FLOSS
Automated string extractor that deobfuscates stack, tight, and encoded strings in malware binaries.
Technical Architecture & Overview
FLOSS, the FLARE Obfuscated String Solver, extracts strings that a plain strings scan misses. It identifies statically calculated stack strings, tightly bound strings, and strings decoded at runtime, then emulates the decoding routines to recover the plaintext. The tool handles Go and Rust binaries where compiler conventions hide strings from naive extraction. Output can feed directly into indicator lists.
Targeted Technical Use Cases
Recovering URLs, mutexes, and configuration values from malware during the first hour of analysis.
Evaluation & Trade-offs
Core Strengths
- +Recovers strings that static scanners report as absent.
- +Emulation-based decoding needs no debugger interaction.
- +Maintained by Mandiant alongside capa.
Trade-Offs & Limitations
- -Emulation of decoding routines can stall on anti-emulation tricks.
- -Large binaries increase processing time noticeably.
Defensive Security Application
Extracting candidate indicators from malware samples quickly enough to support incident response timelines.
Frequently Asked Questions
What is FLOSS?→
FLOSS, the FLARE Obfuscated String Solver, extracts strings that a plain strings scan misses. It identifies statically calculated stack strings, tightly bound strings, and strings decoded at runtime, then emulates the decoding routines to recover the plaintext. The tool handles Go and Rust binaries where compiler conventions hide strings from naive extraction. Output can feed directly into indicator lists.
What is FLOSS used for?→
Recovering URLs, mutexes, and configuration values from malware during the first hour of analysis.
What are the strengths of FLOSS?→
- +Recovers strings that static scanners report as absent.
- +Emulation-based decoding needs no debugger interaction.
- +Maintained by Mandiant alongside capa.
What are the limitations of FLOSS?→
- +Emulation of decoding routines can stall on anti-emulation tricks.
- +Large binaries increase processing time noticeably.
How is FLOSS used defensively?→
Extracting candidate indicators from malware samples quickly enough to support incident response timelines.