# End-to-end capability matrix — PASS is always scoped

Scope: retained Windows x64 experiments, not general tool claims. No new experiments were run for this pack. PASS means the named retained checks passed; it is not universal correctness.

| Transformation family | Case | Obfuscated runnable binary | Semantic deobfuscation | SMT/proof validation | Working rewritten binary | Clean-like representation | Notable limitation | Evidence sources |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| SUB / MBA | OLLVM SUB | PASS | Local expression recovery available | Selected recovered expressions proved | No msynth PE produced | Some operations canonical before msynth | Mergen lifted IR FAILS semantics; original PE is valid | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| SUB / MBA | Hikari SUB | PASS | Mostly already simple; limited fresh recovery | Expression checks on tested cases | No | Many local expressions already clean-like | Partial O0 injection and O1 removal | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| SUB / MBA | Polaris SUB | PASS | Local expression analysis; backend simplification | Selected expression checks | No | Native operations largely recognizable | Not the stronger linear MBA treatment | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| SUB / MBA | Polaris MBA | PASS | Local recovery plus successful Mergen whole-function reconstruction | Selected local SMT proofs; 4118-vector lift checks are not universal proof | No rewritten original PE; compiled lift harness only | Partial; much MBA remains | Miasm whole-function extraction guard; not fully normalized | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| SUB / MBA | Tigress EncodeArithmetic | PASS | Local/partial simplification; qualified Mergen execution | Local SMT proofs; lift runtime with global backing | No | Partial | Exact generated C and runtime global contract matter | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| SUB / MBA | BinProtect MBA/Linear O2 | INVALID; static only | Local/static arithmetic analysis; Mergen IR emitted | Local checks do not validate full PE | No | Partial/static only | Protected whole PE crashes; no runtime success claim | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| BCF / opaque predicates | OLLVM BCF O0 | PASS | 22 impossible edges removed | 22/22 gate proofs; genuine branches negative controls | PASS: proof-rewritten PE | Reachable CFG much smaller, not clean-identical | Predicate arithmetic and dead bytes remain | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| BCF / opaque predicates | Polaris BCF O0 | PASS | 16 impossible edges removed | 16/16 gate proofs; genuine branches negative controls | PASS: proof-rewritten PE | Reachable CFG smaller; lifted IR also simpler | Lift uses concrete global assumptions; not isolated proof-patch benefit | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| BCF / opaque predicates | Hikari BCF O0 | PASS | No extant injected native opaque gate to remove | N/A for injected gates; genuine branch controls | No; unnecessary for already folded gates | Backend already simplified | Do not report 0 gates as solver failure | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| BCF / opaque predicates | Tigress AddOpaque | PASS | 3/3 only under captured initialized-state model | State-dependent proof; generic globals 0/3 | No | No full rewritten-PE result | Not a universal proof over arbitrary global states | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| BCF / opaque predicates | BinProtect Opaque | INVALID; static only | Limited predicate characterization | 11 regions: 4 one-sided, 4 SAT/SAT, 3 timeout | No | No | Machine overflow defeats naive mathematical opacity; crash/hang | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| FLA | OLLVM FLA O0 | PASS | 25/25 semantic successor pairs recovered | Edge oracle + runtime, not universal formal proof | PASS: stock rewrite | Dispatcher removed; graph differs from clean | Whole-function address mapping changed; original PDB unsafe | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| FLA | Hikari FLA O0 | PASS | 28/28 successor pairs recovered | Edge oracle + canonical runtime | PASS: stock rewrite, indexed original evidence | 66 to 20 blocks | O2 fails early; no cross-optimization success claim | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| FLA | Polaris FLA O0 | PASS | 14/22 true pairs plus 1 false pair | Runtime counterexample proves incorrect rewrite | FAIL: valid PE, wrong result | Visually small but WRONG (56 to 10 blocks) | Legitimate four-way switch collapsed into sequential case operations | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| FLA | Tigress Flatten O0 | PASS | Stock CFG discovery only 6/38 blocks | Verified jump-table/reference CFG; no successful recovery | No output | No | Fails before symbolic successor analysis | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| FLA | BinProtect CFF | INVALID; static only | Static state/compare-chain characterization | No whole-PE correctness proof | No | No | Direct dispatch is flattening; original protected output invalid | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |
| Other | Polaris indirection / global encryption / backend MIR | PASS in individual smoke tests | No dedicated deobfuscation study | Retained runtime/repeatability checks only | No | Not established | MIR distinct from IR, nondeterministic; not a core pack story | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\msynth_validation.md; E:\Workspace\seeing_through_obfuscation\docs\complex_arithmetic_deobfuscation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_triton.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md |

CSV and JSON contain the identical fields and rows. Original full evidence paths are recorded in the final column.