Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/HexRaysSA/goomba
gooMBA is a Hex-Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions
https://github.com/HexRaysSA/goomba
Last synced: 3 months ago
JSON representation
gooMBA is a Hex-Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions
- Host: GitHub
- URL: https://github.com/HexRaysSA/goomba
- Owner: HexRaysSA
- Created: 2023-01-24T14:09:46.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2023-06-20T10:55:35.000Z (about 1 year ago)
- Last Synced: 2024-01-22T15:53:55.309Z (5 months ago)
- Language: C++
- Size: 91.8 KB
- Stars: 518
- Watchers: 14
- Forks: 47
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
Lists
- awesome-ida-x64-olly-plugin - gooMBA - Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions. (IDA Plugins)
- awesome-stars - HexRaysSA/goomba - gooMBA is a Hex-Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions (C++)
- awesome-ida-x64-olly-plugin - gooMBA - Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions. (IDA Plugins)
README
# gooMBA
gooMBA is a Hex-Rays Decompiler plugin that simplifies Mixed Boolean-Arithmetic
(MBA) expressions. It achieves this using several heuristics and algorithms to
achieve orders-of-magnitude better performance than existing state-of-the-art
solutions.
More information on the inner workings of this tool is available in our [blog
post](https://hex-rays.com/blog/deobfuscation-with-goomba/).
## Core Features
- Full integration with the Hex-Rays Decompiler
- Simplifies linear MBAs, including opaque predicates
- Handles sign extension for linear functions
- Verifies soundness of simplifications using the z3 SMT solver
- Simplifies non-linear MBAs with the use of a function fingerprint oracle
## Usage
By default, the plugin does not run automatically. You can invoke the plugin
by right clicking in the pseudocode view and selecting "Run gooMBA Optimizer".
In addition, you can set up a keyboard shortcut in IDA by opening Options ->
Shortcuts... and adding a shortcut for the `goomba:run` action.
Several options for usage are available within `goomba.cfg`. You can set up a
fingerprint oracle, configure the z3 proof timeout time, choose the desired behavior when
timeouts occur, and choose to make the plugin run automatically without needing
to be invoked from the right-click menu.
## Demo
The sample database `tests/idb/mba_challenge.i64` was created from the `mba_challenge` binary. The functions
`mba1`, `mba2`, `mba3`, `mba`, `solve_me` contain MBA expressions of varying complexity.
For example, the `mba1` function's initial pseudocode:
And after running gooMBA optimization:
## Fingerprint oracle
The oracle can be used for simplifying non-linear MBAs.
The input for generaring it is a list of candidate expressions in [msynth](https://github.com/mrphrazer/msynth) syntax.
You can use `generate_oracle.sh` or `generate_oracle.bat` to generate a binary
oracle file which can then be used by the plugin by specifying the path to it
in `goomba.cfg` (parameter `MBA_ORACLE_PATH`).
A large pre-computed oracle is available [here](https://hex-rays.com/products/ida/support/freefiles/goomba-oracle.7z)
NOTE: oracle files generated with IDA 8.2 can only be used with 64-bit binaries, otherwise you may hit internal error 30661.
## Obtaining gooMBA
Please see the [releases](https://github.com/HexRaysSA/goomba/releases) section for `goomba` builds that will work with IDA Pro & IDA Teams v8.2.
Starting with version 8.3, `goomba` is shipped with IDA Pro & IDA Teams.