smda 4.2.0__tar.gz → 4.2.2__tar.gz

{smda-4.2.0/src/smda.egg-info → smda-4.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: smda
-Version: 4.2.0
+Version: 4.2.2
 Summary: A recursive disassmbler optimized for CFG recovery from memory dumps. Based on capstone.
 Author-email: Daniel Plohmann <daniel.plohmann@mailbox.org>
 License: BSD 2-Clause
@@ -146,6 +146,8 @@ make test
 
 ## Version History
 
+ * 2026-07-09: v4.2.2 - Now also parsing delay import tables from Windows PEs.
+ * 2026-07-09: v4.2.1 - Better detection of CFG instructions with prefixes, improved accuracy of gap search. (THX: @r0ny123) IDA ARM64 export.
  * 2026-06-24: v4.2.0 - Further improvements for inter-procedural operand escaping (closer to x86_x64 and traditional PIC hashing).
  * 2026-06-23: v4.1.0 - Significantly extended Aarch64 mnemonic escapes and improved PIC/OPC hashing. (THX: @r0ny123)
  * 2026-06-23: v4.0.2 - Improvements to Aarch64 function recovery, adressing tailcalls and gap function cornercases.

{smda-4.2.0 → smda-4.2.2}/README.md

@@ -105,6 +105,8 @@ make test
 
 ## Version History
 
+ * 2026-07-09: v4.2.2 - Now also parsing delay import tables from Windows PEs.
+ * 2026-07-09: v4.2.1 - Better detection of CFG instructions with prefixes, improved accuracy of gap search. (THX: @r0ny123) IDA ARM64 export.
  * 2026-06-24: v4.2.0 - Further improvements for inter-procedural operand escaping (closer to x86_x64 and traditional PIC hashing).
  * 2026-06-23: v4.1.0 - Significantly extended Aarch64 mnemonic escapes and improved PIC/OPC hashing. (THX: @r0ny123)
  * 2026-06-23: v4.0.2 - Improvements to Aarch64 function recovery, adressing tailcalls and gap function cornercases.

{smda-4.2.0 → smda-4.2.2}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=64.0.0,<82.1.0", "wheel>=0.47.0"]
+requires = ["setuptools>=64.0.0,<83.1.0", "wheel>=0.47.0"]
 build-backend = "setuptools.build_meta"
 
 [project]

{smda-4.2.0 → smda-4.2.2}/src/smda/SmdaConfig.py

@@ -4,7 +4,7 @@ import os
 
 class SmdaConfig:
     # keep this in sync with smda.__version__
-    VERSION = "4.2.0"
+    VERSION = "4.2.2"
     ESCAPER_DOWNWARD_COMPATIBILITY = "1.13.16"
     CONFIG_FILE_PATH = str(os.path.abspath(__file__))
     PROJECT_ROOT = str(os.path.abspath(os.sep.join([CONFIG_FILE_PATH, "..", "..", ".."])))

smda-4.2.2/src/smda/__init__.py

@@ -0,0 +1 @@
+__version__ = "4.2.2"

{smda-4.2.0 → smda-4.2.2}/src/smda/aarch64/AArch64Backend.py

@@ -130,6 +130,7 @@ class AArch64Backend(ArchBackend):
     @classmethod
     def _callFallthroughFunctionStart(cls, d, addr):
         if addr in d.fc_manager.getFunctionStartCandidates():
+            print(f"found candidate at call fallthrough 0x{addr:08x}")
             return addr
 
         cursor = addr
@@ -138,7 +139,13 @@ class AArch64Backend(ArchBackend):
             skipped_nop = True
             cursor += INSTRUCTION_SIZE
         if skipped_nop and cursor in d.fc_manager.getFunctionStartCandidates():
+            print(f"skipped NOPs, found candidate at 0x{cursor:08x}")
             return cursor
+        if skipped_nop and cursor % 16 == 0:
+            word = cls._wordAt(d, cursor)
+            if word not in (None, 0, NOP):
+                print(f"skipped NOPs, found non-NOP at 0x{cursor:08x}: 0x{word:08x}")
+                return cursor
         return None
 
     def _analyzeCondBranch(self, d, instruction, state):

{smda-4.2.0 → smda-4.2.2}/src/smda/common/RecursiveDisassembler.py

@@ -275,6 +275,7 @@ class RecursiveDisassembler:
             while True:
                 for i in cache:
                     i_address, i_size, i_mnemonic, i_op_str = i
+
                     i_op_str = i_op_str.strip()
                     i_relative_address = i_address - self.disassembly.binary_info.base_addr
                     i_bytes = self.disassembly.binary_info.binary[i_relative_address : i_relative_address + i_size]

