# QBDI

> Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. The engine is a library that can start an instrumented execution anywhere in a process, scripted from C, C++, Python (PyQBDI) or Frida JavaScript. It has no preferred injection method: it bundles the LD_PRELOAD-based QBDIPreload for Linux and macOS dynamic executables and is integrated with Frida.

- Type: Tool
- Targets: App · Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/QBDI/QBDI>
- Primary source: <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst>
- Catalog page: <https://awesomerea.org/resources/qbdi/>
- Record JSON: <https://awesomerea.org/resources/qbdi/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/qbdi/index.md)

## Requirements & limits

- The README status table supports execution and memory-access information for x86-64 and x86 on Android, Linux, macOS and Windows, ARM on Android and Linux, and AArch64 on Android, Linux, macOS and iOS; iOS support is described as unstable and needs a jailbroken device. Latest release at review: v0.12.1, published 2026-01-07, with Android, iOS, macOS and Windows packages; Linux packages last appear in v0.12.0 (2025-10-14). PyQBDI 0.12.1 on PyPI requires Python 3.8+.
- The reviewed dev-next commit is 12 commits ahead of v0.12.1; the README says all new work merges there and there is no scheduled release plan. Source builds need CMake 3.12+, Ninja or Make and a C++17 toolchain, and build a bundled LLVM statically because QBDI uses private LLVM APIs of one specific version; per-platform configuration scripts cover Linux, macOS, Windows (with a native Python 3 and Visual Studio) and Android NDK cross-compilation.
- The README states that QBDI does not handle signals, new-thread creation or C++ exceptions. Its documentation adds that the instrumentation tool shares the target's heap and libraries, so non-reentrant code such as the heap allocator should be left to the execution broker outside the instrumentation range, and the OS loader itself cannot be instrumented. Users supply their own target programs and an injection route.
- LICENSE.txt places QBDI under Apache-2.0 and lists statically linked components: LLVM (Apache-2.0 with LLVM exceptions), spdlog, fmtlib, Catch2, pybind11 and a GPLv3/Apache-2.0 SHA-256 implementation; GitHub could not classify the combined file.

## Primary sources

1. <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst>
2. <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst#L18-L52>
3. <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/docs/source/intro.rst>
4. <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/docs/source/api_description.rst>
5. <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/docs/source/changelog.rst>
6. <https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/LICENSE.txt>
7. <https://github.com/QBDI/QBDI/releases/tag/v0.12.1>
8. <https://pypi.org/project/PyQBDI/0.12.1/>

## More in Native binaries

- [binsider](https://awesomerea.org/resources/binsider/index.md) · Tool
- [iced](https://awesomerea.org/resources/iced/index.md) · Tool
- [hrtng](https://awesomerea.org/resources/hrtng/index.md) · Tool
- [BinCAT](https://awesomerea.org/resources/bincat/index.md) · Tool
- [GEF (GDB Enhanced Features)](https://awesomerea.org/resources/gef/index.md) · Tool
- [Triton](https://awesomerea.org/resources/triton/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.