aligned-entry: reduce false positives on -O2 optimized binaries

[dodoazzurro]

The combined detector (DetectFunctionsFromELF) produces a ~2.8x FP multiplier on -O2 binaries (14 FPs for 5 real functions in a stripped test binary). Recall is 5/5 but the noise makes the output impractical without post-filtering by the caller.

The FPs come from all three strategies combined - prologue, call-site, and aligned-entry. Aligned-entry is the likely largest contributor and the most tractable to improve, but the combined FP rate will never reach 0x: prologue patterns can match inside functions and call-site analysis picks up non-function jump targets regardless.

The most actionable starting point is reducing the aligned-entry noise. The main source there is loop-head alignment: with -O2, GCC aligns loop heads to 16-byte boundaries using NOP fill, producing the same ret + NOP padding + 16-byte aligned address pattern as a function separator.

/cc @maxgio92

[dodoazzurro]

Three directions to reduce the noise, roughly by impact:

Backward-branch target filter

Collect all backward-branch targets from the code (unconditional JMP/B instructions where target < source - these are loop back-edges). Any aligned-entry candidate that is also a backward-branch target is almost certainly a loop head, not a function entry, and should be discarded.

This directly attacks the main FP source. The backward-branch targets are already discoverable during call-site analysis at no extra cost, so this is mostly a post-filter step in DetectFunctions.

Prologue gate

After finding an aligned-entry candidate, check whether the instruction at that address matches any known prologue pattern (push rbp, sub rsp, callee-saved register push, etc.). A candidate with no prologue signal and no call-site edge is much weaker evidence. This could either filter it out entirely or require a higher NOP count threshold before emitting it.

Inter-function boundary post-filter

Once the high/medium confidence candidates (prologue + call-site) are known, build a sorted list of confirmed function ranges. An aligned-entry candidate that falls inside a confirmed function body is an intra-function alignment point and can be discarded. This requires knowing approximate function sizes, which means pairing candidates with the next detected boundary - doable but more involved than the other two.