{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst#L18-L52",
    "https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/docs/source/intro.rst",
    "https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/docs/source/api_description.rst",
    "https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/docs/source/changelog.rst",
    "https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/LICENSE.txt",
    "https://github.com/QBDI/QBDI/releases/tag/v0.12.1",
    "https://pypi.org/project/PyQBDI/0.12.1/"
  ],
  "category": "dynamic-analysis",
  "description_en": "Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. The engine is a library that can start an instrumented execution anywhere in a process, scripted from C, C++, Python (PyQBDI) or Frida JavaScript. It has no preferred injection method: it bundles the LD_PRELOAD-based QBDIPreload for Linux and macOS dynamic executables and is integrated with Frida.",
  "description_zh": "Quarkslab 开发的模块化动态二进制插桩（DBI）框架：在目标进程内部按基本块对程序进行 JIT 重编译，使插桩工具可以在指令执行前后、内存读写以及虚拟机事件上注册回调。引擎以库的形式提供，可在进程中任意位置启动插桩执行，并可通过 C、C++、Python（PyQBDI）或 Frida JavaScript 编写脚本。它不绑定特定注入方式：自带基于 LD_PRELOAD 的 QBDIPreload，用于 Linux 和 macOS 动态可执行文件，并已与 Frida 集成。",
  "entry_url": "https://awesomerea.org/resources/qbdi/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/qbdi/",
  "evidence_url": "https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst",
  "group": "tools",
  "id": "qbdi",
  "json_url": "https://awesomerea.org/resources/qbdi/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/qbdi/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/qbdi/index.md",
  "name": "QBDI",
  "name_zh": "QBDI 动态二进制插桩框架",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The README status table supports execution and memory-access information for x86-64 and x86 on Android, Linux, macOS and Windows, ARM on Android and Linux, and AArch64 on Android, Linux, macOS and iOS; iOS support is described as unstable and needs a jailbroken device. Latest release at review: v0.12.1, published 2026-01-07, with Android, iOS, macOS and Windows packages; Linux packages last appear in v0.12.0 (2025-10-14). PyQBDI 0.12.1 on PyPI requires Python 3.8+.",
    "The reviewed dev-next commit is 12 commits ahead of v0.12.1; the README says all new work merges there and there is no scheduled release plan. Source builds need CMake 3.12+, Ninja or Make and a C++17 toolchain, and build a bundled LLVM statically because QBDI uses private LLVM APIs of one specific version; per-platform configuration scripts cover Linux, macOS, Windows (with a native Python 3 and Visual Studio) and Android NDK cross-compilation.",
    "The README states that QBDI does not handle signals, new-thread creation or C++ exceptions. Its documentation adds that the instrumentation tool shares the target's heap and libraries, so non-reentrant code such as the heap allocator should be left to the execution broker outside the instrumentation range, and the OS loader itself cannot be instrumented. Users supply their own target programs and an injection route.",
    "LICENSE.txt places QBDI under Apache-2.0 and lists statically linked components: LLVM (Apache-2.0 with LLVM exceptions), spdlog, fmtlib, Catch2, pybind11 and a GPLv3/Apache-2.0 SHA-256 implementation; GitHub could not classify the combined file."
  ],
  "requirements_zh": [
    "README 的状态表显示，x86-64 和 x86 在 Android、Linux、macOS 和 Windows 上，ARM 在 Android 和 Linux 上，AArch64 在 Android、Linux、macOS 和 iOS 上均支持执行与内存访问信息；iOS 支持被描述为不稳定，且需要越狱设备。审阅时最新版本为 v0.12.1，发布于 2026-01-07，提供 Android、iOS、macOS 和 Windows 软件包；Linux 软件包最后见于 v0.12.0（2025-10-14）。PyPI 上的 PyQBDI 0.12.1 需要 Python 3.8+。",
    "所审阅的 dev-next 提交领先 v0.12.1 共 12 个提交；README 说明所有新功能都合并到该分支，且没有固定的发布计划。从源码构建需要 CMake 3.12+、Ninja 或 Make 以及 C++17 工具链，并会静态构建自带的 LLVM，因为 QBDI 使用特定版本 LLVM 的私有 API；各平台的配置脚本涵盖 Linux、macOS、Windows（需原生 Python 3 和 Visual Studio）以及基于 Android NDK 的交叉编译。",
    "README 说明 QBDI 不处理信号、新线程创建和 C++ 异常。其文档还指出，插桩工具与目标程序共用堆和库，因此堆分配器等不可重入代码应交给插桩范围之外的执行代理处理，且操作系统加载器本身无法插桩。用户需自备目标程序和注入途径。",
    "LICENSE.txt 说明 QBDI 采用 Apache-2.0 许可，并列出静态链接的组件：LLVM（Apache-2.0 附 LLVM 例外）、spdlog、fmtlib、Catch2、pybind11，以及采用 GPLv3/Apache-2.0 的 SHA-256 实现；GitHub 无法识别这份合并许可文件。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/QBDI/QBDI",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}