f4e3d32fcb
- Only 5/15 functions tested; extractCalls/extractXrefs/pdbj untested - CTF failures mapped to specific r2_backend.cpp code paths - Top fix: flag dangerous imports + hardcoded strings (S effort, +12 findings) - Full basic block analysis needed for div-by-zero/null-deref (L effort, +6)
2.5 KiB
2.5 KiB
Binary Backend Test Coverage and Failure-Point Audit
Generated 2026-05-29. Audits src/binary/r2_backend.cpp against test suite and CTF corpus.
Coverage Summary
| Function | Tested? | Test File |
|---|---|---|
R2Session::start() |
Yes | test_binary_backend.cpp |
R2Session::text() |
Yes | test_binary_backend.cpp |
R2Session::jsonCommand() |
Yes | test_binary_backend.cpp |
shellQuote() |
No | — |
jsonString() / jsonU64() |
No | — |
extractSections() |
Partial | test_binary_backend.cpp (only counts) |
extractStrings() |
Partial | test_binary_backend.cpp (only counts) |
extractCalls() |
No | — |
extractXrefs() |
Partial | test_binary_backend.cpp (by address) |
discoverFuzzTargets() |
No | — (tested via fuzz-prep integration) |
discoverObjcClasses() |
No | — |
discoverVtableTargets() |
No | — |
inferParamCountARM64() |
No | — (returns default 3 for all) |
discoverInternalFuzzTargets() |
No | — |
Coverage: ~35% of binary backend functions are tested.
CTF Failure Analysis
Map of each missed CTF vulnerability to the r2_backend.cpp function that should have caught it:
| CWE | Expected Finding | Code Path | Why Failed |
|---|---|---|---|
| CWE-121 (buffer overflow) | gets() import detection |
extractCalls() |
Function NOT IMPLEMENTED |
| CWE-134 (format string) | printf(user_input) |
axtj (xrefs) |
Xref from call to string not analyzed |
| CWE-416 (use-after-free) | free() + deref pattern |
extractCalls() |
No basic block analysis |
| CWE-369 (div-by-zero) | Division with potential zero | pdbj |
Basic block disasm exists but not queried |
| CWE-190 (int overflow) | Arithmetic overflow paths | pdbj |
Not analyzed |
| CWE-476 (null deref) | Pointer deref without check | pdbj |
Not analyzed |
| CWE-78 (cmd injection) | system(user_input) |
extractCalls() |
Import detected but not flagged |
| Hardcoded strings | "http://", "password" |
izzj |
String extraction works but not flagged as finding |
Prioritized Fix List
| # | Fix | Effort | Detection Gain |
|---|---|---|---|
| 1 | Flag system(), popen(), exec() imports |
S | +3 findings |
| 2 | Flag hardcoded URL/password strings | S | +5 findings |
| 3 | Flag gets/strcpy/printf imports | S | +4 findings |
| 4 | Analyze call xrefs to detect which strings feed into dangerous calls | M | +2 findings |
| 5 | Basic block analysis for div-by-zero / null-deref patterns | L | +6 findings |