AwesomeREA.org

Tool

FLOSS (FLARE Obfuscated String Solver)

Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. Besides static ASCII and UTF-16LE strings it extracts stack strings, tight strings and strings decoded by functions: it heuristically identifies decoding routines, recovers their arguments through control-flow analysis, emulates them and diffs memory before and after emulation. It also extracts Go and Rust strings and accepts PE, ELF and raw 32- or 64-bit shellcode; JSON results can be turned into import scripts for IDA Pro, Ghidra, Binary Ninja, radare2 and x64dbg.

Requirements and limitations

  • Latest release at review: v3.2.0, published 2026-10-16 as standalone Linux, macOS and Windows executables and on PyPI for Python 3.10+; it adds basic ELF support and moves the Ghidra import script to PyGhidra. The reviewed master commit has 857 commits that are not in v3.2.0, which in turn has 8 not on master: it merges the QUANTUMSTRAND preview, so the layout-aware static strings with file-structure context and tags, the HTML report and the hosted viewer described in its README have so far shipped only in quantumstrand pre-releases (latest quantumstrand-beta3, 2026-04-22). Master requires Python 3.12+ and still reports version 3.1.1.
  • Decoding uses static emulation with embedded FLIRT signatures to identify library functions; files above 64 MB abort deobfuscation unless --large-file is given. Shellcode is recognized by .sc32/.raw32/.sc64/.raw64 extensions or selected with -f. Source clones need Git LFS for the tag databases and signature files, and the installation guide calls the Python API unstable between releases, leaving the CLI as the stable interface.
  • Samples come from the analyst. v3.2.0 fixed an issue in which crafted .viv vivisect workspace files, either the sample itself or one beside it, could execute code during analysis in v3.1.1 and earlier and in the QUANTUMSTRAND pre-releases; saved workspaces now load only with FLOSS_LOAD_VIV_WORKSPACE=1. Decoded strings come only from routines that FLOSS identifies as decoders and emulates.
  • Apache-2.0. Nothing was installed and no samples were analyzed.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · mandiant/flare-floss · Revision e100790
  2. doc/theory.md GitHub · mandiant/flare-floss · Revision e100790
  3. doc/usage.md GitHub · mandiant/flare-floss · Revision e100790
  4. doc/installation.md GitHub · mandiant/flare-floss · Revision e100790
  5. doc/language_specific_strings.md GitHub · mandiant/flare-floss · Revision e100790
  6. scripts/README.md GitHub · mandiant/flare-floss · Revision e100790
  7. pyproject.toml GitHub · mandiant/flare-floss · Revision e100790
  8. floss/version.py GitHub · mandiant/flare-floss · Revision e100790
  9. LICENSE.txt GitHub · mandiant/flare-floss · Revision e100790
  10. https://github.com/mandiant/flare-floss/releases/tag/v3.2.0
  11. https://github.com/mandiant/flare-floss/releases/tag/quantumstrand-beta3
  12. https://pypi.org/project/flare-floss/3.2.0/