Installation

Installation

Requirements

Install Methods

pip (stable)

1python3 -m pip install qiling

pip (dev branch — recommended for latest fixes)

1python3 -m pip install --user https://github.com/qilingframework/qiling/archive/dev.zip

Clone from GitHub (for development)

1git clone -b dev https://github.com/qilingframework/qiling.git
2cd qiling
3git submodule update --init --recursive
4pip3 install .

Docker

1docker pull qilingframework/qiling:latest
2docker exec -it qiling bash

Use -p to publish ports (useful for emulating network services like router httpd).

1python3 -m venv qlenv
2
3# Activate on Linux/macOS
4. qlenv/bin/activate
5
6# Activate on Windows
7qlenv\Scripts\activate

Rootfs

Example rootfs files are in a separate repo (not bundled):

1git submodule update --init --recursive

Or clone separately from https://github.com/qilingframework/rootfs.

Windows DLL Setup

Due to legal restrictions, Windows DLLs and registry hives are not bundled. Run dllscollector.bat on a licensed Windows system with Administrator privileges:

1examples\scripts\dllscollector.bat

With Docker, bind-mount DLLs:

1docker run -dt --name qiling \
2  -v /analysis/win/rootfs/x86_windows:/qiling/examples/rootfs/x86_windows \
3  -v /analysis/win/rootfs/x8664_windows:/qiling/examples/rootfs/x8664_windows \
4  qilingframework/qiling:latest

macOS: Keystone Engine Workaround

On macOS >= 10.14 (Mojave), pip install keystone-engine fails because i386 is deprecated. Install from source:

1git clone https://github.com/keystone-engine/keystone
2cd keystone
3mkdir build && cd build
4../make-share.sh
5cd ../bindings/python
6sudo make install

Then run Qiling setup.