3.5 KiB
Vendor Architecture Audit Findings
Date: 2026-05-31; updated after vendor-surface pruning. Architecture map:
docs/research/vendor-architecture-map-2026-05-31.md. Reading list:docs/research/vendor-library-study-2026-05-31.md.
Summary
The vendor surface is now intentionally narrow:
- Active: Ghidra/SLEIGH for binary semantics.
- Manifest-only candidates: LIEF for binary metadata, Souffle for Fold-owned facts.
- Deferred: RetDec, Remill/McSema, PhASAR, Crab/Clam.
Findings and status
| ID | Severity | Finding | Status |
|---|---|---|---|
| V1 | High | Ghidra-enabled macOS build failed because zlib injected SDK include paths before libc++ headers. | Fixed: Ghidra now links libz via cpp.find_library('z'). |
| V2 | Medium | Binary lanes needed explicit ownership between metadata, heuristics, raw P-Code, and SSA P-Code. | Addressed: architecture map assigns r2/LIEF to metadata and Ghidra to semantics. |
| V3 | Medium | Ghidra P-Code support was initially AArch64-only. | Partially fixed: x86/x86-64 SLEIGH and arch mappings added; ARM32/MIPS remain future scope. |
| V4 | Medium | P-Code encoder intentionally under-approximates path-sensitive hazards. | Open: expand CBRANCH/path predicates before broad SAT hazard gates. |
| V5 | Low | .sla docs and runtime behavior diverged. |
Fixed: checked-in .sla are runtime copies; Meson-generated .sla are validation artifacts. |
| V6 | Low | Too many dormant vendor lanes created misleading build surface. | Fixed: active scaffolding pruned to Souffle and LIEF only. |
| V7 | High | SQL injection detector missed return-value taint sources such as getenv(). |
Fixed with regression tests. |
| V8 | High | r2 CLI fallback could hang or run uncapped structural scans. | Fixed with CLI timeout and bounded fallback scans. |
| V9 | Medium | Base64 hardcoded-string heuristic over-reported by marker syntax alone. | Fixed with decode/entropy filtering and tests. |
| V10 | Medium | P-Code int-overflow gate over-advertised unsigned machine arithmetic. |
Fixed: P-Code overflow hooks remain gated until signedness provenance exists. |
Current vendor policy
Ghidra/SLEIGH
Ghidra owns binary semantics. Fold should continue mapping P-Code into native hazard observers and summaries. External references:
- https://ghidra.re/ghidra_docs/languages/html/pcoderef.html
- https://ghidra.re/ghidra_docs/languages/html/sleigh.html
LIEF
LIEF is the next metadata candidate. It should mirror r2-backed metadata first, without changing finding semantics. External references:
- https://lief.re/doc/latest/api/cpp/index.html
- https://lief.re/doc/stable/api/binary_abstraction/cpp.html
Souffle
Souffle is the next derived-fact candidate after stable MidIR/fact IDs. Start
with standalone TSV facts and .dl rules. External references:
Deferred candidates
RetDec, Remill/McSema, PhASAR, and Crab/Clam are documented in the reading list but should not be scaffolded again until a fixture demonstrates need.
Validation already run for related fixes
ninja -C build/release
meson test -C build/release --print-errorlogs
meson test -C build/release pcode_summary --print-errorlogs
git diff --check
Remaining follow-up
- Add LIEF metadata prototype only after listing current r2 metadata fields.
- Define stable MidIR/fact IDs before Souffle.
- Expand Ghidra P-Code path predicates before broadening binary hazard gates.
- Keep deferred vendors docs-only unless a reproducible fixture proves need.