Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions
Abstract
Mixed Boolean-Arithmetic (MBA) obfuscation is a common technique used to transform simple expressions into semantically equivalent but more complex combinations of boolean and arithmetic operators. Its widespread usage in DRM systems, malware, and software protectors is well documented. In 2021, Liu et al. proposed a groundbreaking method of simplifying linear MBAs, utilizing a hidden two-way transformation between 1-bit and n-bit variables. In 2022, Reichenwallner et al. proposed a similar but more effective method of simplifying linear MBAs, SiMBA, relying on a similar but more involved theorem. However, because current linear MBA simplifiers operate in 1-bit space, they cannot handle expressions which utilize constants inside of their bitwise operands, e.g. (x&1), (x&1111) + (y&1111). We propose an extension to SiMBA that enables simplification of this broader class of expressions. It surpasses peer tools, achieving efficient simplification of a class of MBAs that current simplifiers struggle with.
Cite
@article{arxiv.2406.10016,
title = {Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions},
author = {Colton Skees},
journal= {arXiv preprint arXiv:2406.10016},
year = {2024}
}
Comments
- Note that Zhou et al's 2007 paper was first to prove the N-bit to 1-bit transform, as opposed to Liu et al. in 2021 - Update email href - Apply constant propagation over multiplication by two constants before computing # of nodes - Change example MBA used in the introduction section