{smda-4.2.0 → smda-4.2.2}/src/smda/common/SmdaFunction.py

@@ -199,20 +199,25 @@ class SmdaFunction:
         architecture = self.smda_report.architecture if self.smda_report else ""
         if architecture == "dalvik":
             return sum(1 for block in self.blocks.values() for ins in block if ins.mnemonic.startswith("invoke-"))
-        return sum(1 for block in self.blocks.values() for ins in block if ins.mnemonic == "call")
+        # capstone prepends mandatory prefixes (bnd/rep/lock/...) to the mnemonic string
+        return sum(1 for block in self.blocks.values() for ins in block if ins.mnemonic.split(" ")[-1] == "call")
 
     @property
     def num_returns(self):
         architecture = self.smda_report.architecture if self.smda_report else ""
         if architecture == "dalvik":
             return sum(1 for block in self.blocks.values() for ins in block if ins.mnemonic.startswith("return"))
-        return sum(1 for block in self.blocks.values() for ins in block if ins.mnemonic in ("ret", "retn"))
+        # capstone prepends mandatory prefixes (bnd/rep/lock/...) to the mnemonic string
+        return sum(
+            1 for block in self.blocks.values() for ins in block if ins.mnemonic.split(" ")[-1] in ("ret", "retn")
+        )
 
     def isApiThunk(self):
         if self.num_instructions != 1:
             return False
         first_ins = self.blocks[self.offset][0]
-        if first_ins.mnemonic not in ["jmp", "call"]:
+        # capstone prepends mandatory prefixes (bnd/rep/lock/...) to the mnemonic string
+        if first_ins.mnemonic.split(" ")[-1] not in ["jmp", "call"]:
             return False
         return len(self.apirefs) != 0
 

{smda-4.2.0 → smda-4.2.2}/src/smda/common/labelprovider/PeSymbolProvider.py

@@ -6,7 +6,7 @@ import logging
 import lief
 
 from .AbstractLabelProvider import AbstractLabelProvider
-from .import_parsers import parse_pe_imports, resolve_pe_base_addr
+from .import_parsers import parse_pe_delay_imports, parse_pe_imports, resolve_pe_base_addr
 
 lief.logging.disable()
 LOGGER = logging.getLogger(__name__)
@@ -89,7 +89,9 @@ class PeSymbolProvider(AbstractLabelProvider):
         return function_symbols
 
     def parseImports(self, lief_binary, base_addr=None):
-        return parse_pe_imports(lief_binary, base_addr)
+        import_symbols = parse_pe_imports(lief_binary, base_addr)
+        import_symbols.update(parse_pe_delay_imports(lief_binary, base_addr))
+        return import_symbols
 
     def collectSymbols(self, lief_binary, base_addr=None):
         symbols = {}

{smda-4.2.0 → smda-4.2.2}/src/smda/common/labelprovider/WinApiResolver.py

@@ -9,7 +9,7 @@ import lief
 lief.logging.disable()
 
 from .AbstractLabelProvider import AbstractLabelProvider  # noqa: E402
-from .import_parsers import parse_pe_imports  # noqa: E402
+from .import_parsers import parse_pe_delay_imports, parse_pe_imports  # noqa: E402
 
 LOGGER = logging.getLogger(__name__)
 
@@ -41,6 +41,7 @@ class WinApiResolver(AbstractLabelProvider):
             if not isinstance(lief_binary, lief.PE.Binary):
                 return
             self._api_map["lief"] = parse_pe_imports(lief_binary, binary_info.base_addr)
+            self._api_map["lief"].update(parse_pe_delay_imports(lief_binary, binary_info.base_addr))
 
     def setOsName(self, os_name):
         self._os_name = os_name

{smda-4.2.0 → smda-4.2.2}/src/smda/common/labelprovider/import_parsers.py

@@ -34,6 +34,28 @@ def parse_pe_imports(lief_binary, base_addr=None):
     return import_symbols
 
 
+def parse_pe_delay_imports(lief_binary, base_addr=None):
+    if not hasattr(lief_binary, "delay_imports"):
+        return {}
+    if not lief_binary.has_delay_imports:
+        return {}
+    active_base = resolve_pe_base_addr(lief_binary, base_addr)
+    magic = getattr(lief_binary.optional_header, "magic", None)
+    ptr_size = 8 if magic is not None and magic == lief.PE.PE_TYPE.PE32_PLUS else 4
+    import_symbols = {}
+    for delay_import in lief_binary.delay_imports:
+        lib_name_lower = (getattr(delay_import, "name", "") or "").lower()
+        for index, func in enumerate(delay_import.entries):
+            slot_addr = active_base + delay_import.iat + index * ptr_size
+            if func.name:
+                import_symbols[slot_addr] = (lib_name_lower, func.name)
+            elif func.is_ordinal:
+                resolved_ordinal = OrdinalHelper.resolveOrdinal(lib_name_lower, func.ordinal)
+                ordinal_name = resolved_ordinal if resolved_ordinal else f"#{func.ordinal}"
+                import_symbols[slot_addr] = (lib_name_lower, ordinal_name)
+    return import_symbols
+
+
 def parse_elf_relocation_imports(lief_binary):
     """Build import map keyed by relocation slot address: addr -> (lib, name)."""
     if not isinstance(lief_binary, lief.ELF.Binary):

smda-4.2.2/src/smda/ida/IdaExporter.py

@@ -0,0 +1,123 @@
+import datetime
+import logging
+
+from capstone import CS_ARCH_ARM64, CS_ARCH_X86, CS_MODE_32, CS_MODE_64, CS_MODE_LITTLE_ENDIAN, Cs
+
+from smda.DisassemblyResult import DisassemblyResult
+
+from .IdaInterface import IdaInterface
+
+LOGGER = logging.getLogger(__name__)
+
+
+class IdaExporter:
+    def __init__(self, config, bitness=None):
+        self.config = config
+        self.ida_interface = IdaInterface()
+        self.bitness = bitness if bitness else self.ida_interface.getBitness()
+        self.architecture = self.ida_interface.getArchitecture()
+        self.capstone = None
+        self.disassembly = DisassemblyResult()
+        self.disassembly.smda_version = config.VERSION
+        self._initCapstone()
+
+    def _initCapstone(self):
+        if self.architecture == "aarch64":
+            self.capstone = Cs(CS_ARCH_ARM64, CS_MODE_LITTLE_ENDIAN)
+        elif self.bitness == 64:
+            self.capstone = Cs(CS_ARCH_X86, CS_MODE_64)
+        else:
+            self.capstone = Cs(CS_ARCH_X86, CS_MODE_32)
+
+    @staticmethod
+    def _splitInstructionBytes(capstone, offset, instruction_bytes, architecture, errors=None):
+        """Split *instruction_bytes* (which IDA may report as N×4 bytes for an AArch64
+        MOV-macro head) into one ``(addr, size, mnemonic, op_str, bytes)`` tuple per
+        decoded 4-byte instruction.
+
+        Background
+        ----------
+        IDA's MOV-macro feature collapses a ``MOVZ+MOVK`` pair (materialising a 32-bit
+        constant in a Wn register across two 4-byte AArch64 instructions) into one
+        logical "head" whose reported size is 8 bytes.  Without splitting,
+        :meth:`analyzeBuffer` would pass the whole 8-byte buffer to
+        :meth:`capstone.disasm_lite` and then take only ``cache[0]`` (the MOVZ),
+        silently dropping the MOVK and producing an exported report that drifted from
+        SMDA's own per-instruction AArch64 output.
+
+        This static helper iterates every instruction capstone decoded from the buffer
+        and emits one tuple per sub-instruction with correctly sliced 4-byte payloads,
+        so both the MOVZ (head) and the MOVK (head+4) appear as their own records.
+        """
+        cache = list(capstone.disasm_lite(instruction_bytes, offset))
+        out = []
+        consumed = 0
+        for i_address, i_size, i_mnemonic, i_op_str in cache:
+            sub_bytes = bytes(instruction_bytes[consumed : consumed + i_size])
+            out.append((i_address, i_size, i_mnemonic, i_op_str, sub_bytes))
+            consumed += i_size
+        while consumed < len(instruction_bytes):
+            chunk = 4 if architecture == "aarch64" else (len(instruction_bytes) - consumed)
+            chunk = min(chunk, len(instruction_bytes) - consumed)
+            sub_bytes = bytes(instruction_bytes[consumed : consumed + chunk])
+            bytes_hex = sub_bytes.hex()
+            LOGGER.warning("missing capstone disassembly output at 0x%x (%s)", offset + consumed, bytes_hex)
+            if errors is not None:
+                errors[offset + consumed] = {"type": "capstone disassembly failure", "instruction_bytes": bytes_hex}
+            out.append((offset + consumed, chunk, "error", "error", sub_bytes))
+            consumed += chunk
+        return out
+
+    def _convertIdaInsToSmda(self, offset, instruction_bytes):
+        return self._splitInstructionBytes(
+            self.capstone, offset, instruction_bytes, self.architecture, self.disassembly.errors
+        )
+
+    def analyzeBuffer(self, binary_info, cb_analysis_timeout=None):
+        """instead of performing a full analysis, simply collect all data from IDA and convert it into a report"""
+        self.disassembly.analysis_start_ts = datetime.datetime.now(datetime.timezone.utc)
+        self.disassembly.binary_info = binary_info
+        self.disassembly.binary_info.architecture = self.ida_interface.getArchitecture()
+        if not self.disassembly.binary_info.base_addr:
+            self.disassembly.binary_info.base_addr = self.ida_interface.getBaseAddr()
+        if not self.disassembly.binary_info.binary:
+            self.disassembly.binary_info.binary = self.ida_interface.getBinary()
+        if not self.disassembly.binary_info.bitness:
+            self.disassembly.binary_info.bitness = self.bitness
+        self.disassembly.function_symbols = self.ida_interface.getFunctionSymbols()
+        api_map = self.ida_interface.getApiMap()
+        for function_offset in self.ida_interface.getFunctions():
+            if self.ida_interface.isExternalFunction(function_offset):
+                continue
+            converted_function = []
+            for block in self.ida_interface.getBlocks(function_offset):
+                converted_block = []
+                for instruction_offset in block:
+                    instruction_bytes = self.ida_interface.getInstructionBytes(instruction_offset)
+                    smda_instructions = self._convertIdaInsToSmda(instruction_offset, instruction_bytes)
+                    num_subs = len(smda_instructions)
+                    for idx, smda_instruction in enumerate(smda_instructions):
+                        converted_block.append(smda_instruction)
+                        self.disassembly.instructions[smda_instruction[0]] = (
+                            smda_instruction[2],
+                            smda_instruction[1],
+                        )
+                        # IDA tracks code refs at the macro-head level only; for split
+                        # macro heads, attach in-refs to the first sub-instruction (entry)
+                        # and out-refs to the last sub-instruction (exit).
+                        if idx == 0:
+                            for in_ref in self.ida_interface.getCodeInRefs(instruction_offset):
+                                self.disassembly.addCodeRefs(in_ref[0], in_ref[1])
+                        if idx == num_subs - 1:
+                            for out_ref in self.ida_interface.getCodeOutRefs(instruction_offset):
+                                self.disassembly.addCodeRefs(out_ref[0], out_ref[1])
+                                if out_ref[1] in api_map:
+                                    self.disassembly.addr_to_api[smda_instruction[0]] = api_map[out_ref[1]]
+                converted_function.append(converted_block)
+            self.disassembly.functions[function_offset] = converted_function
+            if self.disassembly.isRecursiveFunction(function_offset):
+                self.disassembly.recursive_functions.add(function_offset)
+            if self.disassembly.isLeafFunction(function_offset):
+                self.disassembly.leaf_functions.add(function_offset)
+        self.disassembly.analysis_end_ts = datetime.datetime.now(datetime.timezone.utc)
+        return self.disassembly

{smda-4.2.0 → smda-4.2.2}/src/smda/ida/IdaInterface.py

@@ -52,7 +52,7 @@ class IdaInterface:
 class Ida74Interface(BackendInterface):
     def __init__(self):
         self.version = "IDA Pro 7.4 - 8.4"
-        self._processor_map = {"metapc": "intel"}
+        self._processor_map = {"metapc": "intel", "ARM": "aarch64"}
         self._api_map = {}
         self._import_module_name = ""
 
