# Binary Scan Timeout Analysis — dbench_jumbf

> Date: 2026-05-30 | Source: Task #162

## Root Cause

Fold's binary scan times out on the 1.4MB dbench_jumbf x86-64 ELF because of
**repeated `aaa` analysis per function extraction call**. Each call to
`extractSymbols()`, `extractStrings()`, `extractCalls()`, etc. constructs a new
`R2Session`, which runs `aaa` (auto-analysis) from scratch. For a 1.4MB binary
with 200+ functions, this means 4-6 full `aaa` runs — each taking 15-30s on
larger binaries.

## Affected Code

- `src/binary/r2_backend.cpp`: `R2Session` construction runs `aaa` per session
- `src/cli/scan_runner.cpp`: `BinaryDetectorRunner` creates separate sessions
  for imports, strings, and BB encoding passes

## Proposed Fixes

| Fix | Effort | Impact | Description |
|-----|--------|--------|-------------|
| **Session reuse** | S | High | Share one `R2Session` across all extraction calls in a single binary scan |
| **Streaming BB extraction** | M | Medium | Process basic blocks incrementally instead of batch-loading all at once |
| **Progressive aa levels** | S | Medium | Use `aa` for quick scans, `aaa` only when function recovery is requested |
| **Per-extraction timeout** | S | Low | Set 10s timeout per r2 command instead of 90s total budget |

## Recommended Implementation

1. In `src/binary/r2_backend.cpp::runDetectors()`, create ONE `R2Session` and
   pass it to `extractDangerousImports()`, `extractHardcodedStrings()`,
   `extractCalls()`, etc.

2. Add a `r2_analysis_level` option: `"aa"` (quick, default), `"aaa"` (full),
   `"aaaa"` (experimental/comprehensive).

3. Add `--binary-analysis-level` CLI flag.