FLOSS

FLOSS, the FLARE Obfuscated String Solver, extracts strings that a plain strings scan misses. It identifies stack strings built at run time, tight strings decoded on the stack, and strings decoded in functions, then emulates the decoding routines to recover the plaintext. The tool handles Go and Rust binaries where compiler conventions hide strings from naive extraction. Output can feed directly into indicator lists.

Recovering domains, file names, and configuration strings from malware that strings.exe misses during basic static analysis.

• +Recovers strings that static scanners report as absent.
• +Emulation-based decoding needs no debugger interaction.
• +Maintained by Mandiant alongside capa.

• +Files larger than 64 MB abort deobfuscation unless the large-file option is set, because stack, tight, and decoded string extraction is expensive.

Extracting candidate indicators such as domains and file names from malware samples during incident response.