76 lines
3.5 KiB
Markdown
76 lines
3.5 KiB
Markdown
# Vendor Architecture Audit Findings
|
|
|
|
> Date: 2026-05-31; updated after vendor-surface pruning.
|
|
> Architecture map: `docs/research/vendor-architecture-map-2026-05-31.md`.
|
|
> Reading list: `docs/research/vendor-library-study-2026-05-31.md`.
|
|
|
|
## Summary
|
|
|
|
The vendor surface is now intentionally narrow:
|
|
|
|
- **Active:** Ghidra/SLEIGH for binary semantics.
|
|
- **Manifest-only candidates:** LIEF for binary metadata, Souffle for Fold-owned
|
|
facts.
|
|
- **Deferred:** RetDec, Remill/McSema, PhASAR, Crab/Clam.
|
|
|
|
## Findings and status
|
|
|
|
| ID | Severity | Finding | Status |
|
|
|---|---|---|---|
|
|
| V1 | High | Ghidra-enabled macOS build failed because zlib injected SDK include paths before libc++ headers. | Fixed: Ghidra now links `libz` via `cpp.find_library('z')`. |
|
|
| V2 | Medium | Binary lanes needed explicit ownership between metadata, heuristics, raw P-Code, and SSA P-Code. | Addressed: architecture map assigns r2/LIEF to metadata and Ghidra to semantics. |
|
|
| V3 | Medium | Ghidra P-Code support was initially AArch64-only. | Partially fixed: x86/x86-64 SLEIGH and arch mappings added; ARM32/MIPS remain future scope. |
|
|
| V4 | Medium | P-Code encoder intentionally under-approximates path-sensitive hazards. | Open: expand CBRANCH/path predicates before broad SAT hazard gates. |
|
|
| V5 | Low | `.sla` docs and runtime behavior diverged. | Fixed: checked-in `.sla` are runtime copies; Meson-generated `.sla` are validation artifacts. |
|
|
| V6 | Low | Too many dormant vendor lanes created misleading build surface. | Fixed: active scaffolding pruned to Souffle and LIEF only. |
|
|
| V7 | High | SQL injection detector missed return-value taint sources such as `getenv()`. | Fixed with regression tests. |
|
|
| V8 | High | r2 CLI fallback could hang or run uncapped structural scans. | Fixed with CLI timeout and bounded fallback scans. |
|
|
| V9 | Medium | Base64 hardcoded-string heuristic over-reported by marker syntax alone. | Fixed with decode/entropy filtering and tests. |
|
|
| V10 | Medium | P-Code `int-overflow` gate over-advertised unsigned machine arithmetic. | Fixed: P-Code overflow hooks remain gated until signedness provenance exists. |
|
|
|
|
## Current vendor policy
|
|
|
|
### Ghidra/SLEIGH
|
|
|
|
Ghidra owns binary semantics. Fold should continue mapping P-Code into native
|
|
hazard observers and summaries. External references:
|
|
|
|
- https://ghidra.re/ghidra_docs/languages/html/pcoderef.html
|
|
- https://ghidra.re/ghidra_docs/languages/html/sleigh.html
|
|
|
|
### LIEF
|
|
|
|
LIEF is the next metadata candidate. It should mirror r2-backed metadata first,
|
|
without changing finding semantics. External references:
|
|
|
|
- https://lief.re/doc/latest/api/cpp/index.html
|
|
- https://lief.re/doc/stable/api/binary_abstraction/cpp.html
|
|
|
|
### Souffle
|
|
|
|
Souffle is the next derived-fact candidate after stable MidIR/fact IDs. Start
|
|
with standalone TSV facts and `.dl` rules. External references:
|
|
|
|
- https://souffle-lang.github.io/interface
|
|
- https://souffle-lang.github.io/execute
|
|
|
|
## Deferred candidates
|
|
|
|
RetDec, Remill/McSema, PhASAR, and Crab/Clam are documented in the reading list
|
|
but should not be scaffolded again until a fixture demonstrates need.
|
|
|
|
## Validation already run for related fixes
|
|
|
|
```sh
|
|
ninja -C build/release
|
|
meson test -C build/release --print-errorlogs
|
|
meson test -C build/release pcode_summary --print-errorlogs
|
|
git diff --check
|
|
```
|
|
|
|
## Remaining follow-up
|
|
|
|
1. Add LIEF metadata prototype only after listing current r2 metadata fields.
|
|
2. Define stable MidIR/fact IDs before Souffle.
|
|
3. Expand Ghidra P-Code path predicates before broadening binary hazard gates.
|
|
4. Keep deferred vendors docs-only unless a reproducible fixture proves need.
|