6348820f92
- Each R2Session construction runs full auto-analysis - 4-6 aaa runs on a single binary → 60-90s timeout - Fix: share one R2Session across all extraction calls - Progressive analysis levels: aa (quick), aaa (full), aaaa (experimental)
38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
# Binary Scan Timeout Analysis — dbench_jumbf
|
|
|
|
> Date: 2026-05-30 | Source: Task #162
|
|
|
|
## Root Cause
|
|
|
|
Fold's binary scan times out on the 1.4MB dbench_jumbf x86-64 ELF because of
|
|
**repeated `aaa` analysis per function extraction call**. Each call to
|
|
`extractSymbols()`, `extractStrings()`, `extractCalls()`, etc. constructs a new
|
|
`R2Session`, which runs `aaa` (auto-analysis) from scratch. For a 1.4MB binary
|
|
with 200+ functions, this means 4-6 full `aaa` runs — each taking 15-30s on
|
|
larger binaries.
|
|
|
|
## Affected Code
|
|
|
|
- `src/binary/r2_backend.cpp`: `R2Session` construction runs `aaa` per session
|
|
- `src/cli/scan_runner.cpp`: `BinaryDetectorRunner` creates separate sessions
|
|
for imports, strings, and BB encoding passes
|
|
|
|
## Proposed Fixes
|
|
|
|
| Fix | Effort | Impact | Description |
|
|
|-----|--------|--------|-------------|
|
|
| **Session reuse** | S | High | Share one `R2Session` across all extraction calls in a single binary scan |
|
|
| **Streaming BB extraction** | M | Medium | Process basic blocks incrementally instead of batch-loading all at once |
|
|
| **Progressive aa levels** | S | Medium | Use `aa` for quick scans, `aaa` only when function recovery is requested |
|
|
| **Per-extraction timeout** | S | Low | Set 10s timeout per r2 command instead of 90s total budget |
|
|
|
|
## Recommended Implementation
|
|
|
|
1. In `src/binary/r2_backend.cpp::runDetectors()`, create ONE `R2Session` and
|
|
pass it to `extractDangerousImports()`, `extractHardcodedStrings()`,
|
|
`extractCalls()`, etc.
|
|
|
|
2. Add a `r2_analysis_level` option: `"aa"` (quick, default), `"aaa"` (full),
|
|
`"aaaa"` (experimental/comprehensive).
|
|
|
|
3. Add `--binary-analysis-level` CLI flag.
|