smda

What it is and what it does

SMDA is a Python library for analyzing compiled binaries and memory dumps by recovering their control flow structure. It reads PE, ELF, Mach-O, and raw memory files, then disassembles them using Capstone (for x86/x64 and ARM64) or specialized backends (for .NET CIL and Dalvik), producing a structured report of functions, basic blocks, instructions, and the edges between them. The library is optimized for accurate CFG recovery rather than speed, making it useful for malware analysis, reverse engineering, and binary instrumentation workflows.

The package includes both a single-file API and a batch processor for analyzing corpora in parallel. It can optionally infer Windows API references, integrate with IDA Pro to augment existing analysis, and export results as JSON or reconstruct binaries from recovered CFGs. Memory usage is dominated by the largest file in flight rather than accumulating across files, and performance can be tuned by disabling optional metadata calculations (hashing, nesting depth, strongly connected components) that downstream consumers may not need.

Use it for:

• Analyze malware samples to extract function boundaries and control flow for behavioral analysis or signature generation.
• Process memory dumps from running processes to recover function structure without relying on debug symbols.
• Batch-process a corpus of binaries in parallel to extract CFGs for machine learning or statistical analysis.
• Augment IDA Pro's conservative function detection by running SMDA's independent analysis and importing missing function starts back into IDA.
• Extract Windows API call patterns from PE binaries by using the ApiScout method to infer API references.
• Analyze Dalvik bytecode from raw DEX files to understand Android application control flow.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

SMDA is a recursive disassembler library that recovers control flow graphs from binary files and memory dumps, supporting x86/x64, AArch64, .NET CIL, and Dalvik bytecode with output as functions, basic blocks, and instruction-level edges.

Yes. SMDA is actively maintained, has no known vulnerabilities, uses a permissive license, and offers a well-designed API for CFG recovery across multiple architectures and file formats. Install it if you need to extract control flow structure from binaries or memory dumps; avoid it if you only need basic disassembly without CFG analysis or if you require Python versions below 3.11.

Install

smda on PyPI

pip install smda

uv add smda

poetry add smda

Installing smda

Before you install

Installation is straightforward with low friction; the package is actively maintained with a release 3 days ago and requires Python 3.11 or newer. Five runtime dependencies (capstone, dncil, dnfile, lief, pycxxfilt) are all standard tools in the binary analysis ecosystem.

License in practice

BSD 2-Clause is a permissive license with minimal restrictions, allowing commercial and private use without requiring source disclosure of derivative works.

Quickstart

pip install smda

from smda.Disassembler import Disassembler
disassembler = Disassembler()
report = disassembler.disassembleFile("/bin/cat")
for fn in report.getFunctions():
    for ins in fn.getInstructions():
        print(ins)

Requires Python 3.11 or newer; disassembly is CPU-bound and memory usage scales with the largest binary being analyzed (one 3 MB binary reached ~1.8 GB resident memory).

Verify before relying

• Performance characteristics on binaries larger than the measured 3 MB test case.
• Whether IDA Pro integration (IDA 8.4+) is available in standard installations or requires the optional ida-domain package.
• Accuracy metrics for CFG recovery compared to other disassemblers on real-world binaries.

Package facts

Evidence: smda-4.4.7-py3-none-any.whl

Tags

More Security packages