Dyn-Phi: A Trace-Informed Join Node for Triaging Opaque Predicates and Dead Branches in Binary Code

Opaque predicates inflate a binary's control-flow graph, and the symbolic execution that can prove them infeasible scales poorly, so analysts must decide where to spend it. Dyn-Phi is a triage formulation for that decision. At each use where several definitions of a location may arrive, it annotates the static reaching set with how often each was observed to arrive in execution traces. A never-observed definition becomes a cold candidate for a three-valued verifier, whose counter-examples are replayed as new evidence.

We prove that observations lie inside the static set unless the CFG is incomplete, that dead definitions are cold, that code is removed only on the verifier's word, and that the loop terminates. An open implementation is evaluated on four corpora of 200 functions, two of them real gcc -O0 x86-64 code, with an exact verifier, paired bootstrap intervals, and two self-registered protocols.

Most findings are negative. A cold-definition filter needs about one sixth of the exhaustive queries, but only because it skips cheap feasible ones; if proving infeasibility costs 100 times more, the saving is 9%. Ranking by the score is worse than address order, feedback adds 0.4 points of recall, and a trace-free path-sensitive static baseline removes a quarter of the dead pairs for free. The zero-hit bound fails under correlated traces. No obfuscator output or real symbolic verifier is evaluated.

Code, tests, corpora and results: doi:10.5281/zenodo.23249925.