lakshit verma
82293a3131
materialize() filtered the document to the requested -n but left metadata.min_length at the cached extraction threshold, so --json on a hit (e.g. -n 6 against a -n 4 entry) advertised min_length: 4. Set it to the requested value, matching what load() does for user-supplied documents and what a fresh run reports. |
||
|---|---|---|
| .github | ||
| doc | ||
| floss | ||
| qs-viewer | ||
| resources | ||
| scripts | ||
| tests | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| .pre-commit-config.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| LICENSE.txt | ||
| MANIFEST.in | ||
| pyproject.toml | ||
| README.md | ||
| requirements.txt | ||
| vercel.json | ||
FLARE Obfuscated String Solver
The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced
static analysis techniques to automatically extract and deobfuscate all strings from
malware binaries. You can use it just like strings.exe to enhance the
basic static analysis of unknown binaries.
Obfuscated Strings
Rather than heavily protecting backdoors with hardcore packers, many
malware authors evade heuristic detections by obfuscating only key
portions of an executable. Often, these portions are strings and resources
used to configure domains, files, and other artifacts of an infection.
These key features will not show up as plaintext in the output of the strings.exe utility
that we commonly use during basic static analysis.
FLOSS extracts all the following string types:
- static strings: "regular" ASCII and UTF-16LE strings
- stack strings: strings constructed on the stack at run-time
- tight strings: a special form of stack strings, decoded on the stack
- decoded strings: strings decoded in a function
Please review the theory behind FLOSS here.
Our blog post talks more about the motivation behind FLOSS and details how the tool works.
FLOSS version 2.0 updates are detailed in this blog post.
Language-specific Strings
Not all compilers use string formats that the classic strings.exe algorithm supports. For example, if strings are UTF-8 encoded or stored without a NULL-terminator. FLOSS can identify and extract strings from programs compiled from the following languages:
- Go
- Rust
The strings FLOSS extracts specific to a compiler are much easier to inspect by humans.
Please consult the documentation to learn more about the language-specific string extraction.
Layout-aware static strings
FLOSS enriches static strings by default with file structure context and tags (global prevalence, open-source libraries, expert rules, and more). Stack, tight, and decoded strings still appear after the layout-aware static listing when deobfuscation is enabled.
$ floss sample.exe
$ floss sample.exe -j
Features:
- extract ASCII and UTF-16LE strings
- show strings next to right-aligned, colored context, including tags and file offset
- render strings within PE section range delimiters
- annotate strings from known PE structures, like the import table
- don't show junk strings that overlap with instructions
- mute strings known to be globally prevalent, via an embedded database
- mute strings from popular open source libraries, via embedded databases
- highlight strings that match expert rules, via embedded databases
Tag databases and FLIRT signature files are tracked with Git LFS; contributors
cloning the repo may need Git LFS installed to fetch those files. Maintenance of
tag databases is documented in scripts/tags/README.md
and the per-database notes under floss/tags/data/.
Installation
To use FLOSS, download a standalone executable file from the releases page: https://github.com/mandiant/flare-floss/releases
See the installation documentation for a detailed description of all methods to install FLOSS.
Usage Examples
Extract obfuscated strings from a malware binary:
$ floss malware.exe
Only extract stack and tight strings:
$ floss --string-type stack tight -- suspicious.exe
Do not extract static strings:
$ floss --no-string-type static -- backdoor.exe
Display the help/usage screens:
$ floss -h # show all supported arguments
For a detailed description of using FLOSS, review the documentation here.
Scripts
FLOSS also contains additional Python scripts in the scripts directory which can be used to load its output into other tools such as Binary Ninja or IDA Pro. For detailed description of these scripts review the documentation here.
Mailing List
Subscribe to the FLARE mailing list for community announcements by sending an email with the subject "subscribe" to flare-external@google.com.