# Tool catalog

This catalog separates upstream purpose from what this project actually demonstrated. “Working rewritten binary” refers to deobfuscation of the original specimen, not an obfuscator's own output or a compiled test harness. Tool installers and environments are not included. Primary links are in [BIBLIOGRAPHY](BIBLIOGRAPHY.md).

## Obfuscators

| Tool | Purpose / abstraction | Project use | Strongest retained result | Strongest limitation | Working rewritten binary? |
| --- | --- | --- | --- | --- | --- |
| OLLVM-16 (wwh1004 port) | LLVM IR substitution, bogus control flow and flattening | Independent treatments and O0–O3 comparisons on frozen showcase | All 24 intended O0 SUB IR sites; useful BCF/FLA positive controls for downstream rewriting | SUB canonicalization; global fallback after inactive annotation pilot; modern port is not the historical original implementation | Produces obfuscated PEs, not deobfuscation; downstream BCF/FLA rewrites passed. |
| Hikari LLVM15 | LLVM IR SUB/BCF/FLA/splitting | Existing locally patched production compiler; retained matrix and transfer cases | Working O0 FLA input and stock rewrite with 28/28 successor pairs | Annotation-only SUB pilot inactive; global enable flags used. BCF gates fold in native code; exact BCF IR text cannot be reparsed in tested frontend | Obfuscated originals passed; downstream O0 FLA rewrite passed. Not universal Hikari support. |
| Polaris LLVM16 | LLVM IR passes plus separate X86 MIR/backend transformations | Individual smoke validation, selected IR matrix and MBA/BCF/FLA studies | Strong executable MBA expansion; generic BCF proof/rewrite transfer; backend-obfu worked in separate smoke lane | Same requested seed insufficient for MBA/MIR reproducibility; stock FLA rewrite is WRONG; IR and MIR metrics cannot be conflated | Obfuscated originals passed; downstream BCF rewrite passed, stock FLA rewrite failed. |
| Tigress 4.0.11 | C source-to-source obfuscation | Environment-matched generated C for EncodeArithmetic, AddOpaque, Flatten; same C reused across optimization levels | Arithmetic remains substantial at /Ox; generated source exposes state/dispatch provenance | Initialized-state proof assumptions; stock indirect CFG discovery failure; whole generated file not seed-reconstructed reliably | Obfuscated originals passed; no working deobfuscated Tigress PE in this study. |
| BinProtect | Post-link x64 PE instruction/control-flow transformations | Eight controlled protected outputs and static follow-on analysis; virtualization disabled | Visible post-link arithmetic expansion and useful counterexample to naive opacity claims | 0/8 protected outputs valid at runtime; global processing can include runtime code; no exposed seed | No valid protected output in this study, hence no working end-to-end deobfuscation lane. No protected PE bundled. |

Evidence: [matrix and compiler identities](assets/reports/showcase_matrix_v1.md), [Polaris smoke](assets/reports/polaris_validation.md), [Tigress validation](assets/reports/tigress_validation.md), [BinProtect validation](assets/reports/binprotect_validation.md). Hikari's production toolchain was not rebuilt or modified during these curation tasks.

