vee1e/flare-floss
1
0
Fork 0
mirror of https://github.com/vee1e/flare-floss.git synced 2026-09-01 17:57:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added docs for scripts in FLOSS (#677)

Browse source 
* Update README to mention scripts.

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
This commit is contained in:
symbolicvoid 2023-04-04 17:10:22 +05:30 • committed by GitHub
parent e8e949f696
commit 617cff0202
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
README.md
View file

@ -55,3 +55,9 @@ For a detailed description of *using* FLOSS, review the documentation
For a detailed description of *testing* FLOSS, review the documentation
[here](doc/test.md).
## Scripts
FLOSS also contains additional Python scripts in the [scripts](scripts) folder
which can be used to load its output into other tools such as Binary Ninja or IDA Pro.
For detailed description of these scripts review the documentation [here](scripts/README.md).

33
scripts/README.md Normal file
View file

@ -0,0 +1,33 @@
# FLOSS Scripts
FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory.
Additionally, there is another [plugin for IDA](idaplugin.py) to allow FLOSS to automatically
extract obfuscated strings and apply them to the currently loaded module in IDA. `idaplugin.py` is a IDAPython script you can directly run within IDA Pro (File - Script File... [ALT + F7]).
# Installation
These scripts can be downloaded from the FLOSS [GitHub](https://github.com/mandiant/flare-floss) repository
alongside the source, which is required for the scripts to run.
To install FLOSS as source, see the documentation [here](../doc/installation.md).
# Usage
## Convert FLOSS output for use by other tools
- Run FLOSS on the desired executable with the `-j` or `--json` argument to emit a JSON result
and redirect it to a JSON file.
`$ floss -j suspicious.exe > floss_results.json`
For Binary Ninja, IDA Pro, Ghidra or Radare2:
- Run the script for your tool of choice by passing the result json file as an argument and
redirect the output to a Python (.py) file.
Ghidra Example:
`$ python render-ghidra-import-script.py floss_results.json > apply_floss.py`
- Run the Python script `apply_floss.py` using the desired tool.
For x64dbg:
- Instead of a Python file, redirect the output to a .json file.
`$ python render-x64dbg-database.py floss-results.json > database.json`
- Open the JSON file `database.json` in x64dbg.