Scrambler: MBA Obfuscation via Equality Expansion

• Scrambler is a mixed Boolean–arithmetic obfuscation tool that uses Equality Expansion in e-graphs to create complex, semantically equivalent expressions under configurable limits.
• It bypasses traditional SMT-based verification by ensuring equivalence through validated rewrite rules, thereby enhancing both diversity and complexity in expression generation.
• Performance evaluations indicate that Scrambler significantly outperforms competitors like NeuReduce, Loki, and MBA Obfuscator with higher AST node counts and operator diversity.

Searching arXiv for the named work and closely related MBA-obfuscation context. Scrambler is a mixed Boolean–arithmetic (MBA) obfuscation tool that uses e-graphs and a procedure called Equality Expansion to generate very large, structurally complex, and diverse equivalent expressions, with equivalence guaranteed by construction (Lee et al., 4 Mar 2026). In the paper introducing it, Scrambler is presented as a software-protection mechanism for expression rewriting rather than as a general compiler optimizer: instead of searching for the simplest equivalent form, it expands an equivalence space and extracts a more complex form under configurable resource and termination conditions. Its immediate context is MBA obfuscation, where arithmetic and bitwise Boolean operators are deliberately interleaved to hinder simplification and reverse engineering.

1. MBA obfuscation context

Mixed Boolean Arithmetic obfuscation rewrites a simple expression into a more complicated but semantically equivalent one by combining arithmetic and bitwise operators. The canonical example given for this style of transformation is

$$x+y \quad \Rightarrow \quad (x \lor y) + (x \land y).$$

The paper classifies MBA expressions into linear, polynomial, and non-polynomial forms, with complexity increasing across these categories (Lee et al., 4 Mar 2026).

The motivation for Scrambler is that existing MBA generators are described as constrained by limited operator support, limited expression types, insufficient diversity, high generation time or poor scalability, and dependence on external equivalence checking, often using SMT solvers such as Z3. The paper also argues that SMT performance degrades on large or complex MBA expressions. Scrambler is positioned as a response to these limitations: it is intended to generate more complex and diverse expressions while avoiding a separate solver-based verification stage.

2. Equality Expansion and e-graph formulation

The central technical idea is an adaptation of equality saturation called Equality Expansion. In standard equality saturation, rewrite rules are repeatedly applied over an e-graph and an extraction procedure selects the best expression, typically the simplest one under a cost model. Scrambler reverses this objective: “while the termination condition of Equality Saturation is finding the simplest expression, Equality Expansion seeks to find expressions that satisfy the termination condition (e.g. AST size must exceed 1000)” (Lee et al., 4 Mar 2026).

An e-graph is used to represent equivalence classes of expressions compactly. Equivalent subexpressions are grouped into e-classes, allowing many forms to coexist in one shared structure. The paper’s explanatory example is based on $x+y$ and the rewrite

$y*1 = y.$

Once such rewrites are inserted into the e-graph, equivalent forms accumulate in parallel.

This architecture gives Scrambler its strongest formal claim: equivalence is guaranteed by construction. The output is extracted from the equivalence class represented in the e-graph, so no separate verification step is required, provided the input rewrite rules are semantically correct. The paper is explicit that this guarantee is conditional: the correctness of the applied rules must be carefully validated.

3. Generation pipeline and implementation

Scrambler takes three inputs: a rule set, an expression to be obfuscated, and a termination condition. It is implemented in Rust using the egg framework. At a high level, the process is: initialize an e-graph with the input expression, apply rewrite rules repeatedly, accumulate equivalent forms into e-classes, stop when the configured termination condition is met, and extract the most complex expression satisfying the conditions (Lee et al., 4 Mar 2026).

The paper states that termination conditions can include expression size, e-graph rule search conditions, and termination time. In the reported experiments, additional concrete settings appear: e-graph traversal option, node limit, and time limit. This makes Equality Expansion a bounded search over a rewrite-generated equivalence space rather than an unbounded saturation procedure.

The paper does not provide pseudocode, a formal cost function, a grammar of MBA expressions, or a full list of rewrite rules. It also does not specify a compiler or binary-rewriting integration path. Accordingly, Scrambler is best understood as a standalone expression transformation engine whose behavior is driven by user-supplied rewrite rules and a complexity-oriented extraction objective.

