This repo includes links relevant to Mixed Boolean-Arithmetic (MBA) obfuscation. PRs are welcome.

Note that some resources here are not strictly related to MBA, though all are relevant in some way.

Papers

• Information Hiding in Software with Mixed Boolean-Arithmetic Transforms
• Obfuscation with Mixed Boolean-Arithmetic Expressions : reconstruction, analysis and simplification tools
• Analysis and applications of orthogonal approaches to simplify Mixed Boolean-Arithmetic expressions
• Code deobfuscation by program synthesis-aided simplification of Mixed Boolean-Arithmetic expressions
• Boosting SMT solver performance on mixed-bitwise-arithmetic expressions
• MBA-Blast: Unveiling and Simplifying Mixed Boolean-Arithmetic Obfuscation
• An In-Place Simplification on Mixed Boolean-Arithmetic Expressions
• Software Obfuscation with Non-Linear Mixed Boolean-Arithmetic Expressions
• NeuReduce: Reducing Mixed Boolean-Arithmetic Expressions by Recurrent Neural Network
• Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions
• Simplifying Mixed Boolean-Arithmetic Obfuscation by Program Synthesis and Term Rewriting
• Simplification of General Mixed Boolean-Arithmetic Expressions: GAMBA
• Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions
• Mixed Boolean-Arithmetic (MBA) Obfuscation Using Permutation Polynomials on Modular Lipschitz Integers
• On simplifying expressions with mixed Boolean-arithmetic
• Binary Permutation Polynomial Inversion and Application to Obfuscation Techniques
• Quadratic time algorithm for inversion of binary permutation polynomials
• Efficient Normalized Reduction and Generation of Equivalent Multivariate Binary Polynomials
• Bypassing Malware Obfuscation with Dynamic Synthesis
• Search-Based Local Black-Box Deobfuscation: Understand, Improve and Mitigate
• Syntia: Synthesizing the Semantics of Obfuscated Code
• Arybo: Manipulation, Canonicalization and Identification of Mixed Boolean-Arithmetic Symbolic Expressions
• Loki: Hardening Code Obfuscation Against Automated Attacks
• QSynth – A Program Synthesis based approach for Binary Code Deobfuscation
• On polynomial functions (mod m)
• Polynomial functions (modm)
• Permutation Polynomials Modulo 2^w
• Gröbner Bases for Boolean Function Minimization

Implementations

Simplification:

• SiMBA: Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions
• SiMBA++: Port of SiMBA to C/C++
• GAMBA: Simplification of General Mixed Boolean-Arithmetic Expressions
• Oracle Syntehsis Meets Equality Saturation
• MSiMBA: Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions
• Simplifier: Efficient general mixed boolean-arithmetic (MBA) simplifier
• MBA-Blast: Tool for simplification of MBA expressions
• MBA-Solver: Boosting SMT solver performance on mixed-bitwise-arithmetic expressions
• Arybo: Manipulation, canonicalization and identification of mixed boolean-arithmetic symbolic expressions
• msynth: Code deobfuscation framework to simplify Mixed Boolean-Arithmetic (MBA) expressions
• QSynth: Greybox Synthesizer geared for deobfuscation of assembly instructions
• gooMBA: Hex-Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions
• Syntia: Program synthesis based deobfuscation framework
• Tigress Deobfuscation - Documentation of several Tigress obfuscation passes and an attempt to simplify Mixed Boolean-Arithmetic (MBA) expressions
• M3: An Efficient Deobfuscation of Mixed Boolean Arithmetic (MBA) Expressions Using Dynamic Analysis

Boolean manipulation and minimization:

• Gröbner Bases for Boolean Function Minimization
• Espresso heuristic logic minimizer
• Kitty: C++ boolean truth table library
• Combining DNF minimization, ANF minimization, and up to 4-variable precomputed truth tables
• DenseQMC: A bit-slice implementation of the Quine-McCluskey algorithm
• boolean_expression: a small Rust crate for Boolean expressions and BDDs

Construction:

• MBA-Obfuscator: Tool for generating Non-linear Mixed Boolean-Arithmetic Expressions
• Mba: Mixed Boolean-Arithmetic
• Pocket: Mixed Boolean Arithmetic Expression Obfuscator
• MBA-Generator: Generator for Mixed-Boolean-Arithmetic expressions.
• Mutaben: Simple mixed-boolean-arithmetic (MBA) generator witten in python
• Mixed-boolean-transform: Mixed boolean arithmetic x+y transform

Blog Posts

• Mixed Boolean-Arithmetic
• Improving MBA Deobfuscation using Equality Saturation
• What theoretical tools are needed to simplify MBA expressions?
• Introduction to Pocket: obfuscator for Mixed Boolean Arithmetic expressions
• Practical MBA Deobfuscation with msynth

Miscellaneous items (only tangentially relevant to MBA)

• ægraphs: Acyclic E-graphs for Efficient Optimization in a Production Compiler
• Optir: Compiler optimizer for arbitrary control flow based on equality saturation
• Z3 adventures and fast Boolean matching
• Fast Boolean Matching Based on NPN Classification
• SAT-Based Algorithms for Logic Minimization
• Cranelift's Instruction Selector DSL, ISLE: Term-Rewriting Made Practical