vee1e/flare-floss
1
0
Fork 0
mirror of https://github.com/vee1e/flare-floss.git synced 2026-09-01 17:57:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
flare-floss/scripts
History
Exact
Arker123 12062fccd5
Language Identification module for Rust #762 (#775) 
* Language Identification module for Rust

* Added support for matching rustc/version

* Improved performance by detecting language after extracting static strings

* Added resource documenting file origin and regeneration instructions for database file

* Implemented extract_rust_hashes.py script and made miscellaneous improvements

* Update mmap handling for Linux and Windows compatibility

* Optimized algorithm and corrected spelling errors
2023-06-04 12:25:22 +02:00
..
extract_rust_hashes.py Language Identification module for Rust #762 (#775) 2023-06-04 12:25:22 +02:00
idaplugin.py Fix mypy 1.1.1 errors 2023-05-06 23:32:52 +05:30
README.md Added docs for scripts in FLOSS (#677) 2023-04-04 13:40:22 +02:00
render-binja-import-script.py Adds tightstrings to render/scripts (#665) 2023-03-23 09:02:20 +01:00
render-ghidra-import-script.py Adds tightstrings to render/scripts (#665) 2023-03-23 09:02:20 +01:00
render-ida-import-script.py Adds tightstrings to render/scripts (#665) 2023-03-23 09:02:20 +01:00
render-r2-import-script.py Adds tightstrings to render/scripts (#665) 2023-03-23 09:02:20 +01:00
render-x64dbg-database.py doc: update copyright header (#539) 2022-05-17 09:43:21 +02:00

README.md

FLOSS Scripts

FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory.

Additionally, there is another plugin for IDA to allow FLOSS to automatically extract obfuscated strings and apply them to the currently loaded module in IDA. idaplugin.py is a IDAPython script you can directly run within IDA Pro (File - Script File... [ALT + F7]).

Installation

These scripts can be downloaded from the FLOSS GitHub repository alongside the source, which is required for the scripts to run. To install FLOSS as source, see the documentation here.

Usage

Convert FLOSS output for use by other tools

  • Run FLOSS on the desired executable with the -j or --json argument to emit a JSON result and redirect it to a JSON file.
    $ floss -j suspicious.exe > floss_results.json

For Binary Ninja, IDA Pro, Ghidra or Radare2:

  • Run the script for your tool of choice by passing the result json file as an argument and redirect the output to a Python (.py) file.

Ghidra Example:
$ python render-ghidra-import-script.py floss_results.json > apply_floss.py

  • Run the Python script apply_floss.py using the desired tool.

For x64dbg:

  • Instead of a Python file, redirect the output to a .json file.
    $ python render-x64dbg-database.py floss-results.json > database.json

  • Open the JSON file database.json in x64dbg.