AETHER-64: High-Throughput Binary Devirtualization via Bit-Parallel Algebraic Pre-Reduction and SSA Bytecode Promotion
Year: 2026
Type: article
Abstract: Virtualization-based obfuscation and Mixed Boolean-Arithmetic (MBA) represent the modern standard for software intellectual property concealment and malware defense evasion, transforming native machine instructions into pseudo-random bytecodes executed by an embedded interpreter. Existing deobfuscation paradigms remain fundamentally brittle: dynamic execution tracing achieves incomplete path coverage while triggering anti-analysis defenses; classical Dynamic Symbolic Execution (DSE) suffers from catastrophic path explosion and prohibitive SMT solver latency over modular bit-vector arithmetic; and virtual stack mechanics leave hundreds of dead operations that overwhelm industry decompilers. In this paper, we present AETHER-64, a fully automated, static bytecode-driven devirtualization and algebraic simplification framework engineered specifically for 64-bit protected binaries. AETHER-64 introduces three foundational innovations: (1) Local-Context Handler Symbolic Slicing, which reconstructs complete Control-Flow Graphs (CFGs) through isolated basic block emulation without accumulating global path constraints; (2) a bit-parallel Algebraic Pre-Reduction (APR) filter grounded in Boolean conjunction lattice signatures and fast Moebius inversion over Z/2^64, resolving invariant dispatch conditions in O(1) time; and(3) syntax-directed I/O-guided non-linear MBA synthesis coupled with LLVM Static Single Assignment (SSA) virtual stack elimination. We evaluate AETHER-64 on the Quarkslab Diffing Obfuscation Dataset (104 ground-truth functions across MiniLua, Zlib, and SQLite comprising 56,883 bytecode instructions), 1,000 synthetic Tigress virtual machines, commercial protections (VMProtect 3.4/3.5, Themida 3.1), and 7-layer non-linear MBA expressions.AETHER-64 achieves 100% CFG recovery, resolves 93.91% of branch queries via APR filtering with an empirical 2,072.8x speedup over raw SMT resolution, eliminates 91.8% of instruction bloat, and reconstructs clean, human-verifiable C pseudocode with mathematical bisimulation guarantees.
Author: Kim, Jeong Hoon
Institution: Hanyang University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7223468131
FWCI:
Cites:
Cited by:
Related to: