AwesomeREA.org

Tool

CoBRA (Coefficient-Based Reconstruction of Arithmetic)

Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. Given an expression and a bit width from 1 to 64, cobra-cli returns a simpler equivalent: a worklist scheduler combines signature-vector and change-of-basis techniques, semilinear handling of constant masks, polynomial recovery, decomposition of mixed products and subexpression lifting, and each result is checked on random inputs or, optionally, with a Z3 equivalence proof. The same engine is available as a library and as an optional LLVM pass plugin that simplifies MBA expressions it detects in LLVM IR.

Targets
Binary
Category
Binary analysis libraries
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v1.3.0, published 2026-06-30 without prebuilt binaries. The reviewed master commit is eight commits ahead: README edits, a CI dependency bump, a fix that requires LLVM only when the pass is built, and a fix that lets cobra-core build under MSVC. This entry pins it for documentation only.
  • Builds from source with CMake 3.20+ and a C++23 compiler (GCC 13+, Clang 17+ or Apple Clang 16+); a dependency superbuild builds Abseil and Highway, and GoogleTest when tests are enabled. The LLVM pass plugin needs LLVM 19 to 22, runs through opt as cobra-simplify, replaces an expression only when the simplified form is cheaper and drops nuw/nsw flags. Z3 checking is compiled in only when CMake finds Z3; otherwise cobra-cli warns that --verify is ignored. CI builds with Clang 22 and LLVM 22 on Ubuntu 24.04 on every run, and with GCC 14 and on macOS 15 only for version tags; Windows is not in CI.
  • cobra-cli takes the obfuscated expression as text, with at most 16 variables by default, so expressions in a binary must first be recovered with other tools or reach the pass as LLVM IR. The README's known limitations are deeply interleaved mixed-polynomial MBAs that exhaust the worklist budget, a few candidates that are correct only on Boolean inputs and are reported as verify-failed, and no general logic minimization.
  • The README reports 1,195 tests, and DATASETS.md reports 75,023 of 75,126 parsed expressions from 35 dataset files and seven sources simplified and spot-checked (99.86%). The OSES subsets are disabled for running out of memory or taking minutes per expression, so their figures come from an earlier run; DATASETS.md says the numbers are checked on every CI run, but the reviewed CI workflow excludes the dataset benchmark tests.
  • Apache-2.0 for CoBRA. The test/datasets files are redistributed from third-party research projects: THIRD_PARTY_LICENSES lists most as effectively GPL-3.0-only, Loki's as AGPL-3.0-only, and the OSES and ObfuscatorX sets with unspecified or unknown licenses. Nothing was built or run.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · trailofbits/CoBRA · Revision af44b8a
  2. BUILD.md GitHub · trailofbits/CoBRA · Revision af44b8a
  3. DATASETS.md GitHub · trailofbits/CoBRA · Revision af44b8a
  4. THIRD_PARTY_LICENSES GitHub · trailofbits/CoBRA · Revision af44b8a
  5. docs/methodology/README.md GitHub · trailofbits/CoBRA · Revision af44b8a
  6. CMakeLists.txt GitHub · trailofbits/CoBRA · Revision af44b8a
  7. tools/cobra-cli/main.cpp GitHub · trailofbits/CoBRA · Revision af44b8a
  8. lib/llvm/CobraPass.cpp GitHub · trailofbits/CoBRA · Revision af44b8a
  9. test/llvm/CMakeLists.txt GitHub · trailofbits/CoBRA · Revision af44b8a
  10. .github/workflows/ci.yml GitHub · trailofbits/CoBRA · Revision af44b8a
  11. LICENSE GitHub · trailofbits/CoBRA · Revision af44b8a
  12. https://github.com/trailofbits/CoBRA/releases/tag/v1.3.0

More in Native binaries

All 121 entries in Native binaries