MBASED: Practical Simplifications of Mixed Boolean-Arithmetic Obfuscation

Mixed Boolean-Arithmetic (MBA) obfuscation is a technique that complicates boolean expressions by combining arithmetic and boolean operations. It obstructs the process of reverse engineering by making code more difficult to analyze. This paper presents the Binary Ninja plugin, MBASED (Mixed Boolean-Arithmetic Simplification Engine for Deobfuscation), which performs MBA deobfuscation on C programs. It utilizes novel simplification methods that take ideas from compiler construction and simplification performed on parse trees. MBASED is the first practical implementation of MBA deobfuscation in an industry-grade decompiler. Its extensible framework allows users to incorporate their own simplification passes.