CoBRA is a C++ library and CLI tool for simplifying mixed Boolean-arithmetic (MBA) expressions, commonly used in software obfuscation. It ingests expressions combining arithmetic (+, -, *) with bitwise (&, |, ^, ~) and shift operators and outputs a simplified equivalent form. The core engine uses a worklist orchestrator that coordinates 36+ passes, including signature-based transforms (CoB butterfly, ANF recovery), semilinear normalization with bit partitioning, decomposition (product, polynomial, template cores), ghost residual solving, and pattern matching. An optional Z3 verifier proves full-width equivalence. The tool can be used as a standalone CLI (`cobra-cli`), as an LLVM pass for automatic deobfuscation during compilation, or as a library (`cobra::Simplify()`). The codebase is well-structured with extensive test coverage (1195+ tests) and benchmark datasets from multiple research projects. While the core is tightly coupled internally, several generic utilities (Result type, profiling stubs, math helpers) are reusable independently.
DexKit is a high-performance C++ library for runtime parsing and querying of Android DEX bytecode, primarily used by Xposed module developers to locate obfuscated classes, methods, and fields. It provides a rich DSL in Kotlin/Java for constructing structural queries based on annotations, opcodes, string usage, field/method references, and more. The core engine parses DEX files from APK archives, builds in-memory indexes, and uses algorithms like Aho-Corasick for substring matching and the Hungarian algorithm for unordered set matching. Communication between the native C++ layer and JVM is handled via FlatBuffers serialization. The library also includes an optional caching layer (`DexKitCacheBridge`) for persisting query results across app restarts. It is distributed as an Android AAR via Maven Central and includes a demo app and unit tests.