FLARE Obfuscated String Solver (FLOSS)
The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced static analysis techniques to automatically extract and deobfuscate all strings from malware binaries. You can use it just like strings.exe to enhance the basic static analysis of unknown binaries. Obfuscated Strings Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key features will not show up as plaintext in the output of the strings.exe utility that we commonly use during basic static analysis. FLOSS extracts all the following string types: - static strings: "regular" ASCII and UTF-16LE strings - stack strings: strings constructed on the stack at run-time - tight strings: a special form of stack strings, decoded on the stack - decoded strings: strings decoded in a function Please review the theory behind FLOSS [here](link). Our blog post talks more about the motivation behind FLOSS and details how the tool works. FLOSS version
FEATURES
SIMILAR TOOLS
A strings statistics calculator for YARA rules to aid malware research.
Repository of scripts, signatures, and IOCs related to various malware analysis topics.
Tool for decompressing malware samples to run Yara rules against them.
Hyara is a plugin that simplifies writing YARA rules with various convenient features.
angr is a Python 3 library for binary analysis with various capabilities like symbolic execution and decompilation.
A tool for injecting and loading executables with a focus on stealth techniques.
Repository of TRISIS/TRITON/HatMan malware samples and decompiled sources targeting ICS Triconex SIS controllers.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.