{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/README.md#L170-L199",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/pyproject.toml",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/CHANGELOG.md",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/.github/workflows/ci.yml",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/.github/workflows/perf_benchmark.yml",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/AGENTS.md",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/tests/aarch64_macho_corpus/README.md",
    "https://github.com/danielplohmann/smda/tree/04652e6662fde57d146a14d80399e2c1d128e26b/tests",
    "https://github.com/danielplohmann/smda/tree/04652e6662fde57d146a14d80399e2c1d128e26b/data",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/LICENSE",
    "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/NOTICE",
    "https://github.com/danielplohmann/smda/releases/tag/v5.0.1",
    "https://pypi.org/project/smda/5.0.1/"
  ],
  "category": "binary-libraries",
  "description_en": "Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends. Its JSON reports list functions, basic blocks, instructions and the edges between them, enriched with symbols from imports, exports, PDB, Go, Rust and Delphi metadata, referenced strings, Windows API references inferred with the ApiScout method and position-independent code hashes. Function discovery deliberately favours completeness over precision; the README names SMDA as capa's disassembler backend and MCRIT's code-analysis layer, and IDA Pro or Binary Ninja analyses can be exported into the same report format.",
  "description_zh": "基于 Capstone 的 Python 递归反汇编库，借助 x86/x64、AArch64、32 位 ARM/Thumb、CIL 和 Dalvik 后端，从 PE、ELF、Mach-O 文件、.NET 程序集、原始 DEX 文件以及已知基址的内存转储中恢复控制流图。其 JSON 报告列出函数、基本块、指令及其间的边，并补充来自导入表、导出表、PDB、Go、Rust 与 Delphi 元数据的符号、被引用的字符串、用 ApiScout 方法推断的 Windows API 引用以及位置无关代码哈希。函数发现有意以完整性优先于精确性；README 称 SMDA 是 capa 的反汇编后端和 MCRIT 的代码分析层，IDA Pro 或 Binary Ninja 的分析结果也可导出为同一报告格式。",
  "entry_url": "https://awesomerea.org/resources/smda/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/smda/",
  "evidence_url": "https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/README.md",
  "group": "tools",
  "id": "smda",
  "json_url": "https://awesomerea.org/resources/smda/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/smda/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/smda/index.md",
  "name": "SMDA",
  "name_zh": "SMDA 递归反汇编库",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Reviewed at the v5.0.1 release commit of 2026-10-20, which is also the latest GitHub release and PyPI version; v5.0.0 of 2026-10-16 added the 32-bit ARM backend. The CHANGELOG states that version numbers are a release counter, not semantic versioning, and pyproject.toml classifies the package as Beta.",
    "pip install smda needs Python 3.11+ and pulls in capstone 5.0.2 or later below 6, demangle 0.6.0, dncil, dnfile, LIEF 0.16+ and purepdb. CI runs the tests on Python 3.11 to 3.14 on Ubuntu and on 3.11 on Windows and macOS. The analyze.py, batch_analyze.py and export scripts are not installed by pip and need a clone; the IDA frontend needs IDA Pro 8.4+, headless IDA export needs IDA 9.1+ with the optional ida-domain package, and Binary Ninja export needs a licensed Binary Ninja whose Python API is importable.",
    "The README rates the intel backend as production quality and benchmarked against other disassemblers, AArch64 as matching IDA closely on its test corpora, and the ARM, CIL and Dalvik backends as recent; the managed backends are not benchmarked on obfuscated code and report file offsets rather than virtual addresses. Dalvik accepts raw single-DEX files only, not APKs, multi-dex, ODEX or CDEX, and recognized machine types such as big-endian ARM32, MIPS, PowerPC, SPARC and RISC-V have no backend. Binaries, memory dumps and IDA or Binary Ninja databases come from the analyst; for a headerless dump pass the architecture and base address, and ApiScout resolution needs WinAPI profiles matching the dumped system, of which data/ bundles Windows 7 SP1 and Windows XP SP3 profiles. The default analysis budget is 300 seconds, enforced cooperatively, a timed-out report is a lower bound, and synthesizing binaries from reports is experimental.",
    "The tests use XOR-encoded binaries that are decoded in memory: programs built for the project, a DEX file whose classes are Apache HttpClient code (blockblast_classes_xored), and malware samples including Mirai builds for 12 architectures, Asprox, Cutwail, Bashlite, Komplex and njRAT, plus AArch64 Mach-O malware from Objective-See and Malpedia under tests/aarch64_macho_corpus, whose README forbids executing them. The CI benchmark additionally uses .github/workflows/data/malpedia.zip, a 74 MB password-protected Malpedia corpus whose password is a repository secret, so AGENTS.md says the benchmark cannot be reproduced locally.",
    "BSD-2-Clause (LICENSE); NOTICE lists third-party parts, including rust_demangler-derived code under MIT and MSVC symbol names from LLVM's demangler tests under Apache-2.0 with the LLVM exception. AGENTS.md gives guidance to AI coding agents working on the code."
