Simplifying MBA Expression Using E-Graphs

arXiv:2404.05431v1 Announce Type: new
Abstract: Code obfuscation involves the addition of meaningless code or the complication of existing code in order to make a program difficult to reverse engineer. In recent years, MBA (Mixed Boolean Arithmetic) obfuscation has been applied to virus and malware code to impede expert analysis. Among the various obfuscation techniques, Mixed Boolean Arithmetic (MBA) obfuscation is considered the most challenging to decipher using existing code deobfuscation techniques. In this paper, we have attempted to simplify the …

addition analysis arxiv code code obfuscation cs.cr engineer expert expert analysis graphs malware obfuscation order program reverse reverse engineer techniques virus