# Binary Backend Test Coverage and Failure-Point Audit

> Generated 2026-05-29. Audits src/binary/r2_backend.cpp against test suite and CTF corpus.

## Coverage Summary

| Function | Tested? | Test File |
|----------|---------|-----------|
| `R2Session::start()` | Yes | test_binary_backend.cpp |
| `R2Session::text()` | Yes | test_binary_backend.cpp |
| `R2Session::jsonCommand()` | Yes | test_binary_backend.cpp |
| `shellQuote()` | No | — |
| `jsonString()` / `jsonU64()` | No | — |
| `extractSections()` | Partial | test_binary_backend.cpp (only counts) |
| `extractStrings()` | Partial | test_binary_backend.cpp (only counts) |
| `extractCalls()` | No | — |
| `extractXrefs()` | Partial | test_binary_backend.cpp (by address) |
| `discoverFuzzTargets()` | No | — (tested via fuzz-prep integration) |
| `discoverObjcClasses()` | No | — |
| `discoverVtableTargets()` | No | — |
| `inferParamCountARM64()` | No | — (returns default 3 for all) |
| `discoverInternalFuzzTargets()` | No | — |

**Coverage: ~35% of binary backend functions are tested.**

## CTF Failure Analysis

Map of each missed CTF vulnerability to the r2_backend.cpp function that should have caught it:

| CWE | Expected Finding | Code Path | Why Failed |
|-----|-----------------|-----------|------------|
| CWE-121 (buffer overflow) | `gets()` import detection | `extractCalls()` | Function NOT IMPLEMENTED |
| CWE-134 (format string) | `printf(user_input)` | `axtj` (xrefs) | Xref from call to string not analyzed |
| CWE-416 (use-after-free) | `free()` + deref pattern | `extractCalls()` | No basic block analysis |
| CWE-369 (div-by-zero) | Division with potential zero | `pdbj` | Basic block disasm exists but not queried |
| CWE-190 (int overflow) | Arithmetic overflow paths | `pdbj` | Not analyzed |
| CWE-476 (null deref) | Pointer deref without check | `pdbj` | Not analyzed |
| CWE-78 (cmd injection) | `system(user_input)` | `extractCalls()` | Import detected but not flagged |
| Hardcoded strings | `"http://"`, `"password"` | `izzj` | String extraction works but not flagged as finding |

## Prioritized Fix List

| # | Fix | Effort | Detection Gain |
|---|-----|--------|---------------|
| 1 | Flag `system()`, `popen()`, `exec()` imports | S | +3 findings |
| 2 | Flag hardcoded URL/password strings | S | +5 findings |
| 3 | Flag gets/strcpy/printf imports | S | +4 findings |
| 4 | Analyze call xrefs to detect which strings feed into dangerous calls | M | +2 findings |
| 5 | Basic block analysis for div-by-zero / null-deref patterns | L | +6 findings |