FLOSS automatically extracts and deobfuscates all strings from malware binaries using advanced static analysis techniques.
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
FLOSS is primarily used by malware analysts and security researchers to enhance static analysis by revealing obfuscated strings within malware binaries that traditional tools like strings.exe miss. It helps uncover hidden configuration data, domains, and other artifacts critical for understanding malware behavior.
FLOSS is best used as part of a malware analyst's static analysis toolkit to uncover hidden strings that evade traditional extraction methods; users should review the theory and language-specific extraction documentation for optimal results. Integration scripts facilitate importing FLOSS output into popular reverse engineering tools, enhancing workflow efficiency.
Download the standalone executable from the releases page: https://github.com/mandiant/flare-floss/releases
Refer to the installation documentation for detailed installation methods: doc/installation.mdfloss malware.exe
Extract obfuscated strings from a malware binary.
floss --only stack tight -- suspicious.exe
Extract only stack and tight strings from the specified binary.
floss --no static -- backdoor.exe
Extract all strings except static strings from the binary.
floss -h
Display core help and usage information.
floss -H
Display all supported arguments and detailed usage.