fold/docs/internal/binary-analysis-research.md

Binary Analysis Tools and Techniques Research

Generated 2026-05-29. Research on Ghidra, angr, Binary Ninja, and radare2 for improving fold's 3.7% detection rate.

Tool Comparison

Tool	Key Technique	fold Applicability
Ghidra	P-code decompiler → type recovery, call graph	High — P-code is arch-neutral IR
Binary Ninja	MLIL (Medium Level IL) → abstracted control flow	High — MLIL maps to BinaryIR
angr	Symbolic execution on binaries → path-based vulnerability detection	Medium — requires Python integration
radare2 (r2)	aaa analysis pipeline → strings, symbols, xrefs, basic blocks	Already used — fold's current backend

Ghidra P-Code Architecture

Ghidra's P-code is a register-transfer language:

• Architecture-neutral: x86_64, ARM64, MIPS all map to the same P-code ops
• 25 core operations: LOAD, STORE, COPY, BRANCH, CBRANCH, CALL, RETURN, INT_ADD, INT_SUB, etc.
• Type recovery: Ghidra infers function signatures and data types from P-code patterns

fold can adopt: P-code's 25-op pattern as the core BinaryIR instruction set. This mirrors Infer's 10-op SIL approach — a small, universal instruction set that all architectures lower to.

angr Symbolic Execution

angr's claripy symbolic engine can:

• Find paths to specific addresses: simgr.explore(find=0x401234) — find all inputs reaching a vulnerable function
• Detect buffer overflows: constrain symbolic input length, check if guard variables are overwritten
• Detect format strings: check if symbolic data reaches printf with fmt specifiers

fold can adopt: Use angr-like path exploration within the existing Z3 encoder. The encoder already does path-based queries — we just need to translate binary basic blocks (from r2's pdbj) into Z3 expressions.

radare2 Analysis Levels

Level	Command	What it provides	fold Usage
aa	Basic analysis	Symbols, strings, imports	✅ Used (-A flag)
aaa	Full auto-analysis	Cross-references, basic blocks	✅ Used via jsonCommand
aaaa	Deep analysis	Type recovery, calling conventions	❌ Not used
aaaaa	Experimental	Emulation-based analysis	❌ Not used

fold gap: We stop at aaa. Running aaaa adds function signature recovery and calling convention detection — this would fix the "default params=3" heuristic in inferParamCountARM64.

What fold Should Implement

#	Feature	Based On	Effort	Detection Gain
1	Dangerous import flagging	r2 isj + CWE mapping	S	+12 findings
2	Hardcoded string detection	r2 izzj + regex patterns	S	+5 findings
3	aaaa analysis level	r2 deep analysis	S	+3 findings (type recovery)
4	BinaryIR encoding	Ghidra P-code 25-op model	M	Foundation
5	String-to-call xref analysis	r2 axtj + call targets	M	+2 findings
6	Basic block to Z3	angr pattern + existing encoder	L	+6 findings