Tool
FLOSS (FLARE Obfuscated String Solver)
Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. Besides static ASCII and UTF-16LE strings it extracts stack strings, tight strings and strings decoded by functions: it heuristically identifies decoding routines, recovers their arguments through control-flow analysis, emulates them and diffs memory before and after emulation. It also extracts Go and Rust strings and accepts PE, ELF and raw 32- or 64-bit shellcode; JSON results can be turned into import scripts for IDA Pro, Ghidra, Binary Ninja, radare2 and x64dbg.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Latest release at review: v3.2.0, published 2026-10-16 as standalone Linux, macOS and Windows executables and on PyPI for Python 3.10+; it adds basic ELF support and moves the Ghidra import script to PyGhidra. The reviewed master commit has 857 commits that are not in v3.2.0, which in turn has 8 not on master: it merges the QUANTUMSTRAND preview, so the layout-aware static strings with file-structure context and tags, the HTML report and the hosted viewer described in its README have so far shipped only in quantumstrand pre-releases (latest quantumstrand-beta3, 2026-04-22). Master requires Python 3.12+ and still reports version 3.1.1.
- Decoding uses static emulation with embedded FLIRT signatures to identify library functions; files above 64 MB abort deobfuscation unless --large-file is given. Shellcode is recognized by .sc32/.raw32/.sc64/.raw64 extensions or selected with -f. Source clones need Git LFS for the tag databases and signature files, and the installation guide calls the Python API unstable between releases, leaving the CLI as the stable interface.
- Samples come from the analyst. v3.2.0 fixed an issue in which crafted .viv vivisect workspace files, either the sample itself or one beside it, could execute code during analysis in v3.1.1 and earlier and in the QUANTUMSTRAND pre-releases; saved workspaces now load only with FLOSS_LOAD_VIV_WORKSPACE=1. Decoded strings come only from routines that FLOSS identifies as decoders and emulates.
- Apache-2.0.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · mandiant/flare-floss · Revision e100790
- doc/theory.md GitHub · mandiant/flare-floss · Revision e100790
- doc/usage.md GitHub · mandiant/flare-floss · Revision e100790
- doc/installation.md GitHub · mandiant/flare-floss · Revision e100790
- doc/language_specific_strings.md GitHub · mandiant/flare-floss · Revision e100790
- scripts/README.md GitHub · mandiant/flare-floss · Revision e100790
- pyproject.toml GitHub · mandiant/flare-floss · Revision e100790
- floss/version.py GitHub · mandiant/flare-floss · Revision e100790
- LICENSE.txt GitHub · mandiant/flare-floss · Revision e100790
- https://github.com/mandiant/flare-floss/releases/tag/v3.2.0
- https://github.com/mandiant/flare-floss/releases/tag/quantumstrand-beta3
- https://pypi.org/project/flare-floss/3.2.0/