  Code obfuscation involves the addition of meaningless code or the
complication of existing code in order to make a program difficult to reverse
engineer. In recent years, MBA (Mixed Boolean Arithmetic) obfuscation has been
applied to virus and malware code to impede expert analysis. Among the various
obfuscation techniques, Mixed Boolean Arithmetic (MBA) obfuscation is
considered the most challenging to decipher using existing code deobfuscation
techniques. In this paper, we have attempted to simplify the MBA expression. We
use an e-graph data structure to efficiently hold multiple expressions of the
same semantics to systematically rewrite terms and find simpler expressions.
The preliminary experimental result shows that our e-graph based MBA
deobfuscation approach works faster with reasonable performance than other
approaches do.
