qiling-emulation
Use when you need to emulate or sandbox a native ARM/ARM64 shared object off-device — running the Battle Cats Android .so (or any Android/Linux ELF native library) inside the Qiling framework on the PC instead of on a rooted phone. This is the dynamic-OFF-device complement to the frida skill (dynamic-ON-device) and to the static ghidra/radare2/ida skills — reach for it to call a single exported native function with controlled inputs, brute-force or trace an algorithm (save crypto, PRNG, checksum, offset math) without the game engine or a device, hook native calls in a scriptable sandbox, or diff native behavior across app versions. Do NOT use for Java/Smali (use jadx), for live on-device instrumentation (use frida), or for pure static disassembly (use ghidra/radare2).
- License 许可
- MIT
- 最近更新
- 2026-11-02
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- qiling-emulation
- description
- Use when you need to emulate or sandbox a native ARM/ARM64 shared object off-device — running the Battle Cats Android .so (or any Android/Linux ELF native library) inside the Qiling framework on the PC instead of on a rooted phone. This is the dynamic-OFF-device complement to the frida skill (dynamic-ON-device) and to the static ghidra/radare2/ida skills — reach for it to call a single exported native function with controlled inputs, brute-force or trace an algorithm (save crypto, PRNG, checksum, offset math) without the game engine or a device, hook native calls in a scriptable sandbox, or diff native behavior across app versions. Do NOT use for Java/Smali (use jadx), for live on-device instrumentation (use frida), or for pure static disassembly (use ghidra/radare2).
03 SKILL.md 正文
Qiling Emulation (off-device native sandbox)
Overview
Qiling is a Python binary-emulation framework built on Unicorn (the CPU emulator behind
QEMU) plus Capstone/Keystone. It loads a native ELF (.so/executable) for a different
architecture — e.g. Android arm64-v8a — and runs it on your x86-64 Windows PC with no
device and no game process. You script it in Python: set registers/memory, call one
exported function, read the result, hook any address.
Use it as the dynamic-off-device leg of the RE stack:
| Need | Tool |
|---|---|
| Live truth from the running app on a phone | frida (dynamic on-device) |
| Static structure / decompilation | ghidra-mcp / radare2 / ida-pro-mcp |
| Run one native function in a PC sandbox, no device | this skill (Qiling) |
| Solve for an input that reaches a branch | angr |
Sweet spot for Battle Cats (jp.co.ponos.battlecatsen, custom PONOS C++/GLES engine): the
native code lives in lib/arm64-v8a/*.so inside the APK. When you have already located a
self-contained routine in Ghidra (save encrypt/decrypt, a checksum, an offset/schedule
computation, a PRNG) and want to exercise it with many inputs or confirm your
understanding, emulate just that function off-device instead of standing up a rooted device
- frida session.
Setup (venv — REQUIRED, do not use the base interpreter)
Qiling/Unicorn wheels do not build on the machine's default Python 3.14 (bleeding edge — same class of incompatibility that deferred AiZynthFinder). Create a dedicated venv on
from any working dir; keep this venv out of git
sanity
Smallest proof (this actually runs — verified)
Workflow: call one exported function of the BC .so
rootfs must match the .so's ABI (arm64 android). Point argv at the .so so Qiling maps it.
put args in x0..x7 (AArch64 AAPCS), allocate scratch memory for pointers as needed
Common mistakes
Relationship to the RE harness
Reference
04 同仓库更多 Skills
clarify-requirements
Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.
openmm-md
Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein / protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.
visual-review
Take screenshots of web pages and UI using Playwright for visual review and iteration
status
Diagnostic status report — shows metaswarm installation state, project setup, and potential issues
start
Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work
setup
Interactive project setup — detects your project, configures metaswarm, writes project-local files