  ],
  "requirements_zh": [
    "审阅对象为 2026-10-20 的 v5.0.1 发布提交，它也是 GitHub 和 PyPI 上的最新版本；2026-10-16 的 v5.0.0 新增了 32 位 ARM 后端。CHANGELOG 说明版本号只是发布计数，并非语义化版本；pyproject.toml 将该包标为 Beta。",
    "pip install smda 需要 Python 3.11+，并会安装 5.0.2 及以上但低于 6 的 capstone、demangle 0.6.0、dncil、dnfile、LIEF 0.16+ 和 purepdb。CI 在 Ubuntu 上用 Python 3.11 至 3.14、在 Windows 和 macOS 上用 3.11 运行测试。analyze.py、batch_analyze.py 和导出脚本不会随 pip 安装，需要克隆仓库；IDA 前端需要 IDA Pro 8.4+，无界面 IDA 导出需要 IDA 9.1+ 及可选的 ida-domain 包，Binary Ninja 导出则需要可导入其 Python API 的正版 Binary Ninja。",
    "README 将 intel 后端评为生产级并已与其他反汇编器对比测试，称 AArch64 在其测试语料上与 IDA 的结果非常接近，ARM、CIL 和 Dalvik 后端则较新；两个托管代码后端未在混淆代码上做过基准测试，报告的是文件偏移而非虚拟地址。Dalvik 只接受原始的单个 DEX 文件，不支持 APK、多 DEX、ODEX 或 CDEX；大端 ARM32、MIPS、PowerPC、SPARC、RISC-V 等可识别的机器类型没有对应后端。二进制文件、内存转储以及 IDA 或 Binary Ninja 数据库均由分析者提供；分析无文件头的转储时应传入架构和基址，ApiScout 解析需要与被转储系统相符的 WinAPI 配置文件，data/ 目录附带 Windows 7 SP1 和 Windows XP SP3 的配置文件。默认分析预算为 300 秒，以协作方式执行，超时的报告只是下限；根据报告合成二进制文件的功能仍属实验性质。",
    "测试使用在内存中解码的 XOR 编码二进制文件：为项目构建的程序、一个类均为 Apache HttpClient 代码的 DEX 文件（blockblast_classes_xored），以及恶意软件样本，包括 12 种架构的 Mirai 构建、Asprox、Cutwail、Bashlite、Komplex 和 njRAT，另有 tests/aarch64_macho_corpus 下来自 Objective-See 和 Malpedia 的 AArch64 Mach-O 恶意软件，其 README 禁止执行这些样本。CI 基准测试还使用 .github/workflows/data/malpedia.zip，这是一个 74 MB、带密码保护的 Malpedia 语料包，密码保存在仓库机密中，因此 AGENTS.md 说明该基准无法在本地复现。",
    "采用 BSD-2-Clause 许可（LICENSE）；NOTICE 列出第三方部分，包括以 MIT 许可、源自 rust_demangler 的代码，以及取自 LLVM 符号还原测试、以 Apache-2.0 加 LLVM 例外许可的 MSVC 符号名。AGENTS.md 为参与开发的 AI 编程代理提供指引。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/danielplohmann/smda",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}