Skip to content

Gold-standard typed session rewrite for radare2 integration#38

Open
0verflowme wants to merge 40 commits into
masterfrom
codex/gold-standard-r2sleigh
Open

Gold-standard typed session rewrite for radare2 integration#38
0verflowme wants to merge 40 commits into
masterfrom
codex/gold-standard-r2sleigh

Conversation

@0verflowme
Copy link
Copy Markdown
Member

Summary

  • routes r2sleigh analysis through the Rust-owned typed session/store path
  • keeps r2plugin as radare2 glue around R2SleighSessionInput, typed session results, and mutation plans
  • removes legacy internal interproc/type-writeback JSON transport and refreshes r2r/e2e coverage

Pairing requirement

This PR requires the matching radare2 seam branch: 0verflowme/radare2:codex/gold-standard-radare2-seam.

Compatibility note

Low-level debug command compatibility is intentionally not preserved; public behavior is the workflow-oriented surface plus debug namespace coverage.

Validation

  • Z3_SYS_Z3_HEADER=/opt/homebrew/include/z3.h Z3_LIBRARY_PATH_OVERRIDE=/opt/homebrew/lib cargo test --workspace --features all-archs
  • Z3_SYS_Z3_HEADER=/opt/homebrew/include/z3.h Z3_LIBRARY_PATH_OVERRIDE=/opt/homebrew/lib cargo clippy -p r2ssa --all-targets -- -D warnings
  • Z3_SYS_Z3_HEADER=/opt/homebrew/include/z3.h Z3_LIBRARY_PATH_OVERRIDE=/opt/homebrew/lib cargo clippy -p r2sym --all-targets -- -D warnings
  • Z3_SYS_Z3_HEADER=/opt/homebrew/include/z3.h Z3_LIBRARY_PATH_OVERRIDE=/opt/homebrew/lib cargo clippy -p r2types --all-targets -- -D warnings
  • Z3_SYS_Z3_HEADER=/opt/homebrew/include/z3.h Z3_LIBRARY_PATH_OVERRIDE=/opt/homebrew/lib cargo clippy -p r2dec --all-targets -- -D warnings
  • Z3_SYS_Z3_HEADER=/opt/homebrew/include/z3.h Z3_LIBRARY_PATH_OVERRIDE=/opt/homebrew/lib cargo clippy -p r2sleigh-plugin --features all-archs -- -D warnings
  • make -C r2plugin RUST_FEATURES=all-archs install
  • PATH="/usr/local/bin:/opt/homebrew/bin:$PATH" make -C tests/r2r run R2R_TIMEOUT=120 R2R_JOBS=1
  • R2R_RADARE2=/Users/priyanshu/code/radare2/binr/radare2/radare2 cargo e2e-test
  • git diff --check

- Introduced a new `spec` module to define exploration specifications, including predicates, input configurations, and budget constraints.
- Enhanced the `PathExplorer` to support running exploration specifications, allowing for more controlled symbolic execution paths.
- Added functionality to handle symbolic file descriptor inputs, enabling the exploration of paths based on external input streams.
- Updated tests to validate the new exploration specification features, ensuring correct behavior in symbolic execution scenarios.

This commit enhances the symbolic execution framework by allowing users to define and run detailed exploration strategies.
- Updated dependencies in Cargo.lock, including new packages such as `anes`, `cast`, `ciborium`, and `criterion`, along with their respective versions and checksums.
- Introduced a new benchmark for symbolic execution in `r2sym`, allowing for performance evaluation of hot paths in symbolic execution.
- Enhanced the `ExploreConfig` structure to include a `max_completed_paths` option, providing better control over exploration limits.
- Added tests to validate the new exploration capabilities and ensure correct behavior in symbolic execution scenarios.

This commit improves the dependency management and expands the symbolic execution framework's capabilities, facilitating more efficient exploration strategies.
- Introduced `VmUnaryOp` and `VmBinaryOp` enums to represent unary and binary operations in the symbolic execution context.
- Updated `VmValueExpr` to support new operation types, including rendering logic for unary and binary expressions.
- Enhanced the `evaluate_u64` method to handle new binary operations, improving the evaluation capabilities of symbolic expressions.
- Refactored related code to integrate new operations into the existing symbolic execution framework.

This commit expands the symbolic execution capabilities, allowing for more complex expressions and operations to be evaluated during analysis.
- Added functions to format VM guarded exits and memory conditions, improving the representation of symbolic execution states.
- Updated the Decompiler to include counts for likely and heuristic transfers, enhancing the semantic analysis capabilities.
- Refactored output formatting to include new metrics such as exact exit guards and total memory effects, providing more detailed insights during analysis.

This commit expands the symbolic execution framework, allowing for better tracking and representation of VM states and their associated conditions.
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e13459cb75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread r2plugin/r_anal_sleigh.c
@0verflowme 0verflowme force-pushed the codex/gold-standard-r2sleigh branch 13 times, most recently from 6331273 to c6141c1 Compare April 25, 2026 15:55
@0verflowme 0verflowme force-pushed the codex/gold-standard-r2sleigh branch 5 times, most recently from e11406f to 3cc719d Compare April 25, 2026 16:38
@0verflowme 0verflowme force-pushed the codex/gold-standard-r2sleigh branch from 3cc719d to 3fd4bfb Compare April 25, 2026 16:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant