MBA pass on a CTF binary. I rewrote until the decompiler showed a xor. Then I stopped.
Is there a Ghidra plugin in 2026 that does MBA simplify without a 4-hour SAT?
(x ^ y) + 2*(x & y) // == x + yRefs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I still keep a paper notebook for this kind of note. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. Listing first. The decompiler invented a cast last week that hid a signed compare. My note id for this: 25-00.
@ibrahimvibe
I still keep a paper notebook for this kind of note. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. Lis
You are treating a checksum as a signature again. Good. Dated shot, version in the post. «Obfuscated MBA expressions — when to stop rewriting» — specifically MBA pass on a CTF binary. I trust FLOSS after I have seen the decoder. Before that I read the stores. Pinned a comment at 0x140000de9 in the listing.
@kelvinpro
Please keep the hashes and drop the mystery zips. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. FID fo
You skipped isolation and then asked why the box is dirty. That is on you. This matches a public n-day class from last patch Tuesday. «Obfuscated MBA expressions — when to stop rewriting» — specifically MBA pass on a CTF binary. I trust FLOSS after I have seen the decoder. Before that I read the stores. Hash of the public file, or are we arguing a shape? Pinned a comment at 0x140006326 in the listing.
Please keep the hashes and drop the mystery zips. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I will +rep a listing and −rep a vibe. That is the deal.
@labsec
This matches a public n-day class from last patch Tuesday. «Obfuscated MBA expressions — when to stop rewriting» — specifically MBA pass on
Bookmarking this for the lab wiki. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.
@loadx
Bookmarking this for the lab wiki. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. UPX with a skipped ma
I am not moving this to DMs so you can yell. Stay on the class. Please keep the hashes and drop the mystery zips. The load-bearing line: MBA pass on a CTF binary. I trust FLOSS after I have seen the decoder. Before that I read the stores. I will +rep a listing and −rep a vibe. That is the deal.
I would have written the opposite conclusion a year ago. The load-bearing line: MBA pass on a CTF binary. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1310.
@nexor
I would have written the opposite conclusion a year ago. The load-bearing line: MBA pass on a CTF binary. UPX with a skipped magic is still
That is not what the listing shows. You are arguing a vibe. I want the listing, not the decompiler story. «Obfuscated MBA expressions — when to stop rewriting» — specifically MBA pass on a CTF binary. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I reproduced it on lab build 1201.
Please keep the hashes and drop the mystery zips. On «Obfuscated MBA expressions — when to stop rewriting»: MBA pass on a CTF binary. I leave CET ops in the listing. They document that CET is on. Hash of the public file, or are we arguing a shape? I will +rep a listing and −rep a vibe. That is the deal.