Tools for finding out which code a binary is related to.
Familiary is the home of MCRIT and the surrounding toolchain for binary code similarity analysis — disassembly, shingling, MinHash-based comparison, reference data, and the interfaces to work with it all.
The name is a coinage in the pattern of library and apiary: a familiary is where the families are kept. Given an unknown sample, these tools tell you which known code it is related to, how strongly, and which parts of it are just library or compiler boilerplate.
The repositories moved here in September 2026. GitHub redirects the old URLs, so existing clones, links and
git+https://installs keep working.
The projects here build on each other. Working bottom-up:
| Project | What it does | |
|---|---|---|
| Disassembly | smda ↗ | Minimalist recursive disassembler built on Capstone, focused on accurate function entry point detection and CFG recovery — including in memory dumps and shellcode. Emits the SMDA reports everything else consumes. |
| Block hashing | picblocks | Position-independent hashing of basic blocks, used by MCRIT for unique-block matching. |
| Similarity engine | mcrit | The MinHash-based Code Relationship & Investigation Toolkit. A framework for rapidly implementing shinglers — methods that encode properties of disassembled functions — and using them for scalable 1:N similarity estimation. Ships a REST API, a worker queue, a Python client, and a CLI. |
| Web frontend | mcritweb | Web UI for MCRIT: submitting samples, browsing families and functions, running and reviewing matching jobs. |
| Deployment | docker-mcrit | Fully packaged docker-compose setup — MCRIT server and workers, MongoDB, MCRITweb, NGINX. The recommended way to get started, and the only one that guarantees compatible versions across components. |
| Disassembler integration | mcrit-plugin | IDA Pro plugin for querying an MCRIT server from inside your database: function and block matching, label synchronisation, dedicated result views. Installs as mcrit-ida via Hex-Rays' HCLI. |
| Reference data | mcrit-data | Ready-to-import reference code and symbols for statically linked library and compiler artefacts (MSVC, MinGW, Go, Nim, aPLib, and more), so that known library code can be identified and filtered out instead of drowning your results. |
| Data preparation | lib2smda | Converts .LIB / .OBJ files into SMDA reports via IDA Pro, for building your own reference collections. |
↗ SMDA is a standalone disassembly library with a life of its own beyond code similarity, so it stays at danielplohmann/smda. Everything here depends on it. The same goes for purepdb, a dependency-free pure-Python PDB parser that SMDA uses to label functions from PDB symbols. It stays next to SMDA.
The fastest path to a working instance:
git clone https://github.com/familiary/docker-mcrit
cd docker-mcrit
docker compose upThis builds the MCRIT server and workers plus MCRITweb, pulls MongoDB and NGINX, and brings everything up. From there, import a reference collection from mcrit-data via Data → Import in MCRITweb and start submitting samples.
For a library-only workflow, pip install smda and pip install mcrit also work
standalone.
These tools grew out of research on malware reverse engineering and analysis automation, and they are closely tied to Malpedia — a curated corpus of malware families that serves as the reference data set the similarity work was built around. MCRIT itself was developed at Fraunhofer FKIE.
Familiary exists to give these projects a single, maintainer-neutral home so they can be developed and handed on independently of any one person or institution.
Issues and pull requests are welcome on the individual repositories. If you are unsure where something belongs, open an issue on mcrit and we will route it.
For reference data in particular: if a compiler version or library you keep running into is missing from mcrit-data, open an issue — ideally with the input data — and we will see what we can do.
Individual projects carry their own licenses; see each repository.