FLARE FLOSS
Apache-2.0🧬 Reverse Engineering · Python
FLARE FLOSS (FireEye Labs Obfuscated String Solver) automatically extracts obfuscated strings from malware binaries. While the standard 'strings' utility only finds plaintext, FLOSS uses advanced static analysis techniques to identify string decoding routines, emulates them, and recovers the decoded strings. It handles XOR encoding, stack strings (built character-by-character), tight strings (short encoded sequences), and custom decryption routines. FLOSS integrates with FLARE's analysis toolkit and produces output compatible with YARA rule generation. It dramatically reduces manual reverse engineering time for string-heavy malware analysis.
Installation
$ pip install flare-flossUse Cases
- Extracting obfuscated strings from malware samples
- Recovering XOR-encoded and stack-built strings
- Generating IOCs from decoded malware strings
- Automating string analysis in malware triage pipelines
Tags
Details
- Category
- 🧬 Reverse Engineering
- Language
- Python
- Repository
- mandiant/flare-floss
- License
- Apache-2.0
- Platforms
- 🐧linux🍎macos🪟windows
Links
Community Reviews
Alternatives & Comparisons
Ghidra
JavaNSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.
Compare FLARE FLOSS vs GhidraYARA
CPattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.
Compare FLARE FLOSS vs YARAMore in Reverse Engineering
dnSpy
C#.NET debugger, decompiler, and assembly editor. Inspect and modify .NET and Unity assemblies without source code.
ILSpy
C#Open-source .NET decompiler and assembly browser. Produces clean C# from compiled binaries with cross-platform support.
x64dbg
C++Open-source x64/x32 debugger for Windows. Full-featured binary debugger with plugin ecosystem for malware analysis and reverse engineering.
Detect It Easy
C++/QtBinary packer and compiler detection. Identifies compilers, linkers, packers, and protectors used to build PE, ELF, and Mach-O files.
angr
PythonBinary analysis framework. Symbolic execution, CFG recovery, and vulnerability discovery for compiled binaries in Python.
RetDec
C++Retargetable decompiler by Avast. Converts machine code back to C from x86, ARM, MIPS, and PowerPC binaries.