msynth is a Python deobfuscation framework that collapses Mixed Boolean-Arithmetic expressions back into readable arithmetic, supporting authorized reverse engineering and defensive malware analysis.

Obfuscation based on Mixed Boolean-Arithmetic, usually shortened to MBA, is one of the most durable tricks in the protector and packer ecosystem. It works by rewriting a simple arithmetic identity into a tangled mix of bitwise and arithmetic operators that is semantically equivalent but syntactically nightmarish, defeating both human reading and many automated simplifiers. msynth, authored by Tim Blazytko and Moritz Schloegel, attacks exactly this problem: given a complex expression represented as an abstract syntax tree, it walks the tree and attempts to collapse subtrees using algebraic and semantic techniques backed by a pre-computed simplification oracle. The project is written in Python, licensed under GPL-2.0, and sits at a respectable 391 stars on GitHub, which signals genuine adoption in the reverse engineering community rather than a weekend experiment.

The architecture is what makes msynth interesting. It is built on top of Miasm, the well-known open-source reverse engineering framework from cea-sec, and can be plugged directly into Miasm's symbolic execution engine. In that mode, you symbolically execute an obfuscated function and feed the resulting expression into the simplifier, which reduces the monster back to something a human can reason about. The README demonstrates this with scripts/symbolic_simplification.py, which takes a sample binary, an address such as 0x1290, and an oracle file, and prints the before/after of the simplification — in the shown example a wall of shifts, xor-chains and truncations collapses into a clean RDI[0:32] + RSI[0:32]. That one-line result is the entire sales pitch of the tool.

There are two distinct simplification strategies inside msynth, and the split reveals a lot about the state of the art. The first is oracle-based simplification: the authors pre-computed enormous enumerative lookup tables of expressions over up to five variables (p0 through p4) at bit sizes of 8, 16, 32 and 64, using operators like addition, subtraction, multiplication, negation, bitwise and/or/xor/not and logical shift left. These databases map complex expressions to equivalent-class representatives, so simplification becomes a lookup rather than a search. The shipped example database covers 1,293,020 combinations built from three variables and the constants 0x0, 0x1 and 0x2 up to seven AST nodes; the full pre-computed set, hosted externally, is around 31GB unzipped. The tool clusters these into equivalence classes to build the oracle.

The second strategy is stochastic program synthesis, directly descended from the academic lineage the README cites: Syntia from USENIX Security 2017, QSynth from BAR 2020, the CCS 2021 search-based deobfuscation work, and the CCS 2025 paper on augmenting search with local inference rules. Instead of looking an expression up, the synthesizer learns a shorter expression that matches the input-output behavior of the original by sampling inputs and observing outputs. Notably, the synthesis path now defaults to Search Modulo Inference Rules (Smir), which augments local search with derived candidates for patterns that are notoriously hard to synthesize blindly: arbitrary constants, masks, constant shifts and rotations, affine expressions and bounded polynomials. The README notes that combining both approaches is future work, so today they operate as parallel paths.

Installation is straightforward and conventional for a research-grade Python tool. You git clone https://github.com/mrphrazer/msynth.git, install dependencies with pip install -r requirements.txt, install the package with pip ., and unpack the bundled database with unzip -d database -q database/3_variables_constants_7_nodes.txt.zip. One operational wrinkle worth knowing: Miasm is pinned to a specific commit in the requirements, and because different commits can report the same package version, a plain reinstall may silently leave the older commit in place. The fix is python -m pip install --force-reinstall -r requirements.txt, a detail that has certainly cost someone an afternoon of confusion before it was documented.

Usage from Python is deliberately minimal. The oracle-based path is three lines: instantiate Simplifier(oracle_path) and call simplifier.simplify(expression). The synthesis path mirrors it with Synthesizer() and synthesizer.simplify(expression). Before any of that works you need the oracle itself, generated with scripts/gen_oracle.py, which clusters the database into equivalence classes — the README shows this taking roughly 632 seconds for the bundled database, and warns it can stretch to hours for the larger sets. There is a pre-built oracle.pickle in the repository for those who want to skip the wait, and the --sqlite flag generates the oracle in SQLite format for lazy loading and much faster startup, a pragmatic touch that matters when you are iterating on a target interactively.

Soundness is where deobfuscation tools often quietly fail, and msynth addresses it explicitly: it can verify simplifications with an SMT solver, meaning the claimed equivalence between original and simplified expression is machine-checked rather than assumed. It also supports parallelization, which matters when you are grinding through thousands of obfuscated expressions in a single binary, and it can simplify whole expressions down to constants when the underlying semantics allow. These are the features that separate a usable workhorse from a paper prototype.

The stated limitations are honest and worth internalizing before you bet an analysis workflow on the tool. Synthesis of partial constants is unsupported, support for truncations and zero/sign extensions is limited, and the pre-computed tables may simply be incomplete — an MBA construction that falls outside the enumerated space will not be matched by the oracle. In practice this means the tool simplifies, in the authors' own words, most MBAs found in the wild, not all of them, and analysts should expect a residual layer of manual work on heavily protected targets.

From a defensive and authorized-research standpoint, msynth is squarely a comprehension tool. It creates nothing, exploits nothing, and touches no systems; its entire output is a shorter expression that means the same thing as the one you fed it. That makes it valuable in malware analysis labs unpacking protected binaries during incident response, in vendor research teams auditing obfuscated license checks or anti-tamper logic on software they are authorized to examine, and in academic evaluation of obfuscation strength. It is also the natural companion to training: if you are learning how MBA obfuscation actually works, running the bundled samples through both the oracle and the synthesizer and diffing the results is an excellent education in expression equivalence.

For defenders, there is an indirect but real angle: tools like msynth lower the cost of understanding obfuscated code, which shortens the path from a detected sample to understood behavior, extracted logic and written detections. The same MBA techniques that protect commercial software also shield malicious implants from static analysis, and a team that can routinely collapse those expressions recovers visibility that obfuscation was designed to deny. In that sense msynth is less a niche utility and more a piece of community infrastructure — a carefully documented, academically grounded bridge between the obfuscation literature and the daily practice of authorized binary analysis.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• wolfssh for embedding SSHv2 servers and clients in constrained systems


• Inside p0tools: how googleprojectzero publishes its research scraps and small utilities


• cloudflare-security-art for zero trust hardening of small sites on a free Cloudflare plan