Qiling Framework comes with a rich set of examples that demonstrate its features and capabilities. These examples are the best way to learn how to use Qiling for various tasks.

The official examples are located in the examples directory of the Qiling GitHub repository.

We encourage you to browse this directory to find examples relevant to your use case.

Here are some of the key categories of examples you can find:

• Basic Emulation: Simple scripts to run binaries for different platforms (Linux, Windows, macOS).
• Hooking: Examples that show how to use address hooks, code hooks, and syscall hooks.
• Malware Analysis: Scripts tailored for analyzing malicious software, such as unpacking samples and decrypting strings.
• Fuzzing: Harnesses and integrations with fuzzing engines like AFL++.
• Shellcode: Examples of how to run and analyze raw binary shellcode.
• OS-Specific Features: Scripts that demonstrate Windows registry manipulation, Linux syscall handling, and more.

1. Clone the Qiling repository:

   git clone https://github.com/qilingframework/qiling.git
   cd qiling

2. Install dependencies:

   pip install -r requirements.txt

3. Download the root filesystems: Many examples require a root filesystem. You can download them from the Qiling releases page.

   # You may need to unzip the downloaded rootfs archives

4. Run an example script:

   # Navigate to the examples directory
   cd examples
   
   # Run a specific example
   python linux/x8664_hello.py

By studying and modifying these examples, you can quickly learn how to build your own powerful analysis tools with Qiling.