{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/BUILD.md", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/DATASETS.md", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/THIRD_PARTY_LICENSES", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/docs/methodology/README.md", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/CMakeLists.txt", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/tools/cobra-cli/main.cpp", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/lib/llvm/CobraPass.cpp", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/test/llvm/CMakeLists.txt", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/.github/workflows/ci.yml", "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/LICENSE", "https://github.com/trailofbits/CoBRA/releases/tag/v1.3.0" ], "category": "binary-libraries", "description_en": "Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. Given an expression and a bit width from 1 to 64, cobra-cli returns a simpler equivalent: a worklist scheduler combines signature-vector and change-of-basis techniques, semilinear handling of constant masks, polynomial recovery, decomposition of mixed products and subexpression lifting, and each result is checked on random inputs or, optionally, with a Z3 equivalence proof. The same engine is available as a library and as an optional LLVM pass plugin that simplifies MBA expressions it detects in LLVM IR.", "description_zh": "Trail of Bits 开发的 C++23 混合布尔-算术（MBA）表达式化简器。MBA 是一种混淆技术，会把简单运算改写为算术、按位与移位运算交织的复杂形式。cobra-cli 接受一个表达式和 1 至 64 位的位宽，输出更简单的等价式：工作列表调度器组合签名向量与基变换技术、带常量掩码的半线性处理、多项式恢复、混合乘积分解和子表达式提升，每个结果都会用随机输入抽查，也可选用 Z3 做等价性证明。同一引擎还以库的形式提供，并可编译为 LLVM 优化遍插件，对其在 LLVM IR 中检测到的 MBA 表达式进行化简。", "entry_url": "https://awesomerea.org/resources/cobra-mba-simplifier/", "entry_url_zh": "https://awesomerea.org/zh/resources/cobra-mba-simplifier/", "evidence_url": "https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/README.md", "group": "tools", "id": "cobra-mba-simplifier", "json_url": "https://awesomerea.org/resources/cobra-mba-simplifier/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/cobra-mba-simplifier/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/cobra-mba-simplifier/index.md", "name": "CoBRA (Coefficient-Based Reconstruction of Arithmetic)", "name_zh": "CoBRA 混合布尔-算术表达式化简器", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: v1.3.0, published 2026-06-30 without prebuilt binaries. The reviewed master commit is eight commits ahead: README edits, a CI dependency bump, a fix that requires LLVM only when the pass is built, and a fix that lets cobra-core build under MSVC.", "Builds from source with CMake 3.20+ and a C++23 compiler (GCC 13+, Clang 17+ or Apple Clang 16+); a dependency superbuild builds Abseil and Highway, and GoogleTest when tests are enabled. The LLVM pass plugin needs LLVM 19 to 22, runs through opt as cobra-simplify, replaces an expression only when the simplified form is cheaper and drops nuw/nsw flags. Z3 checking is compiled in only when CMake finds Z3; otherwise cobra-cli warns that --verify is ignored. CI builds with Clang 22 and LLVM 22 on Ubuntu 24.04 on every run, and with GCC 14 and on macOS 15 only for version tags; Windows is not in CI.", "cobra-cli takes the obfuscated expression as text, with at most 16 variables by default, so expressions in a binary must first be recovered with other tools or reach the pass as LLVM IR. The README's known limitations are deeply interleaved mixed-polynomial MBAs that exhaust the worklist budget, a few candidates that are correct only on Boolean inputs and are reported as verify-failed, and no general logic minimization.", "The README reports 1,195 tests, and DATASETS.md reports 75,023 of 75,126 parsed expressions from 35 dataset files and seven sources simplified and spot-checked (99.86%). The OSES subsets are disabled for running out of memory or taking minutes per expression, so their figures come from an earlier run; DATASETS.md says the numbers are checked on every CI run, but the reviewed CI workflow excludes the dataset benchmark tests.", "Apache-2.0 for CoBRA. The test/datasets files are redistributed from third-party research projects: THIRD_PARTY_LICENSES lists most as effectively GPL-3.0-only, Loki's as AGPL-3.0-only, and the OSES and ObfuscatorX sets with unspecified or unknown licenses." ], "requirements_zh": [ "审阅时最新版本为 v1.3.0，发布于 2026-06-30，未附带预编译二进制。所审阅的 master 提交比该版本多八个提交：修改 README、升级 CI 依赖、改为仅在构建优化遍插件时才要求 LLVM，以及使 cobra-core 能用 MSVC 构建。", "从源码构建需要 CMake 3.20+ 和 C++23 编译器（GCC 13+、Clang 17+ 或 Apple Clang 16+）；依赖超级构建会编译 Abseil 和 Highway，启用测试时还会编译 GoogleTest。LLVM 优化遍插件需要 LLVM 19 至 22，通过 opt 以 cobra-simplify 名称运行，仅在化简结果开销更低时才替换表达式，并会丢弃 nuw/nsw 标志。只有 CMake 找到 Z3 时才会编译 Z3 校验功能，否则 cobra-cli 会提示 --verify 被忽略。CI 每次都在 Ubuntu 24.04 上用 Clang 22 和 LLVM 22 构建，GCC 14 和 macOS 15 构建仅针对版本标签运行；Windows 不在 CI 范围内。", "cobra-cli 以文本形式接收混淆表达式，默认最多 16 个变量，因此二进制中的表达式须先借助其他工具恢复，或以 LLVM IR 形式交给优化遍处理。README 列出的已知局限包括：算术与按位运算深度交织、提升后仍耗尽工作列表预算的混合多项式 MBA；少数只在布尔输入上成立、因而被报告为校验失败的候选结果；以及不提供通用逻辑最小化。", "README 报告共有 1,195 项测试；DATASETS.md 报告，在来自七个来源、35 个数据集文件的 75,126 个可解析表达式中，有 75,023 个完成化简并通过抽查（99.86%）。OSES 子集因内存耗尽或每个表达式需耗时数分钟而被停用，其数字来自此前的一次运行；DATASETS.md 称这些数字在每次 CI 运行时都会核对，但所审阅的 CI 工作流排除了数据集基准测试。", "CoBRA 本身采用 Apache-2.0 许可。test/datasets 中的文件转载自第三方研究项目：THIRD_PARTY_LICENSES 将其中大部分列为实际适用 GPL-3.0-only，Loki 数据集为 AGPL-3.0-only，OSES 和 ObfuscatorX 数据集的许可证未说明或未知。" ], "targets": [ "binary" ], "url": "https://github.com/trailofbits/CoBRA", "verification": "source-reviewed", "verified_at": "2026-10-20" }