PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What theoretical tools are needed to simplify MBA expressions?

blog.quarkslab.com | research | #reverse-engineering | #obfuscation | #mba | #program-analysis | #deobfuscation | #math
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Why Mixed Boolean-Arithmetic (MBA) expressions are hard to de-obfuscate: the maths behind expressions that mix arithmetic and bitwise operators, and the theoretical tools needed to simplify them.
Published
Collected

Related coverage

research · blog.quarkslab.com
PhD defense of Ninon Eyrolles: Obfuscation with Mixed Boolean-Arithmetic Expressions: Reconstruction, Analysis and Simplification Tools
Ninon Eyrolles' PhD defense on Mixed Boolean-Arithmetic obfuscation: reconstructing an MBA implementation, defining simplicity metrics, and building two tools that simplify published MBA samples.
research · volexity.com
GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
# GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically April 1, 2025 Killian Raimbaud and Paul Rascagneres In the course of its investigations, Volexity...
research · blog.quarkslab.com
PhD Defense of Jonathan Salwan: Use of Symbolic Execution for Binary Deobfuscation
Announcement of Jonathan Salwan's PhD defense on using symbolic execution for binary deobfuscation, including the thesis abstract on opaque predicate detection and devirtualization approaches.
research · blog.quarkslab.com
Symbolic Deobfuscation: From Virtualized Code Back to the Original (DIMVA 2018)
A micro-post on joint research with CEA and VERIMAG (DIMVA 2018): symbolically deobfuscating virtualized hash functions by tainting VM inputs and concretizing unrelated instructions.
research · blog.quarkslab.com
Arybo: cleaning obfuscation by playing with mixed boolean and arithmetic operations
Introducing Arybo, a Python module wrapping a native library for understanding, creating and simplifying Mixed Boolean-Arithmetic expressions, aiding de-obfuscation of protected code.
research · blog.quarkslab.com
Deobfuscation: recovering an OLLVM-protected program
Quarkslab breaks the protections of Obfuscator-LLVM (LLVM 3.5) on a sample function, stripping control-flow flattening and the other layers one by one with the Miasm reverse-engineering framework.
Back