@@ -60,6 +60,10 @@ class Ida74Interface(BackendInterface):
         # https://reverseengineering.stackexchange.com/a/11398
         info = ida_idaapi.get_inf_structure()
         procname = info.procname if idaapi.IDA_SDK_VERSION >= 800 else info.procName
+        if procname == "ARM":
+            if self.getBitness() != 64:
+                raise ValueError(f"Unsupported Architecture: {procname} ({self.getBitness()}bit)")
+            return "aarch64"
         if procname in self._processor_map:
             return self._processor_map[procname]
         else:
@@ -177,6 +181,10 @@ class Ida73Interface(BackendInterface):
         # https://reverseengineering.stackexchange.com/a/11398
         info = idaapi.get_inf_structure()
         procname = info.procName
+        if procname == "ARM":
+            if self.getBitness() != 64:
+                raise ValueError(f"Unsupported Architecture: {procname} ({self.getBitness()}bit)")
+            return "aarch64"
         if procname in self._processor_map:
             return self._processor_map[procname]
         else:
@@ -290,6 +298,10 @@ class Ida85Interface(BackendInterface):
 
     def getArchitecture(self):
         procname = idaapi.inf_get_procname()
+        if procname == "ARM":
+            if self.getBitness() != 64:
+                raise ValueError(f"Unsupported Architecture: {procname} ({self.getBitness()}bit)")
+            return "aarch64"
         if procname in self._processor_map:
             return self._processor_map[procname]
         else:

{smda-4.2.0 → smda-4.2.2}/src/smda/intel/FunctionAnalysisState.py

@@ -167,14 +167,15 @@ class FunctionAnalysisState:
             # for instruction in sorted(self.instructions):
             #    print("0x%08x: %s %s" % (instruction[0], instruction[2], instruction[3]))
         if as_gap and not self.is_sanely_ending:
-            if len(self.instructions) == 1 and self.instructions[0][2] == "jmp":
+            # capstone prepends mandatory prefixes (bnd/rep/lock/...) to the mnemonic string
+            if len(self.instructions) == 1 and self.instructions[0][2].split(" ")[-1] == "jmp":
                 byte = self.disassembly.getByte(self.instructions[0][0])
                 if isinstance(byte, int):
                     byte = chr(byte)
                 if byte == "\xeb":
                     return False
                 # sane case, stub found that just jumps to a referenced function
-            elif self.num_blocks_analyzed == 1 and self.instructions[-1][2] in [
+            elif self.num_blocks_analyzed == 1 and self.instructions[-1][2].split(" ")[-1] in [
                 "jmp",
                 "call",
             ]:
@@ -226,11 +227,12 @@ class FunctionAnalysisState:
             block = []
             for i in range(ins[start], len(self.instructions)):
                 current = self.instructions[i]
+                current_mnemonic = current[2].split(" ")[-1]
                 block.append(current)
                 # if one code reference is to another address than the next
                 if (
                     current[0] in self.code_refs_from
-                    and current[2] not in self.CALL_MNEMONICS
+                    and current_mnemonic not in self.CALL_MNEMONICS
                     and i != len(self.instructions) - 1
                     and any(r != self.instructions[i + 1][0] for r in self.code_refs_from[current[0]])
                 ):
@@ -252,7 +254,7 @@ class FunctionAnalysisState:
                     )
                 ):
                     break
-                if current[2] in self.END_MNEMONICS:
+                if current_mnemonic in self.END_MNEMONICS:
                     break
             if block:
                 blocks.append(block)

{smda-4.2.0 → smda-4.2.2}/src/smda/intel/FunctionCandidateManager.py

@@ -8,12 +8,16 @@ from smda.common.ExceptionHandling import reraise_non_operational_exception
 from smda.utility.BracketQueue import BracketQueue
 from smda.utility.PriorityQueue import PriorityQueue
 
-from .definitions import DEFAULT_PROLOGUES, GAP_SEQUENCES
+from .definitions import COMMON_PROLOGUES, DEFAULT_PROLOGUES, GAP_SEQUENCES
 from .FunctionCandidate import FunctionCandidate
 from .LanguageAnalyzer import LanguageAnalyzer
 
 LOGGER = logging.getLogger(__name__)
 
+# bytes.lstrip() can skip long runs of one-byte padding in C instead of
+# crawling them byte-by-byte in the gap scanner.
+_PADDING_STRIP_BYTES = bytes(sorted(seq[0] for seq in GAP_SEQUENCES[1]))
+
 
