{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/LICENSE",
    "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/makefile",
    "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/.github/workflows/main.yml",
    "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/docker/README.md",
    "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/docker/Dockerfile",
    "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/api/plugin_support.h",
    "https://github.com/beehive-lab/mambo/tree/dcdf19a751092c18cccc1e31fea684dfc599c8b8/plugins",
    "https://github.com/beehive-lab/mambo/tree/dcdf19a751092c18cccc1e31fea684dfc599c8b8/test",
    "https://doi.org/10.1145/2896451"
  ],
  "category": "dynamic-analysis",
  "description_en": "Dynamic binary modification framework from the University of Manchester that runs unmodified Linux user-space programs on 32-bit Arm (A32/T32), AArch64 and RV64GC RISC-V, translating their code into a code cache as it executes. An event-driven C plugin API registers callbacks on code-scanning and execution events and emits instrumentation; sample plugins count instruction mixes, branches and blocks, trace memory accesses and system calls, find hotspots, simulate caches, check memory errors and detect data races.",
  "description_zh": "曼彻斯特大学开发的动态二进制修改框架，可在 32 位 Arm（A32/T32）、AArch64 和 RV64GC RISC-V 上运行未经修改的 Linux 用户态程序，并在执行过程中把代码翻译到代码缓存里运行。事件驱动的 C 插件 API 可在代码扫描与执行事件上注册回调并生成插桩代码；示例插件可统计指令构成、分支与基本块次数，跟踪内存访问和系统调用，查找热点，模拟缓存，检查内存错误并检测数据竞争。",
  "entry_url": "https://awesomerea.org/resources/mambo/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/mambo/",
  "evidence_url": "https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/README.md",
  "group": "tools",
  "id": "mambo",
  "json_url": "https://awesomerea.org/resources/mambo/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/mambo/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/mambo/index.md",
  "name": "MAMBO",
  "name_zh": "MAMBO 动态二进制修改框架",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The reviewed master commit of 2025-01-21 updates the HiPEAC 2025 tutorial. There are no versioned releases; GitHub releases 1 and 2 only host talk slides. The README says application compatibility is improved as needed, lists SPEC CPU2006, PARSEC 3.0, GCC, LibreOffice and GIMP among programs that work on Arm, and notes that most development happens in a private tree.",
    "Builds and runs on an Armv7, Armv8 or RV64GC Linux system, physical or virtual, with GCC, libelf development files and Ruby 1.9.1+; the build generates instruction encoders and decoders from the bundled PIE specifications and links dbm statically. The authors use armhf/arm64 Debian, Ubuntu and Arch Linux ARM and Ubuntu 22.04 on RISC-V; for other hosts, a Dockerfile downloads Ubuntu 24.04 preinstalled server images for Arm64 and RISC-V and runs them under QEMU. Plugins are compiled in through the makefile's PLUGINS list.",
    "Known issues listed in the README: SA_SIGINFO handlers receive incorrect siginfo_t data, synchronous-signal handlers cannot sigreturn, code-cache invalidation after munmap or cache flushes only happens in the calling thread, and RISC-V signal handling is incomplete. MAMBO is not designed to protect itself from the program it translates, so the README says it cannot serve as a secure sandbox without hardening.",
    "CI builds MAMBO in Ubuntu 20.04 chroots under QEMU user emulation for arm64, armhf and riscv64 and only runs /bin/ls under it; the instruction, signal and self-modifying-code programs in test/ are not run by CI. The authors ask users to cite their 2016 ACM TACO paper and list later ICPE 2018, CC 2020, VEE 2020 and ISPASS 2023 papers.",
    "Apache-2.0, with the same license in pie/. Programs to instrument are supplied by the user."
  ],
  "requirements_zh": [
    "所审阅的 master 提交（2025-01-21）更新了 HiPEAC 2025 教程。项目没有带版本号的发布；GitHub 上的 1 和 2 两个发布只用于存放演讲幻灯片。README 称会按需改进应用兼容性，列出 SPEC CPU2006、PARSEC 3.0、GCC、LibreOffice 和 GIMP 等可在 Arm 上正常运行的程序，并说明大部分开发在私有仓库中进行。",
    "需在 Armv7、Armv8 或 RV64GC 的 Linux 系统（物理机或虚拟机）上构建和运行，依赖 GCC、libelf 开发文件和 Ruby 1.9.1+；构建时会根据随附的 PIE 规格生成指令编码器与解码器，并静态链接 dbm。作者使用 armhf/arm64 版 Debian、Ubuntu 和 Arch Linux ARM，以及 RISC-V 上的 Ubuntu 22.04；对于其他主机，Dockerfile 会下载 Arm64 和 RISC-V 的 Ubuntu 24.04 预装服务器镜像并在 QEMU 中运行。插件需通过 makefile 的 PLUGINS 列表编译进来。",
    "README 列出的已知问题：SA_SIGINFO 处理函数收到的 siginfo_t 数据不正确，同步信号的处理函数无法 sigreturn，munmap 或缓存刷新后的代码缓存失效只在发起调用的线程中进行，RISC-V 上的信号处理也不完整。MAMBO 并非为防范被翻译程序的攻击而设计，因此 README 指出未经加固不能用作安全沙箱。",
    "CI 在 QEMU 用户态模拟下的 Ubuntu 20.04 chroot 中为 arm64、armhf 和 riscv64 构建 MAMBO，且只在其下运行 /bin/ls；test/ 中的指令、信号与自修改代码测试程序不在 CI 中运行。作者请使用者引用其 2016 年的 ACM TACO 论文，并列出之后的 ICPE 2018、CC 2020、VEE 2020 和 ISPASS 2023 论文。",
    "采用 Apache-2.0，pie/ 目录中也附有相同许可证。待插桩的程序由使用者提供。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/beehive-lab/mambo",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}