behaviour differs in disassembleFile / disassembleBuffer

[fishfacegit]

It looks like disassembling a file from disk yields different results than reading from buffer.
Do you have encountered this before?

[danielplohmann]

Hi!

Yes, that's actually quite well possible and intended.
When disassembling buffers (typically assuming a memory mapped files that was dumped), SMDA relies entirely on its heuristics for function entry point recognition and does not parse any structures even if they were there.
When disassembling a file, it will instead evaluate available data structures (such as PE or ELF headers) and extract additional information, such as exports or in this case the entry point, which leads to one single function as shown here.

Please note that the file you are trying to disassemble is a .NET binary and this is not yet supported by SMDA.
It's however one of the next big things that I would like to look at, using one of the FOSS Python CLR parsers that have become available in the last year or two.