flare-floss - FLARE Obfuscated String Solver - Automatically ext

项目说明

!PyPI - Python
![Last release]()
![CI status]()
![Downloads]()

!FLOSS logo

FLARE Obfuscated String Solver

The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses ad
static analysis techniques to automatically extract and deobfuscate all strings from
malware binaries. You can use it just like strings.exe to enhance the
basic static analysis of unknown binaries.

Obfuscated Strings

Rather than heavily protecting backdoors with hardcore packers, many
malware authors evade heuristic detections by obfuscating only key
portions of an executable. Often, these portions are strings and resources
used to configure domains, files, and other artifacts of an infection.
These key features will not show up as plaintext in the output of the strings.exe utility
that we commonly use during basic static analysis.

FLOSS extracts all the following string types:
1. static strings: "regular" ASCII and UTF-16LE strings
2. stack strings: strings constructed on the stack at run-time
3. tight strings: a special form of stack strings, decoded on the stack
4. decoded strings: strings decoded in a function

Please review the theory behind FLOSS here.

Our blog post talks more about the moti behind FLOSS and details how the tool works.

FLOSS 2.0 updates are detailed in this blog post.

Language-specific Strings

Not all compilers use string formats that the classic strings.exe algorithm supports. For example, if strings are UTF-8 encoded or stored without a NULL-terminator. FLOSS can identify and extract strings from programs compiled from the following languages:
1. Go
2. Rust

The strings FLOSS extracts specific to a compiler are much easier to inspect by humans.

Please consult the documentation to learn more about the language-specific string extraction.

Layout-aware static strings

FLOSS enriches static strings by default with
file structure context and tags (global pre, open-source libraries,
expert rules, and more). Stack, tight, and decoded strings still appear after
the layout-aware static listing when deobfuscation is enabled.

Features:

extract ASCII and UTF-16LE strings

show strings next to right-aligned, colored context, including tags and file offset

render strings within PE section range delimiters

annotate strings from known PE structures, like the import table

don't show junk strings that o with instructions

mute strings known to be globally pre, via an embedded database

mute strings from popular open source libraries, databases

highlight strings that match expert rules, databases

!screenshot 1
!screenshot 2

Tag databases and FLIRT signature files are tracked with Git LFS; contributors
cloning the repo may need Git LFS installed to fetch those files. Maintenance of
tag databases is documented in scripts/tags/README.md
and the per-database notes under floss/tags/data/.

Installation

To use FLOSS, download a standalone executable file from the releases page:

See the installation documentation for a detailed description of all methods to install FLOSS.

Usage Examples

Extract obfuscated strings from a malware binary:

$ floss malware.exe

Only extract stack and tight strings:

$ floss --string-type stack tight -- suspicious.exe

Do not extract static strings:

$ floss --no-string-type static -- backdoor.exe

Display the help/usage screens:

$ floss -h # show all supported arguments

Enable tab completion for flags, choice , and file paths with floss --print-completion bash
(also zsh, fish); installation instructions are in doc/usage.md.

For a detailed description of using FLOSS, review the documentation
here.

Scripts

FLOSS also contains additional Python scripts in the scripts directory
which can be used to load its output into other tools such as Binary Ninja or IDA Pro.
For detailed description of these scripts review the documentation here.

Graphical

Explore floss -j output in the hosted web :
upload the JSON, filter strings by search term, minimum length, tags, or
structures, and copy what you keep.

Emit a standalone HTML report directly and open it in a browser:

floss --html malware.exe > report.html

You can also build the yourself into a single, self-contained offline HTML
file, see /README.md.

Documentation

doc/usage.md — CLI usage: extraction, filtering, rendering, and en

doc/results_document.md — the JSON results schema

doc/tags.md — the semantic tag system and its tag families

doc/language_specific_strings.md — Go and Rust string extraction

doc/theory.md — the deobfuscation algorithm

doc/installation.md — all installation methods

doc/test.md — how to build and run the test suite

/README.md — web de

Mailing List

Subscribe to the FLARE mailing list for community announcements by sending an email with the subject "subscribe" to .

项目信息

开发语言：Python

Star 数：4171

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。