Skip to content

Simplifying MBA obfuscation with CoBRA

0.5798
Chimera Difficulty Score
a synthesis of Flesch-Kincaid, Coleman-Liau, SMOG, and Dale-Chall readability metrics
Simplifying MBA obfuscation with CoBRA Mixed Boolean-Arithmetic (MBA) obfuscation disguises simple operations like x + y behind tangles of arithmetic and bitwise operators. Malware authors and software protectors rely on it because no standard simplification technique covers both domains simultaneously; algebraic simplifiers don’t understand bitwise logic, and Boolean minimizers can’t handle arith...
CoBRA addresses the challenge of MBA obfuscation by developing an efficient orchestrator that classifies input expressions and selects the right combination of simplification techniques. By handling both arithmetic and bitwise operations, CoBRA provides a much-needed solution for the security community as previous approaches have fallen short in dealing with this complex type of obfuscation. However, it should be noted that the tool is not foolproof, with some carry-sensitive mixed-domain cases ...