AwesomeREA.org

Tool

SMDA

Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends. Its JSON reports list functions, basic blocks, instructions and the edges between them, enriched with symbols from imports, exports, PDB, Go, Rust and Delphi metadata, referenced strings, Windows API references inferred with the ApiScout method and position-independent code hashes. Function discovery deliberately favours completeness over precision; the README names SMDA as capa's disassembler backend and MCRIT's code-analysis layer, and IDA Pro or Binary Ninja analyses can be exported into the same report format.

Targets
Binary
Category
Binary analysis libraries
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Reviewed at the v5.0.1 release commit of 2026-10-20, which is also the latest GitHub release and PyPI version; v5.0.0 of 2026-10-16 added the 32-bit ARM backend. The CHANGELOG states that version numbers are a release counter, not semantic versioning, and pyproject.toml classifies the package as Beta.
  • pip install smda needs Python 3.11+ and pulls in capstone 5.0.2 or later below 6, demangle 0.6.0, dncil, dnfile, LIEF 0.16+ and purepdb. CI runs the tests on Python 3.11 to 3.14 on Ubuntu and on 3.11 on Windows and macOS. The analyze.py, batch_analyze.py and export scripts are not installed by pip and need a clone; the IDA frontend needs IDA Pro 8.4+, headless IDA export needs IDA 9.1+ with the optional ida-domain package, and Binary Ninja export needs a licensed Binary Ninja whose Python API is importable.
  • The README rates the intel backend as production quality and benchmarked against other disassemblers, AArch64 as matching IDA closely on its test corpora, and the ARM, CIL and Dalvik backends as recent; the managed backends are not benchmarked on obfuscated code and report file offsets rather than virtual addresses. Dalvik accepts raw single-DEX files only, not APKs, multi-dex, ODEX or CDEX, and recognized machine types such as big-endian ARM32, MIPS, PowerPC, SPARC and RISC-V have no backend. Binaries, memory dumps and IDA or Binary Ninja databases come from the analyst; for a headerless dump pass the architecture and base address, and ApiScout resolution needs WinAPI profiles matching the dumped system, of which data/ bundles Windows 7 SP1 and Windows XP SP3 profiles. The default analysis budget is 300 seconds, enforced cooperatively, a timed-out report is a lower bound, and synthesizing binaries from reports is experimental.
  • The tests use XOR-encoded binaries that are decoded in memory: programs built for the project, a DEX file whose classes are Apache HttpClient code (blockblast_classes_xored), and malware samples including Mirai builds for 12 architectures, Asprox, Cutwail, Bashlite, Komplex and njRAT, plus AArch64 Mach-O malware from Objective-See and Malpedia under tests/aarch64_macho_corpus, whose README forbids executing them. The CI benchmark additionally uses .github/workflows/data/malpedia.zip, a 74 MB password-protected Malpedia corpus whose password is a repository secret, so AGENTS.md says the benchmark cannot be reproduced locally.
  • BSD-2-Clause (LICENSE); NOTICE lists third-party parts, including rust_demangler-derived code under MIT and MSVC symbol names from LLVM's demangler tests under Apache-2.0 with the LLVM exception. AGENTS.md gives guidance to AI coding agents working on the code; the reviewed sources establish no REA connection. This review ran no SMDA analysis and executed no fixture.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · danielplohmann/smda · Revision 04652e6
  2. README.md#L170-L199 GitHub · danielplohmann/smda · Revision 04652e6
  3. pyproject.toml GitHub · danielplohmann/smda · Revision 04652e6
  4. CHANGELOG.md GitHub · danielplohmann/smda · Revision 04652e6
  5. .github/workflows/ci.yml GitHub · danielplohmann/smda · Revision 04652e6
  6. .github/workflows/perf_benchmark.yml GitHub · danielplohmann/smda · Revision 04652e6
  7. AGENTS.md GitHub · danielplohmann/smda · Revision 04652e6
  8. tests/aarch64_macho_corpus/README.md GitHub · danielplohmann/smda · Revision 04652e6
  9. tests GitHub · danielplohmann/smda · Revision 04652e6
  10. data GitHub · danielplohmann/smda · Revision 04652e6
  11. LICENSE GitHub · danielplohmann/smda · Revision 04652e6
  12. NOTICE GitHub · danielplohmann/smda · Revision 04652e6
  13. https://github.com/danielplohmann/smda/releases/tag/v5.0.1
  14. https://pypi.org/project/smda/5.0.1/

More in Native binaries

All 158 entries in Native binaries