## Semantic analysis and deobfuscation

| Tool / workflow | Purpose / abstraction | Project use | Strongest retained result | Strongest limitation | Working rewritten binary? |
| --- | --- | --- | --- | --- | --- |
| Miasm | Native disassembly, semantic IR and symbolic execution | Extract local/whole-function expressions and support stock successor recovery | Usable ground-truth-linked expression and CFG evidence across families | Polaris complex MBA flag-AST growth; stock tool's Tigress jump-table discovery incomplete—do not generalize this to all Miasm integrations | Framework can support rewriting; here outputs depend on the integrating tool, notably ollvm-unflattener. |
| msynth AST/oracle | Simplify symbolic expressions via rewrites/oracle matches | Repeated-site and composed-expression comparisons with independent SMT checks | Selected local reductions; controls distinguish pre-existing canonical expressions from new recovery | Weak on remaining native MBA; oracle activity is not a causal proof of recovery; no full complex-return recovery | No; expressions and proof records only. |
| SiMBA | Algebraic linear-MBA simplification | Separate msynth pipeline mode, not stochastic search | Tigress partial reduction, including 305→79 nodes in a complex mixed return | Reduced expression may remain far from source; restricted representation/class assumptions | No; expression output, not PE reconstruction. |
| msynth Synthesizer | Search for smaller candidate expressions from behavior | Small three-XOR pilot, then a separate preregistered 12-site expansion and complete-expression probes | Ten of twelve expanded isolated-site candidates accepted with SMT proof | Two UNKNOWN; complete-expression searches failed within budget, including clean controls. Sampling alone is insufficient | No; candidates require independent equivalence checks. |
| ollvm-unflattener | Native CFG discovery plus Miasm symbolic successor recovery and patching | Untouched stock tool on O0/O2 cases, separately labelled diagnostics/assistance | OLLVM/Hikari O0 working canonical rewrites | Polaris wrong rewrite; Tigress discovery failure; optimized layouts and metadata assumptions | Yes for retained OLLVM/Hikari O0; not for all cases. |
| RPISEC llvm-deobfuscator methodology | Binary Ninja SSA state def/use traversal and local patching | Source inspection only; alternative conceptual comparison | Explains a different state-identification and patching strategy | No plugin execution or corpus success demonstrated; SSA alone does not resolve indirect discovery or multiway semantic-switch errors | Upstream is a patching methodology; no working output from it was produced here. |
| Triton | Actual-instruction dynamic symbolic analysis and SMT branch reasoning | Generic bounded harness, genuine-branch controls, symbolic writable globals and initialized Tigress state | 22/22 OLLVM and 16/16 Polaris gates proved; 3/3 Tigress under captured state | Exploration/model limits; state assumptions and UNKNOWN must be explicit. This is Salwan's DBA library, not GPU Triton | Not by the analysis alone. A separate project-local proof consumer produced passing OLLVM/Polaris branch-patched PEs. |
| Mergen | x64 PE function lifting to LLVM IR with internal simplification | Seventeen selected cases, raw/internal stages plus ordinary LLVM O2 and runtime contracts | 68 verifier-valid/recompilable modules; passing Polaris MBA lift with residual complexity | OLLVM SUB raw lift already wrong; helper/memory contracts restrict execution; valid IR is insufficient | No rewritten original PE. Recompiled validation harnesses are a different deliverable. |

Evidence: [msynth](assets/reports/msynth_validation.md), [complex probe](assets/reports/complex_arithmetic_deobfuscation.md), [unflattening](assets/reports/unflattening_validation.md), [Triton](assets/reports/opaque_predicate_triton.md), [separate branch rewriter](assets/reports/opaque_predicate_rewrite.md), [Mergen](assets/reports/mergen_validation.md).

## Manual inspection tools

| Tool | Purpose / abstraction | Project use | Strongest result | Limitation | Working rewritten binary? |
| --- | --- | --- | --- | --- | --- |
| IDA | Native disassembly, graph navigation; optional decompiler depending on installation | User-provided target graphs and instruction comparisons | Readable semantic landmarks and a Tigress switch/jump-table view | A recovered view is not a complete/correctness proof; licensing/features vary; supplied images are not pseudocode | No automatic recovery result claimed. |
| Diaphora | Function matching and binary-diff views within IDA | User-supplied primary/secondary graph and assembly comparisons | Side-by-side structure makes residual code and rewritten routing visible | Colours/similarity are not equivalence; database hashes/tool versions not supplied; two screenshot identities need review | No working rewrite claim; diff analysis only. |
| x64dbg | Windows native debugging | Intended manual setup/use for the retained PE examples; export/RVA instructions supplied | Enables optional breakpoint/step/return-value observation on Windows | No new debugger session was run or validated in this handoff; not a native Linux tool; stale PDB and ASLR caveats | No automated deobfuscation result claimed. |

Do not make access to a paid decompiler or Binary Ninja a prerequisite for core labs. Supplied source, text disassembly, CFGs and result files support an offline analytical route.