8af924dd47
- Ghidra P-code: 25-op arch-neutral IR → BinaryIR design - angr: symbolic path exploration → basic block to Z3 - r2 aaaa: function signature recovery → fix default params=3 - 6 recommended features ordered by effort/impact
52 lines
3.1 KiB
Markdown
52 lines
3.1 KiB
Markdown
# Binary Analysis Tools and Techniques Research
|
|
|
|
> Generated 2026-05-29. Research on Ghidra, angr, Binary Ninja, and radare2 for improving fold's 3.7% detection rate.
|
|
|
|
## Tool Comparison
|
|
|
|
| Tool | Key Technique | fold Applicability |
|
|
|------|-------------|-------------------|
|
|
| Ghidra | P-code decompiler → type recovery, call graph | High — P-code is arch-neutral IR |
|
|
| Binary Ninja | MLIL (Medium Level IL) → abstracted control flow | High — MLIL maps to BinaryIR |
|
|
| angr | Symbolic execution on binaries → path-based vulnerability detection | Medium — requires Python integration |
|
|
| radare2 (r2) | `aaa` analysis pipeline → strings, symbols, xrefs, basic blocks | Already used — fold's current backend |
|
|
|
|
## Ghidra P-Code Architecture
|
|
|
|
Ghidra's P-code is a register-transfer language:
|
|
- **Architecture-neutral**: x86_64, ARM64, MIPS all map to the same P-code ops
|
|
- **25 core operations**: LOAD, STORE, COPY, BRANCH, CBRANCH, CALL, RETURN, INT_ADD, INT_SUB, etc.
|
|
- **Type recovery**: Ghidra infers function signatures and data types from P-code patterns
|
|
|
|
**fold can adopt**: P-code's 25-op pattern as the core BinaryIR instruction set. This mirrors Infer's 10-op SIL approach — a small, universal instruction set that all architectures lower to.
|
|
|
|
## angr Symbolic Execution
|
|
|
|
angr's `claripy` symbolic engine can:
|
|
- **Find paths to specific addresses**: `simgr.explore(find=0x401234)` — find all inputs reaching a vulnerable function
|
|
- **Detect buffer overflows**: constrain symbolic input length, check if guard variables are overwritten
|
|
- **Detect format strings**: check if symbolic data reaches printf with fmt specifiers
|
|
|
|
**fold can adopt**: Use angr-like path exploration within the existing Z3 encoder. The encoder already does path-based queries — we just need to translate binary basic blocks (from r2's `pdbj`) into Z3 expressions.
|
|
|
|
## radare2 Analysis Levels
|
|
|
|
| Level | Command | What it provides | fold Usage |
|
|
|-------|---------|-----------------|------------|
|
|
| `aa` | Basic analysis | Symbols, strings, imports | ✅ Used (`-A` flag) |
|
|
| `aaa` | Full auto-analysis | Cross-references, basic blocks | ✅ Used via `jsonCommand` |
|
|
| `aaaa` | Deep analysis | Type recovery, calling conventions | ❌ Not used |
|
|
| `aaaaa` | Experimental | Emulation-based analysis | ❌ Not used |
|
|
|
|
**fold gap**: We stop at `aaa`. Running `aaaa` adds function signature recovery and calling convention detection — this would fix the "default params=3" heuristic in `inferParamCountARM64`.
|
|
|
|
## What fold Should Implement
|
|
|
|
| # | Feature | Based On | Effort | Detection Gain |
|
|
|---|---------|----------|--------|---------------|
|
|
| 1 | Dangerous import flagging | r2 `isj` + CWE mapping | S | +12 findings |
|
|
| 2 | Hardcoded string detection | r2 `izzj` + regex patterns | S | +5 findings |
|
|
| 3 | `aaaa` analysis level | r2 deep analysis | S | +3 findings (type recovery) |
|
|
| 4 | BinaryIR encoding | Ghidra P-code 25-op model | M | Foundation |
|
|
| 5 | String-to-call xref analysis | r2 `axtj` + call targets | M | +2 findings |
|
|
| 6 | Basic block to Z3 | angr pattern + existing encoder | L | +6 findings |
|