# Binary Analysis Tools and Techniques Research

> Generated 2026-05-29. Research on Ghidra, angr, Binary Ninja, and radare2 for improving fold's 3.7% detection rate.

## Tool Comparison

| Tool | Key Technique | fold Applicability |
|------|-------------|-------------------|
| Ghidra | P-code decompiler → type recovery, call graph | High — P-code is arch-neutral IR |
| Binary Ninja | MLIL (Medium Level IL) → abstracted control flow | High — MLIL maps to BinaryIR |
| angr | Symbolic execution on binaries → path-based vulnerability detection | Medium — requires Python integration |
| radare2 (r2) | `aaa` analysis pipeline → strings, symbols, xrefs, basic blocks | Already used — fold's current backend |

## Ghidra P-Code Architecture

Ghidra's P-code is a register-transfer language:
- **Architecture-neutral**: x86_64, ARM64, MIPS all map to the same P-code ops
- **25 core operations**: LOAD, STORE, COPY, BRANCH, CBRANCH, CALL, RETURN, INT_ADD, INT_SUB, etc.
- **Type recovery**: Ghidra infers function signatures and data types from P-code patterns

**fold can adopt**: P-code's 25-op pattern as the core BinaryIR instruction set. This mirrors Infer's 10-op SIL approach — a small, universal instruction set that all architectures lower to.

## angr Symbolic Execution

angr's `claripy` symbolic engine can:
- **Find paths to specific addresses**: `simgr.explore(find=0x401234)` — find all inputs reaching a vulnerable function
- **Detect buffer overflows**: constrain symbolic input length, check if guard variables are overwritten
- **Detect format strings**: check if symbolic data reaches printf with fmt specifiers

**fold can adopt**: Use angr-like path exploration within the existing Z3 encoder. The encoder already does path-based queries — we just need to translate binary basic blocks (from r2's `pdbj`) into Z3 expressions.

## radare2 Analysis Levels

| Level | Command | What it provides | fold Usage |
|-------|---------|-----------------|------------|
| `aa` | Basic analysis | Symbols, strings, imports | ✅ Used (`-A` flag) |
| `aaa` | Full auto-analysis | Cross-references, basic blocks | ✅ Used via `jsonCommand` |
| `aaaa` | Deep analysis | Type recovery, calling conventions | ❌ Not used |
| `aaaaa` | Experimental | Emulation-based analysis | ❌ Not used |

**fold gap**: We stop at `aaa`. Running `aaaa` adds function signature recovery and calling convention detection — this would fix the "default params=3" heuristic in `inferParamCountARM64`.

## What fold Should Implement

| # | Feature | Based On | Effort | Detection Gain |
|---|---------|----------|--------|---------------|
| 1 | Dangerous import flagging | r2 `isj` + CWE mapping | S | +12 findings |
| 2 | Hardcoded string detection | r2 `izzj` + regex patterns | S | +5 findings |
| 3 | `aaaa` analysis level | r2 deep analysis | S | +3 findings (type recovery) |
| 4 | BinaryIR encoding | Ghidra P-code 25-op model | M | Foundation |
| 5 | String-to-call xref analysis | r2 `axtj` + call targets | M | +2 findings |
| 6 | Basic block to Z3 | angr pattern + existing encoder | L | +6 findings |