vee1e/flare-floss
1
0
Fork 0
mirror of https://github.com/vee1e/flare-floss.git synced 2026-09-02 02:07:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
flare-floss/scripts
History
vee1e f0872a3ffb
feat(oss-db): stop deduping shared strings; stamp cross-library count 
Strings that appeared in 2+ libraries used to be deleted from every
database, which dropped legitimate indicators when a dependency was
vendored (e.g. zlib sources copied into curl).

Instead, every entry is now stamped with the number of distinct
libraries the string appears in (OpenSourceString.count). count=1 means
the string is unique to one library; count>=2 indicates a shared
string that the consumer should weight accordingly. Strings are kept
in every database they appear in, so the vendored-dependency case
preserves the original zlib indicator.

The loader schema gains a defaulted 'count: int = 1' field, so legacy
.jsonl.gz files (no count) still decode and are interpreted as
count=1. Preserved (non-rebuilt) libraries are only rewritten when
their per-string counts actually change, so the workflow does not
produce spurious diffs on runs that don't add or remove libraries.
2026-07-07 03:12:04 +05:30
..
build_oss_db.py feat(oss-db): stop deduping shared strings; stamp cross-library count 2026-07-07 03:12:04 +05:30
extract_rust_hashes.py [copyright + license] Fix headers 2025-01-14 17:52:22 +01:00
idaplugin.py style: auto-format with black and isort 2026-03-13 09:47:53 +00:00
README.md Added docs for scripts in FLOSS (#677) 2023-04-04 13:40:22 +02:00
render-binja-import-script.py style: auto-format with black and isort 2026-03-13 09:47:53 +00:00
render-ghidra-import-script.py style: auto-format with black and isort 2026-03-13 09:47:53 +00:00
render-ida-import-script.py style: auto-format with black and isort 2026-03-13 09:47:53 +00:00
render-r2-import-script.py style: auto-format with black and isort 2026-03-13 09:47:53 +00:00
render-x64dbg-database.py style: auto-format with black and isort 2026-03-13 09:47:53 +00:00

README.md

FLOSS Scripts

FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory.

Additionally, there is another plugin for IDA to allow FLOSS to automatically extract obfuscated strings and apply them to the currently loaded module in IDA. idaplugin.py is a IDAPython script you can directly run within IDA Pro (File - Script File... [ALT + F7]).

Installation

These scripts can be downloaded from the FLOSS GitHub repository alongside the source, which is required for the scripts to run. To install FLOSS as source, see the documentation here.

Usage

Convert FLOSS output for use by other tools

  • Run FLOSS on the desired executable with the -j or --json argument to emit a JSON result and redirect it to a JSON file.
    $ floss -j suspicious.exe > floss_results.json

For Binary Ninja, IDA Pro, Ghidra or Radare2:

  • Run the script for your tool of choice by passing the result json file as an argument and redirect the output to a Python (.py) file.

Ghidra Example:
$ python render-ghidra-import-script.py floss_results.json > apply_floss.py

  • Run the Python script apply_floss.py using the desired tool.

For x64dbg:

  • Instead of a Python file, redirect the output to a .json file.
    $ python render-x64dbg-database.py floss-results.json > database.json

  • Open the JSON file database.json in x64dbg.