g MBA : Expression Semantic Guided Mixed B oolean-Arithmetic Deobfuscation Using Transformer Architectures (2025)

Abstract: Mixed Boolean-Arithmetic (MBA) obfuscation protects intellectual property by converting programs into forms that are more complex to analyze. However, MBA has been increasingly exploited by malware developers to evade detection and cause significant real-world problems. Traditional MBA deobfuscation methods often consider these expressions as part of a black box and overlook their internal semantic information. To bridge this gap, we propose a truth table, which is an automatically constructed semantic representation of an expression’s behavior that does not rely on external resources. The truth table is a mathematical form that represents the output of expression for all possible combinations of input. We also propose a general and extensible guided MBA deobfuscation framework (gMBA) that modifies a Transformer-based neural encoder-decoder Seq2Seq architecture to incorporate this semantic guidance. Experimental results and in-depth analysis show that integrating expression semantics significantly improves performance and highlights the importance of internal semantic expressions in recovering obfuscated code to its original form.

## introduction mixed boolean-arithmetic (mba) obfuscation protects intellectual property by transforming code into complex forms that are difficult to analyze (nagra and @xcite @xcite . it combines boolean (and, or, xor) and arithmetic (+, -, ×) operations to create exponentially more complex expressions @xcite , making reverse engineering harder @xcite . however, these techniques are increasingly exploited by malware developers to evade detection. by obfuscating internal code, malware can bypass security analysis tools @xcite . for example, the darkside ransomware utilized obfuscation to evade detection @xcite , highlighting the need for advanced deobfuscation techniques. figure 1 shows an example of mba obfuscation and deobfuscation. traditional mba deobfuscation methods include bitblast @xcite , pattern matching @xcite , and program synthesis @xcite . recently, seq2seq models using rnns @xcite and transformers @xcite have been introduced @xcite ), but they consider these expressions as part of a black box and overlook their internal semantic information, leading to lower accuracy. to address this, we propose using truth tables as a structured semantic representation. we introduce two types: boolean truth tables (logical equivalence) and extended truth tables (computational equivalence). these tables are automatically constructed to represent all possible input-output mappings of an expression. we present gmba, a guided mba deobfuscation framework that integrates semantic information to improve deobfuscation performance. using a transformer-based seq2seq model, our approach integrates truth tables to enhance internal represenwhiece/gmba. tation learning. specifically, we encode both the obfuscated source code and the truth tables into vector space representations and merge them to inject into the decoder architecture. to the best of our knowledge, this is the first approach leveraging semantic representations for mba deobfuscation. comparison between our gmba and previous methods on neureduce dataset @xcite showed that our method outperforms them for both accuracy for exact matching and bleu metrics. ## methods in this study, truth tables serve as features to enhance the model's understanding of mixed boolean-arithmetic (mba) expressions. to properly ground the model's reasoning in both syntactic and semantic evidence, we introduce a feature fusion mechanism that concatenates the encoder's latent embedding-capturing the syntactic patterns of obfuscated expressions-with a vectorized truth table representation that preserves raw semantic evaluation values. in this section, we describe gmba, where both the obfuscation code and a semantic representation of the truth table serve as inputs. ## conclusions we showed that incorporating truth tables derived from semantic information is crucial for mba deobfuscation. to incorporate truth tables, we proposed a gmba that leverages a transformer-based seq2seq framework. our analysis showed that gmba outperforms both traditional methods and a naive transformer network, resulting in improving performance.