Propagate "writes-unbounded into pointer-param k" across call hops so a buffer
passed through a wrapper (2+ levels) is still flagged — no third-party call
graph needed; the raw P-Code stream already gives resolved call edges.
- pcode_summary: PointerWriteSummary gains forwarding edges — a Call that passes
one of the function's own pure-input pointer params straight through to a
callee argument (my_param → callee:arg), detected via in_def + paramIndexOf.
Forwards are computed regardless of the loop/size-bound gates (a non-looping
wrapper still forwards).
- pcode_router: expose annotateCallTargets(ssa, raw, names) — factor the
raw→site→SSA name correlation so the summary pre-pass can resolve callee names
for forwarding edges.
- binary_pcode_scan: the pre-pass now annotates each function's SSA call targets
(via a raw lift) before summarizing, collects direct + forwarding summaries,
then runs a worklist fixpoint: a function forwarding a pure-param pointer to an
unbounded-writer parameter becomes an unbounded writer on that param. The
closure feeds both the interprocedural detector and the write-loop prototype
set (so multi-hop callers recover the buffer arg).
Validated: baby_bof (AArch64 + x86-64) still fires; corpus BOF counts unchanged
(3/1/1); the x86-64 static stays at 1 finding (the transitive closure adds no
FP). Unit: test_pcode_summary +forwarding cases (14 assertions). meson test 77/77.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Unlocks the x86 family end-to-end and makes the write-loop detector precise
enough for statically-linked binaries.
x86 SLEIGH:
- Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default);
add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32.
- ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the
raw path, and bound decompiler flow at the function end (0xC3 tail fill) so
variable-length x86 does not run away into zero padding.
Precise SSA def-use (benefits all arches):
- ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter
records real def-use. summarizePointerWrites now resolves the store-address
base via def-use instead of a last-write heuristic — essential on x86 where
arg registers are reused as scratch (RAX) and sub-registers are written (SIL).
- paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9).
Precision (the key fix at scale):
- A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed:
if the loop index is `<`-compared against a pure parameter input, the function
is size-bounded and not flagged. baby_bof's decode_base64 bounds on
strlen(input) (a computed value, not a param) so it still fires. This cut a
statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs)
to 1 — the real decode_base64 → 264-byte overflow.
Perf + reach:
- Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the
few callers of a write-loop callee that need the injected prototype).
- Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS,
default 120s) so large static binaries actually analyze (the 3s per-command
watchdog left them with an empty function list).
Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64
(index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static
FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Detect custom (non-libc) routines that fill a caller's fixed-size stack
buffer in an unbounded loop — the bug class fold previously missed because
the destination array decays to a pointer across the call boundary.
- pcode_summary (pure, fold::symbolic, unit-tested): summarizePointerWrites
flags a pointer parameter the function writes via a loop-carried index.
Robust over flattened SSA: base must be a *pure-input* param register (never
reassigned as scratch), index must be non-constant, and the function must
contain a loop (MultiEqual).
- ghidra_lifter: generalize prototype injection — besides known sinks, accept
extra_pointer_protos so a custom write-loop callee gets a pointer prototype
at its call sites, letting the decompiler recover the caller's args and the
destination buffer size (the key enabler).
- binary_pcode_scan: two-pass — pass 1 summarizes every function and collects
write-loop callees + their prototypes; the main pass injects those protos and
reports an overflow at any call passing a recovered fixed-size stack buffer to
a write-loop parameter (Heuristic). Call-site guard: suppress when another arg
is a constant >= the capacity (a size was passed → bounded copy).
- router: detectInterprocBufferWrites emits the finding from the annotated SSA
function (call_target + in_buffer_sizes), with ExploitContext populated.
Validated: dist-baby_bof/index_nocanary.cgi now reports the decode_base64 →
256-byte `decoded` overflow in validate_auth (the SOLVE.md "Fold Gap"); zero
new FP across bench/corpora/ctf-challenges; div/null/sink-BOF unchanged.
Unit: test_pcode_summary (7 assertions). meson test 76/76.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
