Defeating MBA-based Obfuscation

Ninon Eyrolles (1, 2) , Louis Goubin (2) , Marion Videau (3, 1)

1 Quarkslab
2 LMV - Laboratoire de Mathématiques de Versailles
3 CARAMBA - Cryptology, arithmetic : algebraic methods for better algorithms

Mixed Boolean-Arithmetic expressions are presented as a strong protection in the context of data flow obfuscation. As there is very little literature on the analysis of such obfus-cated expressions, two important subjects of interest are: to define what simplifying those expressions means, and how to design a simplification solution. We focus on evaluating the resilience of this technique, by giving theoretical elements to justify its efficiency and proposing a simplification algorithm using a pattern matching approach. The implementation of this solution is capable of simplifying the public examples of MBA-obfuscated expressions, demonstrating that at least a subset of MBA obfuscation lacks resilience against pattern matching analysis.

Mots clés: pattern matching; expression simplification; mixed boolean-arithmetic expressions; reverse engineering; Obfuscation

Domaines: Cryptographie et sécurité [cs.CR]

Ninon Eyrolles, Louis Goubin, Marion Videau. Defeating MBA-based Obfuscation. 2nd International Workshop on Software PROtection, Oct 2016, Vienna, Austria. ⟨10.1145/2995306.2995308⟩. ⟨hal-01388109⟩