 class FunctionCandidateManager:
     def __init__(self, config):
@@ -147,11 +151,31 @@ class FunctionCandidateManager:
         prev_ins = 0
         min_code = min(self.disassembly.code_map) if self.disassembly.code_map else self.getBitMask()
         max_code = max(self.disassembly.code_map) if self.disassembly.code_map else 0
-        for code_area in self._code_areas:
+        # Raw memory dumps are loaded without section info, so self._code_areas is empty; fall back to
+        # the full mapped image so the head (before the first instruction) and tail (after the last
+        # instruction) still get gap-scanned. Without this, functions that lie entirely before the
+        # first or after the last already-discovered instruction (e.g. trailing jmp/thunk tables) are
+        # never reached by the gap pass.
+        using_synthetic_area = not self._code_areas
+        code_areas = self._code_areas or [
+            [
+                self.disassembly.binary_info.base_addr,
+                self.disassembly.binary_info.base_addr + self.disassembly.binary_info.binary_size,
+            ]
+        ]
+        for code_area in code_areas:
             if code_area[0] < min_code < code_area[1] and min_code != code_area[0]:
                 gaps.append([code_area[0], min_code, min_code - code_area[0]])
             if code_area[0] < max_code < code_area[1] and max_code != code_area[1]:
-                gaps.append([max_code, code_area[1], code_area[1] - max_code])
+                # For the synthetic full-image fallback (raw memory dumps with no section info),
+                # the tail gap must start AFTER the last instruction's address, mirroring the
+                # interior-hole branch's prev_ins + 1 below. max_code is itself in code_map, so a
+                # gap starting at max_code leaves the gap-pointer on a code_map address;
+                # getNextGap()'s strict "gap[0] > gap_pointer" test then finds no further gap,
+                # returns the bitmask sentinel, and the scan terminates -- abandoning the whole tail
+                # region unscanned. Section-derived code areas keep the legacy start (behavior-neutral).
+                tail_start = max_code + 1 if using_synthetic_area else max_code
+                gaps.append([tail_start, code_area[1], code_area[1] - tail_start])
         for ins in sorted(self.disassembly.code_map.keys()):
             if prev_ins != 0 and ins - prev_ins > 1:
                 gaps.append([prev_ins + 1, ins, ins - prev_ins])
@@ -197,6 +221,13 @@ class FunctionCandidateManager:
     def isEffectiveNop(self, byte_sequence):
         return byte_sequence in GAP_SEQUENCES[len(byte_sequence)]
 
+    def isHotpatchPrologue(self, byte_window):
+        # An MSVC hotpatch stub (`mov edi, edi; push ebp; mov ebp, esp`) opens with a
+        # `mov edi, edi` that is byte-identical to a 2-byte effective NOP, yet it IS the
+        # function's true entry. Recognizing the 5-byte prologue lets callers avoid
+        # skipping/rounding past that leading NOP and mislocating the start two bytes late.
+        return byte_window in COMMON_PROLOGUES["5"].get(self.bitness, {})
+
     def isAlignmentSequence(self, instruction_sequence):
         is_alignment_sequence = False
         instructions_analyzed = 0
@@ -213,7 +244,7 @@ class FunctionCandidateManager:
                     break
         if len(instruction_sequence) > instructions_analyzed and instruction_sequence[
             instructions_analyzed
-        ].mnemonic in [
+        ].mnemonic.split(" ")[-1] in [
             "leave",
             "ret",
             "retn",
@@ -260,11 +291,15 @@ class FunctionCandidateManager:
                 LOGGER.warning("could not fetch raw byte for gap pointer.")
             # try to find padding symbols and skip them
             if byte in GAP_SEQUENCES[1]:
+                window = get_window_slice(gap_offset, 256)
+                run = len(window) - len(window.lstrip(_PADDING_STRIP_BYTES))
                 LOGGER.debug(
-                    "nextGapCandidate() found 0xCC / 0x00 - gap_ptr += 1: 0x%08x",
+                    "nextGapCandidate() found %d-byte padding run - gap_ptr += %d: 0x%08x",
+                    run,
+                    run,
                     self.gap_pointer,
                 )
-                self.gap_pointer += 1
+                self.gap_pointer += run if run else 1
                 continue
             # try to find instructions that directly encode as NOP and skip them
             ins_buf = list(self.capstone.disasm_lite(get_window_slice(gap_offset, 15), gap_offset))
@@ -285,6 +320,11 @@ class FunctionCandidateManager:
             found_multi_byte_nop = False
             for gap_length in range(max(GAP_SEQUENCES.keys()), 1, -1):
                 if get_window_slice(gap_offset, gap_length) in GAP_SEQUENCES[gap_length]:
+                    # Do not skip a `mov edi, edi` effective NOP when it is the landing pad of
+                    # a hotpatch stub: that byte pair is the function's true start, and skipping
+                    # it would mislocate the function two bytes late (at the `push ebp`).
+                    if self.isHotpatchPrologue(get_window_slice(gap_offset, 5)):
+                        break
                     LOGGER.debug(
                         "nextGapCandidate() found %d byte effective nop - gap_ptr += %d: 0x%08x",
                         gap_length,

