trailofbits

trailofbits / CoBRA

Public

Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation

algebraic-simplification binary-analysis boolean-algebra compiler cpp
83
4
100% credibility
Found Mar 22, 2026 at 83 stars -- GitGems finds repos before they trend. Get early access to the next one.
Sign Up Free
AI Analysis
C++
AI Summary

CoBRA simplifies obfuscated expressions blending arithmetic operations with bitwise logic, revealing their straightforward equivalents.

How It Works

1
🔍 Spot a puzzle

You encounter tangled math formulas mixing numbers and bits in protected software, hiding the real logic.

2
📥 Get the simplifier

Download the free tool that untangles these expressions effortlessly.

3
⌨️ Paste your formula

Type or paste the confusing expression into the tool.

4
✨ Magic happens

The tool instantly reveals the simple, clear version underneath.

5
✅ Check it works

Test the new formula to confirm it matches the original perfectly.

🎉 See clearly

Now you understand the hidden math, making software analysis easy and fun.

Sign up to see the full architecture

4 more

Sign Up Free

Star Growth

See how this repo grew from 83 to 83 stars Sign Up Free
Repurpose This Repo

Repurpose is a Pro feature

Generate ready-to-use prompts for X threads, LinkedIn posts, blog posts, YouTube scripts, and more -- with full repo context baked in.

Unlock Repurpose
AI-Generated Review

What is CoBRA?

CoBRA simplifies mixed boolean-arithmetic expressions used in software obfuscation, converting tangled combos of bitwise ops (&, |, ^, ~, shifts) and arithmetic (+, -, *) into clean forms—like "(x&y)+(x|y)" to "x + y". Written in C++23, it offers a cobra-cli tool for quick command-line tests with bitwidth config (1-64 bits) and Z3 verification, plus an LLVM pass for compiler integration. Tackles real deobfuscation pain without needing full binaries.

Why is it gaining traction?

Unlike generic algebra solvers, CoBRA nails MBA-specific pipelines for linear sums, masked atoms, polynomials, and products, with pattern matching for scaled bitwise functions up to 5 vars. Users dig the cobra cli example github demos showing instant wins on obfuscated snippets, backed by 1023 tests and benchmarks on 69k+ real expressions from 7 sources. Arithmetic and boolean-arithmetic handling feels precise, not brute-force.

Who should use this?

Reverse engineers deobfuscating malware or cracked binaries with MBA tricks, security analysts probing protected code, or toolchain devs adding expression cleanup to LLVM pipelines. Ideal if you're wrestling github cobra toolbox-style datasets or need spot-checks on suspicious arithmetic.

Verdict

Grab it for MBA deobfuscation experiments—CLI shines for cobra github go-like prototyping—but 83 stars and 1.0% credibility score signal early maturity despite strong tests and docs. Verify outputs rigorously before trusting in analysis workflows.

(187 words)

Sign up to read the full AI review Sign Up Free

Similar repos coming soon.