fold/docs/internal/binary-scan-timeout-analysis.md

Binary Scan Timeout Analysis — dbench_jumbf

Date: 2026-05-30 | Source: Task #162

Root Cause

Fold's binary scan times out on the 1.4MB dbench_jumbf x86-64 ELF because of repeated aaa analysis per function extraction call. Each call to extractSymbols(), extractStrings(), extractCalls(), etc. constructs a new R2Session, which runs aaa (auto-analysis) from scratch. For a 1.4MB binary with 200+ functions, this means 4-6 full aaa runs — each taking 15-30s on larger binaries.

Affected Code

• src/binary/r2_backend.cpp: R2Session construction runs aaa per session
• src/cli/scan_runner.cpp: BinaryDetectorRunner creates separate sessions for imports, strings, and BB encoding passes

Proposed Fixes

Fix	Effort	Impact	Description
Session reuse	S	High	Share one R2Session across all extraction calls in a single binary scan
Streaming BB extraction	M	Medium	Process basic blocks incrementally instead of batch-loading all at once
Progressive aa levels	S	Medium	Use aa for quick scans, aaa only when function recovery is requested
Per-extraction timeout	S	Low	Set 10s timeout per r2 command instead of 90s total budget

Recommended Implementation

1. In src/binary/r2_backend.cpp::runDetectors(), create ONE R2Session and pass it to extractDangerousImports(), extractHardcodedStrings(), extractCalls(), etc.

2. Add a r2_analysis_level option: "aa" (quick, default), "aaa" (full), "aaaa" (experimental/comprehensive).

3. Add --binary-analysis-level CLI flag.