The smaller graph problem#

A success, by every visible measure#

• stock unflattener, exit code 0
• patch generated, executable written
• 56 blocks → 10 blocks — Miasm graphs, both counted alike
• same file size, same sections, same exports
• valid PE

The most dramatic simplification in the corpus.

It computes the wrong answer#

expected   FLA = DBEFFCE7   SHOWCASE PASS
actual     FLA = F9CD8332   SHOWCASE FAIL: 1

exit 1

Why#

The source has a four-way switch. Its four cases were grouped under one incoming state, then emitted in sequence:

0x140001348:  xor 0x22222222
              sub 0x3333
              add 0x4444
              add 0x11111111
              xor 0xCAFEBABE

All four alternatives now run. Every time.

The score said so, quietly#

14 out of 22 was visible before anyone ran the binary.

Verifier-valid LLVM IR#

• whole-function lift of a passing native binary
• 17 cases, 68 modules, all verifier-clean and recompilable
• smaller and more readable than the machine code
• 3,917 of 4,118 inputs miscomputed — at all four stages

At x = 0: expected 0x08083808, actual 0.

The cause is one fold#

(~A & B) | (A & C)   →   select(A, C, B)

Justified by known-bits extrema: an unconstrained integer has those extrema too, which does not prove A is all-zeros or all-ones.

A = 1, B = 0, C = 2 → bitwise gives 0, the select gives 2.

What generalised#

• semantic branch proof + a separate layout-preserving patcher — across OLLVM-16 and Polaris
• local arithmetic recovery, each candidate independently proved
• stock unflattening from one LLVM-family implementation to a related one

All three carry an explicit model and a separate validation step.

What did not#

• a fixed seed as a reconstruction key
• local expression recovery as evidence about a whole function
• an -O0 result as evidence about -O2
• a mathematical identity under machine-width overflow
• an initialised-state invariant as a claim about arbitrary state

These recognise a shape.

Four traps#

Block IV#

• Week 10 — the audit: the wrong rewrite and the discovery failure
• Week 11 — one tool, one day, one pass and one fail
• Week 12 — what would you choose, and what would you check?

The capstone is due at the end of week 12.