Emulation FAQs

Question 1

What architectures and operating systems does Emulation support?

Accepted Answer

For lightweight CPU emulation via Unicorn, it supports x86, x64, ARM, ARM64, and MIPS. For full binary emulation via Qiling, it supports ELF binaries on Linux and PE binaries on Windows, requiring a corresponding rootfs.

Question 2

What is Emulation?

Accepted Answer

Emulation is a unified server for CPU and binary emulation, specifically designed to enhance reverse engineering and security testing workflows. It leverages Unicorn Engine for lightweight code execution and Qiling Framework for full OS-level analysis.

Question 3

What is the difference between Unicorn and Qiling modes in Emulation?

Accepted Answer

Unicorn mode provides lightweight CPU emulation for shellcode and code snippets across various architectures (x86, ARM, MIPS). Qiling mode offers full OS-level emulation, allowing you to load and run complete ELF/PE binaries with support for Linux and Windows environments.

Question 4

What features are available for reverse engineering and analysis?

Accepted Answer

Emulation provides instruction tracing, memory management, state snapshots, and persistent sessions. These features allow you to single-step code, log register/memory changes, save and restore emulation states for exploring different execution paths, and export evidence for reporting.

Question 5

Can Emulation help in analyzing OS-level interactions of a binary?

Accepted Answer

Yes, using the Qiling Framework backend, Emulation enables comprehensive OS-level analysis. This includes syscall and API hooking, filesystem, registry, and network emulation, allowing you to intercept and inspect all OS interactions.

Emulation

Emulation

Key Features

Use Cases

Key Features

Use Cases