Status: In use, not publicly released. GPL-2.0.
Re-execute a binary instruction by instruction, deterministically, as many
times as you need.
What it is
Cupelix Forge is the emulation half of the toolchain: a CPU emulator built for analysis
work, with a QEMU 11 core behind a Unicorn-compatible API.
It is two components. The engine layer handles orchestration, hooks and instrumentation —
the surface you actually work against. The core is the native CPU implementation, derived
from QEMU 11.0.
Why it is a separate program
This is a licensing boundary, not a presentation choice. Forge is GPL-2.0, inherited from
QEMU and permanently so. Sentinel is Apache-2.0. Those two licences cannot link, so the two
are separate executables that exchange capture artifacts as data across a process boundary.
Forge is not built into Sentinel, bundled with it, or embedded in it.
Keeping them apart is also how each stays useful on its own: Forge takes artifacts from
anything that can produce them, not only from Sentinel.
What the QEMU 11 core provides
Over the Unicorn 2.1.4 base it replaced: exact instruction counting, native AVX and AVX2,
full hook coverage, and native multi-vCPU. The CPU model is Skylake-Client.
The core is driven with no background vCPU thread and no QEMU main loop, which is what
makes a run reproducible instruction-for-instruction. Determinism is the point — an analysis
you cannot repeat exactly is an anecdote.
Availability
Neither repository is public, so there is no source link on this page. The licence is
GPL-2.0 today and this page will say so for as long as that is true.