FLOSS
A static analysis tool that automatically extracts and deobfuscates strings from malware binaries.
What is FLOSS?
FLOSS is a static analysis tool developed by Mandiant FLARE that automatically extracts and deobfuscates strings from malware binaries. It solves the problem of hidden configuration data, domains, and other artifacts that are obfuscated to evade detection by traditional tools like `strings.exe`. By recovering stack strings, tight strings, and decoded strings, it provides deeper insights during malware analysis.
Malware analysts, reverse engineers, and cybersecurity professionals who need to perform static analysis on suspicious or malicious executables to uncover hidden strings and indicators of compromise.
Developers choose FLOSS because it automates complex string deobfuscation techniques that are otherwise manual and time-consuming, supports language-specific string extraction for Go and Rust binaries, and integrates with popular disassemblers through provided scripts, enhancing efficiency in malware investigations.
Overview
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Use Cases
Best For
- Extracting obfuscated configuration strings from malware samples
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
