Dyn-Phi: A Trace-Based Dynamic Phi-Node Frameworkfor Opaque Predicate and Dead Code Detection in Binary Analysis

This repository contains the preprint and evaluation artifacts for Dyn-Phi, a lightweight triage layer that augments classical Static Single Assignment (SSA) join nodes with observed execution frequencies. Classical SSA places phi nodes purely on dominance frontiers; Dyn-Phi extends this by tagging join points with empirical register definition frequencies to prioritize dead code and opaque predicate candidates before invoking computationally intensive symbolic execution engines.

The implementation was evaluated directly within Rerius, an open-source, zero-third-party-dependency binary analysis engine written in C99. Rather than relying on idealized synthetic benchmarks, this study evaluates the engine through a white-box methodology. The evaluation measures function boundary recovery against compiler ground truth, disassembly throughput, memory footprint, and analysis behavior across a ground-truth-labeled AArch64 probe suite.