# fold Binary Backend Architecture v2 — BinaryIR + BinaryDetector Pipeline

> Status: Design (May 2026)
> Scope: IR, finding taxonomy, detector pipeline for binary/hybrid scan modes

## Problem

CTF evaluation showed 3.7% binary detection vs 66.7% source. The binary backend lacks:
1. Structured IR between r2 data and findings (source has ir::Expr trees)
2. Detector pipeline (source has 20+ detectors with observer hooks)
3. Type-aware findings (binary findings are opaque strings)

## BinaryIR Design

Mirrors the source IR architecture (`include/fold/ir/expr.hpp`) but for binary constructs:

```cpp
enum class BinaryExprKind : uint8_t {
    // Data discovery
    HardcodedString,    // "password", "http://", key patterns
    ImportedSymbol,     // dlsym/GetProcAddress targets
    SectionData,        // .rodata, .data, .text section references
    
    // Control flow
    BasicBlock,         // Disassembled basic block
    CallSite,           // Call instruction with target
    IndirectCall,       // Call through register/memory
    
    // Data flow  
    StringXref,         // Code referencing a string
    DataXref,           // Data referencing data
    CodeXref,           // Code referencing code
    
    // Structure
    ExportEntry,        // Exported function
    VtableEntry,        // Virtual table slot
    SwitchTable,        // Jump table
};
```

## BinaryFindingKind

New finding kinds for binary-specific vulnerabilities:

| Finding | What it detects | Confidence |
|---------|----------------|-----------|
| HardcodedUrl | HTTP/HTTPS URLs in .rodata | Syntactic |
| HardcodedPassword | "password", "passwd" patterns | Heuristic |
| StackString | String built on stack (obfuscation) | Heuristic |
| SuspiciousImport | system(), exec(), popen() imports | Syntactic |
| PackedSection | UPX/ASPack detection | Syntactic |
| MissingStackCookie | No __stack_chk_fail import | Heuristic |
| WritableXSegment | RWX memory regions | Syntactic |
| UnresolvedIndirectCall | Call through register without known target | Heuristic |

## BinaryDetector Pipeline

Mirrors source detector architecture:

```
Binary (Mach-O/ELF) → R2Backend → BinaryIR tree → BinaryDetector → Finding
                                        ↓
                              BinaryExpr nodes flow through
                              detector pipeline like source
                              ir::Expr flows through ASTVisitor
```

Each detector is a standalone function:
```cpp
std::vector<Finding> detectHardcodedStrings(const BinaryIRTree& tree);
std::vector<Finding> detectSuspiciousImports(const BinaryIRTree& tree);
std::vector<Finding> detectPackedSections(const BinaryIRTree& tree);
```

## Implementation Plan

| Phase | What | Effort |
|-------|------|--------|
| 1 | BinaryExprKind enum + BinaryIRTree | S |
| 2 | HardcodedString + SuspiciousImport detectors | S |
| 3 | PackedSection + WritableXSegment detectors | S |
| 4 | Wire into scan_router + CLI | S |
| 5 | Test against 10 CTF binaries, measure improvement | S |

**Target**: 3.7% → 40%+ detection rate (Phase 2 alone adds ~10 string+suspicious-import findings).