Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

CoBRA (Coefficient-Based Reconstruction of Arithmetic)

Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. Given an expression and a bit width from 1 to 64, cobra-cli returns a simpler equivalent: a worklist scheduler combines signature-vector and change-of-basis techniques, semilinear handling of constant masks, polynomial recovery, decomposition of mixed products and subexpression lifting, and each result is checked on random inputs or, optionally, with a Z3 equivalence proof. The same engine is available as a library and as an optional LLVM pass plugin that simplifies MBA expressions it detects in LLVM IR.

Targets
Binary
Category
Binary analysis libraries
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v1.3.0, published 2026-06-30 without prebuilt binaries. The reviewed master commit is eight commits ahead: README edits, a CI dependency bump, a fix that requires LLVM only when the pass is built, and a fix that lets cobra-core build under MSVC.
  • Builds from source with CMake 3.20+ and a C++23 compiler (GCC 13+, Clang 17+ or Apple Clang 16+); a dependency superbuild builds Abseil and Highway, and GoogleTest when tests are enabled. The LLVM pass plugin needs LLVM 19 to 22, runs through opt as cobra-simplify, replaces an expression only when the simplified form is cheaper and drops nuw/nsw flags. Z3 checking is compiled in only when CMake finds Z3; otherwise cobra-cli warns that --verify is ignored. CI builds with Clang 22 and LLVM 22 on Ubuntu 24.04 on every run, and with GCC 14 and on macOS 15 only for version tags; Windows is not in CI.
  • cobra-cli takes the obfuscated expression as text, with at most 16 variables by default, so expressions in a binary must first be recovered with other tools or reach the pass as LLVM IR. The README's known limitations are deeply interleaved mixed-polynomial MBAs that exhaust the worklist budget, a few candidates that are correct only on Boolean inputs and are reported as verify-failed, and no general logic minimization.
  • The README reports 1,195 tests, and DATASETS.md reports 75,023 of 75,126 parsed expressions from 35 dataset files and seven sources simplified and spot-checked (99.86%). The OSES subsets are disabled for running out of memory or taking minutes per expression, so their figures come from an earlier run; DATASETS.md says the numbers are checked on every CI run, but the reviewed CI workflow excludes the dataset benchmark tests.
  • Apache-2.0 for CoBRA. The test/datasets files are redistributed from third-party research projects: THIRD_PARTY_LICENSES lists most as effectively GPL-3.0-only, Loki's as AGPL-3.0-only, and the OSES and ObfuscatorX sets with unspecified or unknown licenses.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · trailofbits/CoBRA · Revision af44b8a
  2. BUILD.md GitHub · trailofbits/CoBRA · Revision af44b8a
  3. DATASETS.md GitHub · trailofbits/CoBRA · Revision af44b8a
  4. THIRD_PARTY_LICENSES GitHub · trailofbits/CoBRA · Revision af44b8a
  5. docs/methodology/README.md GitHub · trailofbits/CoBRA · Revision af44b8a
  6. CMakeLists.txt GitHub · trailofbits/CoBRA · Revision af44b8a
  7. tools/cobra-cli/main.cpp GitHub · trailofbits/CoBRA · Revision af44b8a
  8. lib/llvm/CobraPass.cpp GitHub · trailofbits/CoBRA · Revision af44b8a
  9. test/llvm/CMakeLists.txt GitHub · trailofbits/CoBRA · Revision af44b8a
  10. .github/workflows/ci.yml GitHub · trailofbits/CoBRA · Revision af44b8a
  11. LICENSE GitHub · trailofbits/CoBRA · Revision af44b8a
  12. https://github.com/trailofbits/CoBRA/releases/tag/v1.3.0

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab