Scrambler: Mixed Boolean Arithmetic Obfuscation Tool Using E-graph and Equality Expansion

The paper introduces Scrambler, an e-graph-based tool that utilizes Equality Expansion to efficiently generate complex and diverse Mixed Boolean Arithmetic obfuscation expressions with guaranteed equivalence, demonstrating superior expressiveness and complexity compared to existing solutions.

Seoksu Lee, Sangjun An, Eun-Sun Cho

Published Mon, 09 Ma
📖 5 min read🧠 Deep dive

Here is an explanation of the paper "Scrambler" using simple language and creative analogies.

The Big Idea: Hiding a Secret Recipe

Imagine you have a simple, delicious recipe: "Mix 2 cups of flour with 1 cup of sugar."

If you want to hide this recipe from a rival chef (a hacker trying to reverse-engineer your software), you could just write it in a secret code. But a smart rival might crack that code.

Instead, you decide to rewrite the recipe using a massive, confusing list of ingredients and steps that mathematically result in the exact same mixture, but look like a nightmare to read.

  • Original: Flour + Sugar
  • Obfuscated: (Flour × 2) - (Sugar ÷ 2) + (Flour - Sugar) ... (and so on for 500 lines).

This is MBA Obfuscation (Mixed Boolean-Arithmetic). It mixes math and logic to make code look incredibly complex while keeping the result exactly the same.

The Problem with Old Tools

For a long time, tools that did this were like bakers with a tiny cookbook.

  • They only knew a few specific tricks (rules) to rewrite the recipe.
  • If they wanted to make the recipe longer, they had to manually look up a "truth table" (a giant chart of every possible outcome) for every single ingredient.
  • This made the process slow, limited, and prone to errors. Sometimes, the "rewritten" recipe didn't actually taste the same as the original because the math got messy.

The Solution: Enter "Scrambler"

The authors of this paper built a new tool called Scrambler. Think of Scrambler not as a baker, but as a magical, infinite Lego factory.

1. The E-Graph: The "Universal Blueprint"

Traditional tools build one version of the recipe at a time. Scrambler uses something called an E-Graph.

  • Analogy: Imagine a blueprint where every possible way to build a wall is drawn on the same piece of paper, connected by dotted lines.
  • In this blueprint, the tool knows that 2 + 2, 4, and 1 + 3 are all the "same thing" (they belong to the same "family" or e-class). It doesn't waste time building them separately; it keeps them all connected in one giant web of possibilities.

2. Equality Expansion: The "Infinite Growth" Machine

Old tools used a method called "Equality Saturation," which tries to find the simplest way to write a recipe. Scrambler flips this script. It uses Equality Expansion.

  • Analogy: Instead of trying to shrink the recipe down to its simplest form, Scrambler is told: "Keep adding Legos until the tower is 100 feet tall, but make sure it still looks like a house."
  • It takes a simple rule (like "you can swap a multiplication for an addition if you subtract something else") and applies it over and over again. Because the E-Graph keeps track of what is equal to what, the tool never gets confused. It just keeps expanding the complexity until it hits a limit you set (like "stop when the code has 3,000 steps").

Why Scrambler is a Game-Changer

The paper compares Scrambler to three other tools (NeuReduce, Loki, and MBA Obfuscator). Here is what they found:

Feature Old Tools Scrambler
Complexity They could make the code a little messy (maybe 200 steps). It made the code massively complex (over 34,000 steps in tests!).
Speed Slow. They had to check their math constantly. Fast. Because the E-Graph guarantees the math is right as it builds, it doesn't need to stop and double-check.
Safety Sometimes they made mistakes, requiring a separate "police check" (SMT solver) to ensure the code still worked. Self-Checking. If the rules are correct, the result is guaranteed to be correct. No police check needed.

The "Secret Sauce" Analogy

Think of the old tools as a translator who knows 10 words in a foreign language. To translate a long sentence, they have to stop and look up every word in a dictionary, which takes forever and might get the grammar wrong.

Scrambler is like a polyglot AI that knows the entire language structure. It doesn't just translate word-for-word; it understands that "The cat sat" and "Sat the cat" are the same concept. It can take a short sentence and expand it into a 10-page story that means the exact same thing, using thousands of synonyms, without ever making a grammar mistake.

The Bottom Line

The researchers created Scrambler to make software security much stronger.

  • Before: Hackers could often untangle the "scrambled" code because the tools used to scramble it were limited and slow.
  • Now: Scrambler can generate code so incredibly complex and diverse that it would take a hacker years to figure out what the original program was doing. And because the tool builds the complexity logically, it never accidentally breaks the program.

In short: Scrambler takes a simple math problem and turns it into a giant, unbreakable puzzle, all while guaranteeing the answer is still correct.