{smda-4.2.0 → smda-4.2.2}/src/smda/intel/IntelInstructionEscaper.py

@@ -2114,7 +2114,7 @@ class IntelInstructionEscaper:
         esc_regs = True
         esc_consts = True
         if offsets_only:
-            if ins.mnemonic in [
+            if ins.mnemonic.split(" ")[-1] in [
                 "call",
                 "lcall",
                 "jmp",
@@ -2191,11 +2191,12 @@ class IntelInstructionEscaper:
     @staticmethod
     def escapeBinary(ins, escape_intraprocedural_jumps=False, lower_addr=None, upper_addr=None):
         escaped_sequence = ins.bytes
+        mnemonic = ins.mnemonic.split(" ")[-1]
         # remove segment, operand, address, repeat override prefixes
-        if ins.mnemonic in ["call", "lcall", "jmp", "ljmp", "loop", "loopne", "loope"]:
+        if mnemonic in ["call", "lcall", "jmp", "ljmp", "loop", "loopne", "loope"]:
             escaped_sequence = IntelInstructionEscaper.escapeBinaryJumpCall(ins, escape_intraprocedural_jumps)
             return escaped_sequence
-        if ins.mnemonic in [
+        if mnemonic in [
             "je",
             "jne",
             "js",

{smda-4.2.0 → smda-4.2.2}/src/smda/intel/X86Backend.py

@@ -367,12 +367,19 @@ class X86Backend(ArchBackend):
                     state.endBlock()
                     state.setSanelyEnding(True)
                     if d.fc_manager.isAlignmentSequence(instruction_sequence):
-                        next_aligned_address = previous_address + (16 - previous_address % 16)
+                        # A hotpatch stub right after a call can look like alignment padding
+                        # (its leading `mov edi, edi` is an effective NOP), but that byte pair
+                        # is the next function's true entry. Seed it directly rather than the
+                        # 16-byte-rounded address, which would land two bytes late.
+                        if d.fc_manager.isHotpatchPrologue(d._getDisasmWindowBuffer(i_address)[:5]):
+                            next_candidate_address = i_address
+                        else:
+                            next_candidate_address = previous_address + (16 - previous_address % 16)
                         LOGGER.debug(
                             "  Adding: 0x%x as candidate.",
-                            next_aligned_address,
+                            next_candidate_address,
                         )
-                        d.fc_manager.addCandidate(next_aligned_address, is_gap=True)
+                        d.fc_manager.addCandidate(next_candidate_address, is_gap=True)
                     return True
                 else:
                     LOGGER.debug(

{smda-4.2.0 → smda-4.2.2/src/smda.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: smda
-Version: 4.2.0
+Version: 4.2.2
 Summary: A recursive disassmbler optimized for CFG recovery from memory dumps. Based on capstone.
 Author-email: Daniel Plohmann <daniel.plohmann@mailbox.org>
 License: BSD 2-Clause
@@ -146,6 +146,8 @@ make test
 
 ## Version History
 
+ * 2026-07-09: v4.2.2 - Now also parsing delay import tables from Windows PEs.
+ * 2026-07-09: v4.2.1 - Better detection of CFG instructions with prefixes, improved accuracy of gap search. (THX: @r0ny123) IDA ARM64 export.
  * 2026-06-24: v4.2.0 - Further improvements for inter-procedural operand escaping (closer to x86_x64 and traditional PIC hashing).
  * 2026-06-23: v4.1.0 - Significantly extended Aarch64 mnemonic escapes and improved PIC/OPC hashing. (THX: @r0ny123)
  * 2026-06-23: v4.0.2 - Improvements to Aarch64 function recovery, adressing tailcalls and gap function cornercases.