4. Experimental evaluation and reported complexity

The evaluation compares Scrambler with NeuReduce, Loki, and MBA Obfuscator using six structural metrics: AST node count, number of variables, number of constants, number of operators, MBA Alternation, and Entropy. The paper notes that exact one-to-one comparison is difficult because the tools do not share a common generation model or identical input-output assumptions. The strongest empirical evidence therefore concerns structural complexity rather than direct deobfuscation resistance (Lee et al., 4 Mar 2026).

The headline comparative results are summarized below.

Tool	Obfuscated AST Size	MBA Alternation
NeuReduce	23.85	3.89
Loki	216.17	38.26
MBA Obfuscator	235.22	31.83
Scrambler	34786.77	6387.58

The same comparison shows that Scrambler also reports the largest obfuscated operator count, 23373.46, compared with 13.31 for NeuReduce, 142.82 for Loki, and 136.22 for MBA Obfuscator. Its reported entropy is 2.59, compared with 3.11, 2.66, and 3.12 respectively. Original AST sizes are also listed in the paper: 3.48 for NeuReduce, 3.00 for Loki, 4.95 for MBA Obfuscator, and 7.44 for Scrambler.

The specific Scrambler experiment used 100 input expressions, 14 rules, e-graph traversal option $=2$, node limit $=3{,}000$, and time limit $=2$ seconds. The authors conclude from these data that Scrambler can generate MBA expressions with higher structural complexity than the compared tools.

5. Relation to prior generators and comparative claims

The paper discusses three representative prior systems. MBA Obfuscator is described as capable of generating linear, polynomial, and non-polynomial MBAs, but as requiring manual configuration of truth tables and basic expressions, with configuration dependent on the number of variables and with only a limited operator set. NeuReduce is described as generating only linear MBA expressions, relying on simple user-provided expressions and truth tables, being unsuitable for complex obfuscation, and incurring high generation overhead. Loki is described as allowing arbitrary growth through a Depth parameter, but with a more restrictive operator set and huge generation overhead (Lee et al., 4 Mar 2026).

Against that background, Scrambler’s comparative claims are fourfold. First, it is said to improve existing tools in expressiveness and complexity. Second, because it is rule-driven and e-graph-based, it is presented as capable of producing more diverse expressions than template- or truth-table-centered systems. Third, it avoids a separate SMT-based equivalence check because equivalent outputs are extracted from an e-graph built by semantics-preserving rewrites. Fourth, by changing the rule set, the same framework is said to support linear, polynomial, and non-polynomial MBA generation.

The paper does not provide a direct runtime table against baselines, nor does it benchmark simplification resistance by running deobfuscators on Scrambler outputs. A plausible implication is that the paper’s evidence is strongest for generation capacity and structural richness, while resistance to analysis remains a stated motivation rather than a directly measured outcome.

6. Constraints, assumptions, and significance

The paper is explicit about several limitations. The semantic guarantee depends entirely on the correctness of the rewrite rules. Performance may vary with rule selection. Relaxing Equality Expansion conditions can produce more robust obfuscation, but this depends on available memory and rule constraints. If no rewrite rules apply to an input, no obfuscation is produced. The evaluation also does not provide direct resistance-to-simplifier results, memory-usage curves, or extraction-quality analysis under alternative objectives (Lee et al., 4 Mar 2026).

A further limitation is formal rather than empirical: the paper does not include theorem statements or proofs, a formal congruence relation, or a complete rewrite inventory. Its mathematical exposition is intentionally light, with the main explicit formulas being the illustrative MBA identity

$x+y \equiv (x \lor y) + (x \land y)$

and the rewrite

$y*1 = y.$

This suggests that Scrambler’s principal contribution is architectural and methodological rather than proof-theoretic.

Its significance lies in reframing MBA obfuscation as an e-graph search problem. Scrambler turns the conventional equality-saturation workflow on its head: e-graphs are used not to simplify expressions, but to expand equivalence classes until a sufficiently large or complex representative can be extracted. In that sense, Scrambler is notable less for introducing a new obfuscation identity than for defining a new generation paradigm—Equality Expansion—for MBA obfuscation, with semantic equivalence inherited from the rewrite system itself.