# Selected metric snapshots

Counts are scoped to the named target and analysis convention. Do not merge early showcase linear-disassembly CFG counts with later audited PE CFG counts. Block/edge definitions differ between the BCF audit and Miasm unflattening; these are within-story comparisons, not a tool leaderboard.

| Example | Snapshot | Metric definition / interpretation | Exact authoritative provenance |
| --- | --- | --- | --- |
| Polaris MBA native target | 115 clean → 678 MBA | Instructions in PE RUNTIME_FUNCTION extent; one straight-line target, not whole executable | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\clean\polaris_sub\native_metrics.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\arithmetic\polaris_mba\native_metrics.json` |
| OLLVM SUB native target | 115 clean → 311 SUB O0 | Native instructions; retained compiler IR and semantic expression counts use different units | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\clean\ollvm_sub\native_metrics.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\arithmetic\ollvm_sub\native_metrics.json` |
| OLLVM BCF | 11 clean → 70 original → 37 reachable rewritten blocks | Dedicated PE-byte CFG audit: calls do not split blocks; RET terminal; genuine outcomes unpruned. Physical rewrite still 70 blocks; 33 original blocks become unreachable. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\cfg_projection\ollvm16\clean_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\cfg_projection\ollvm16\original_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\cfg_projection\ollvm16\rewritten_cfg.json` |
| Polaris BCF | 11 clean → 54 original → 30 reachable rewritten blocks | Same dedicated audit. Physical rewrite still 54 blocks; 24 original blocks become unreachable. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\cfg_projection\polaris\clean_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\cfg_projection\polaris\original_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\cfg_projection\polaris\rewritten_cfg.json` |
| BCF branch patches | 22/22 OLLVM + 16/16 Polaris; 9189 triples; 0 mismatches | 4591 + 4598 clean/original/rewrite native triples; 27,567 calls. Not a universal proof of every PE behavior. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\ollvm16_o0\validation.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\opaque_rewrite\polaris_o0\validation.json` |
| OLLVM FLA | 21 clean → 60 flattened → 17 rewritten blocks; 25/25 successor pairs | Miasm recursive CFG; calls split blocks. Successor-pair oracle is a different metric from graph edges. Rewritten canonical PE PASS. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\ollvm16\o0\clean_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\ollvm16\o0\before_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\ollvm16\o0\stock_result.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\ollvm16\o0\semantic_edge_score.json` |
| Hikari FLA | 66 flattened → 20 rewritten blocks; 28/28 successor pairs | Same Miasm CFG/oracle conventions; rewritten canonical PE PASS. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\hikari\o0\before_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\hikari\o0\stock_result.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\hikari\o0\semantic_edge_score.json` |
| Polaris FLA — WRONG | 56 flattened → 10 rewritten blocks; 14/22 true pairs + 1 false pair | Same CFG/oracle conventions. FLA F9CD8332 instead of DBEFFCE7; exit 1. Smaller is not correct. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\polaris\o0\before_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\polaris\o0\stock_result.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\polaris\o0\semantic_edge_score.json` |
| Tigress Flatten discovery | 38 complete reference blocks vs 6 stock-discovered blocks | Jump-table-aware reference versus incomplete stock graph, NOT before/after deobfuscation. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\tigress\o0\reference_complete_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\tigress\o0\before_cfg.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\unflattening\tigress\o0\stock_result.json` |
| Tigress EncodeArithmetic | 426 O0 → 226 /Ox instructions; /Ox clean 106 | Same frozen generated C across optimization. Matched /Ox clean used for comparison, not O0 clean. Historical O2 clean linear count overran function boundary: no O2 ratio used here. | `E:\Workspace\seeing_through_obfuscation\results\showcase_matrix_v1\summaries\optimization_metrics.json`<br>`E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md` |
| Mergen Polaris MBA | 6689 R → 386 R2 → 375 M → 359 M2 IR instructions | Stages are alternatives R→R2 and R→M→M2, not one four-stage chain; all 4118 vectors per stage pass. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\arithmetic\polaris_mba\ir_metrics.json`<br>`E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\arithmetic\polaris_mba\semantic_result.json` |
| Mergen OLLVM SUB — WRONG | 3917 / 4118 mismatches in each of four stages | Native input/clean both pass. Raw lift already wrong: x=0 expected 0x08083808, actual 0. | `E:\Workspace\seeing_through_obfuscation\results\deobfuscation\mergen\arithmetic\ollvm_sub\semantic_result.json` |

The exhaustive original studies remain authoritative. No new disassembly/CFG analysis or semantic execution was run to generate this table.