{smda-4.2.0 → smda-4.2.2}/tests/testAArch64Disassembler.py

@@ -927,8 +927,8 @@ class TestAArch64StaticFixture(unittest.TestCase):
         self.assertEqual(self.report.bitness, 64)
         self.assertEqual(self.report.base_addr, 0x400000)
         self.assertEqual(self.report.oep, 0x534)
-        self.assertEqual(len(self.report.xcfg), 277)
-        self.assertEqual(sum(1 for f in self.report.getFunctions() for _ in f.getInstructions()), 19882)
+        self.assertEqual(len(self.report.xcfg), 278)
+        self.assertEqual(sum(1 for f in self.report.getFunctions() for _ in f.getInstructions()), 19881)
         self.assertEqual(sum(1 for f in self.report.getFunctions() for _ in f.getBlocks()), 3525)
         self.assertIsNotNone(self.report.getFunction(0x400534))
 
@@ -979,7 +979,7 @@ class TestAArch64StaticFixture(unittest.TestCase):
         self.assertEqual(roundtrip.architecture, "aarch64")
         self.assertEqual(roundtrip.bitness, 64)
         self.assertEqual(roundtrip.oep, 0x534)
-        self.assertEqual(len(roundtrip.xcfg), 277)
+        self.assertEqual(len(roundtrip.xcfg), 278)
 
 
 class TestAArch64Analyzers(unittest.TestCase):
@@ -1273,5 +1273,72 @@ class TestAArch64Analyzers(unittest.TestCase):
         self.assertEqual(targets[:3], [0x411120, 0x411140, 0x4110E0])
 
 
+class TestAArch64MovMacroSplit(unittest.TestCase):
+    """IDA's MOV-macro feature collapses MOVZ+MOVK pairs (materialising a 32-bit
+    constant in a Wn register across two 4-byte AArch64 instructions) into one
+    logical "head" whose reported size is 8 bytes.  Without splitting,
+    IdaExporter._convertIdaInsToSmda would feed all 8 bytes to capstone and
+    take only ``cache[0]`` (the MOVZ), silently dropping the MOVK and producing
+    an exported report that drifted from SMDA's own per-instruction AArch64 output.
+
+    These tests exercise IdaExporter._splitInstructionBytes directly (no IDA
+    mocking required), verifying that an 8-byte macro head from IDA is correctly
+    unpacked into two 4-byte sub-instructions.
+    """
+
+    def _split(self, offset, instruction_bytes):
+        from capstone import CS_ARCH_ARM64, CS_MODE_LITTLE_ENDIAN, Cs
+
+        from smda.ida.IdaExporter import IdaExporter
+
+        capstone = Cs(CS_ARCH_ARM64, CS_MODE_LITTLE_ENDIAN)
+        errors = {}
+        return (
+            IdaExporter._splitInstructionBytes(capstone, offset, instruction_bytes, "aarch64", errors),
+            errors,
+        )
+
+    def test_movz_movk_macro_splits_into_two_4_byte_instructions(self):
+        # The IDA export example:
+        #   03 20 80 52   MOVZ W3, #0x100 -> capstone: 'mov' w3, #0x100
+        #   03 00 A1 72   MOVK W3, #0x800, LSL #16 -> capstone: 'movk' w3, #0x800, lsl #16
+        # originally shown by IDA as one 8-byte "MOV W3, #0x8000100" macro at 0x100004838.
+        macro_bytes = bytes.fromhex("032080520300A172")
+        insns, errors = self._split(0x100004838, macro_bytes)
+
+        self.assertEqual(errors, {})
+        self.assertEqual(len(insns), 2)
+
+        addr, size, mnem, ops, raw = insns[0]
+        self.assertEqual(addr, 0x100004838)
+        self.assertEqual(size, 4)
+        self.assertEqual(mnem, "mov")
+        self.assertEqual(ops, "w3, #0x100")
+        self.assertEqual(raw, bytes.fromhex("03208052"))
+
+        addr, size, mnem, ops, raw = insns[1]
+        self.assertEqual(addr, 0x10000483C)
+        self.assertEqual(size, 4)
+        self.assertEqual(mnem, "movk")
+        self.assertEqual(ops, "w3, #0x800, lsl #16")
+        self.assertEqual(raw, bytes.fromhex("0300A172"))
+
+    def test_single_4_byte_instruction_still_returns_one_tuple(self):
+        # Non-macro AArch64 instructions return exactly 4 bytes from
+        # IdaInterface.getInstructionBytes; the split helper must preserve
+        # the single-instruction output shape (a one-element list).
+        single = bytes.fromhex("200080D2")  # mov x0, #1
+        insns, errors = self._split(0x401000, single)
+
+        self.assertEqual(errors, {})
+        self.assertEqual(len(insns), 1)
+        addr, size, mnem, ops, raw = insns[0]
+        self.assertEqual(addr, 0x401000)
+        self.assertEqual(size, 4)
+        self.assertEqual(mnem, "mov")
+        self.assertEqual(ops, "x0, #1")
+        self.assertEqual(raw, single)
+
+
 if __name__ == "__main__":
     unittest.main()