpack32(ql.mem_read(ql.sp - 0x8, 4))
    # setup stack memory for DialogFunc
    ql.stack_push(0)
    ql.stack_push(1001)
    ql.stack_push(273)
    ql.stack_push(0)
    ql.stack_push(0x0401018)
    # force EIP to DialogFunc
    ql.pc = lpDialogFunc


def my_sandbox(path, rootfs):
    ql = Qiling(path, rootfs)
    # NOP out some code
    ql.patch(0x004010B5, b'\x90\x90')
    ql.patch(0x004010CD, b'\x90\x90')
    ql.patch(0x0040110B, b'\x90\x90')
    ql.patch(0x00401112, b'\x90\x90')
    # hook at an address with a callback
    ql.hook_address(0x00401016, force_call_dialog_func)
    ql.run()


if __name__ == "__main__":
    my_sandbox(["rootfs/x86_windows/bin/Easy_CrackMe.exe"], "rootfs/x86_windows")

The below Youtube video shows how the above example works.

Wannacry demo

The below Youtube video shows how Qiling analyzes Wannacry malware.

Qltool

Qiling also provides a friendly tool named qltool to quickly emulate shellcode & executable binaries.

To emulate a binary, run:

$ ./qltool run -f examples/rootfs/arm_linux/bin/arm32-hello --rootfs examples/rootfs/arm_linux/

To run shellcode, run:

$ ./qltool shellcode --os linux --arch x86 --asm -f examples/shellcodes/lin32_execve.asm

Contact

Get the latest info from out webiste https://www.qiling.io

任何疑问请联系麒麟框架官方微博

Core developers

LAU kaijern (xwings) [email protected]
NGUYEN Anh Quynh [email protected]
DING tianZe (D1iv3) [email protected]
SUN bowen (w1tcher) [email protected]
CHEN huitao (null) [email protected]
YU tong (sp1ke) [email protected]