A static analysis tool that automatically extracts and deobfuscates strings from malware binaries.
FLOSS is a static analysis tool developed by Mandiant FLARE that automatically extracts and deobfuscates strings from malware binaries. It solves the problem of hidden configuration data, domains, and other artifacts that are obfuscated to evade detection by traditional tools like `strings.exe`. By recovering stack strings, tight strings, and decoded strings, it provides deeper insights during malware analysis.
Malware analysts, reverse engineers, and cybersecurity professionals who need to perform static analysis on suspicious or malicious executables to uncover hidden strings and indicators of compromise.
Developers choose FLOSS because it automates complex string deobfuscation techniques that are otherwise manual and time-consuming, supports language-specific string extraction for Go and Rust binaries, and integrates with popular disassemblers through provided scripts, enhancing efficiency in malware investigations.
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
FLOSS recovers stack strings, tight strings, and decoded strings that evade traditional tools like strings.exe, as documented in its theory and supported string types.
Extracts strings from binaries compiled in Go and Rust, handling non-standard encodings that standard extractors miss, per the language-specific features section.
Includes Python scripts for loading output into IDA Pro and Binary Ninja, enhancing reverse engineering workflows with direct integration.
Automates the extraction of multiple string types including static, stack, and decoded strings, saving significant manual effort in malware analysis.
FLOSS cannot handle strings that are generated or decrypted at runtime, limiting its effectiveness against malware with dynamic obfuscation techniques.
Requires downloading standalone executables or Python installation, which adds complexity compared to simpler, built-in tools like strings.exe.
While it supports Go and Rust, FLOSS may not cover all compiler-specific string formats, as the documentation focuses primarily on these languages.