{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/doc/theory.md",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/doc/usage.md",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/doc/installation.md",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/doc/language_specific_strings.md",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/scripts/README.md",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/pyproject.toml",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/floss/version.py",
    "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/LICENSE.txt",
    "https://github.com/mandiant/flare-floss/releases/tag/v3.2.0",
    "https://github.com/mandiant/flare-floss/releases/tag/quantumstrand-beta3",
    "https://pypi.org/project/flare-floss/3.2.0/"
  ],
  "category": "native-analysis",
  "description_en": "Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. Besides static ASCII and UTF-16LE strings it extracts stack strings, tight strings and strings decoded by functions: it heuristically identifies decoding routines, recovers their arguments through control-flow analysis, emulates them and diffs memory before and after emulation. It also extracts Go and Rust strings and accepts PE, ELF and raw 32- or 64-bit shellcode; JSON results can be turned into import scripts for IDA Pro, Ghidra, Binary Ninja, radare2 and x64dbg.",
  "description_zh": "Mandiant FLARE 团队的恶意软件字符串提取工具，用法与 strings.exe 相同，但还能还原混淆字符串。除了静态的 ASCII 和 UTF-16LE 字符串，它还能提取栈字符串、紧凑栈字符串（tight strings）以及由函数解码出的字符串：先用启发式方法识别解码函数，通过控制流分析取得调用参数，再模拟执行这些函数，并比较模拟前后的内存状态。它还能提取 Go 和 Rust 字符串，支持 PE、ELF 以及 32 位或 64 位原始 shellcode；JSON 结果可转换为 IDA Pro、Ghidra、Binary Ninja、radare2 和 x64dbg 的导入脚本。",
  "entry_url": "https://awesomerea.org/resources/flare-floss/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/flare-floss/",
  "evidence_url": "https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/README.md",
  "group": "tools",
  "id": "flare-floss",
  "json_url": "https://awesomerea.org/resources/flare-floss/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/flare-floss/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/flare-floss/index.md",
  "name": "FLOSS (FLARE Obfuscated String Solver)",
  "name_zh": "FLOSS 混淆字符串提取工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v3.2.0, published 2026-10-16 as standalone Linux, macOS and Windows executables and on PyPI for Python 3.10+; it adds basic ELF support and moves the Ghidra import script to PyGhidra. The reviewed master commit has 857 commits that are not in v3.2.0, which in turn has 8 not on master: it merges the QUANTUMSTRAND preview, so the layout-aware static strings with file-structure context and tags, the HTML report and the hosted viewer described in its README have so far shipped only in quantumstrand pre-releases (latest quantumstrand-beta3, 2026-04-22). Master requires Python 3.12+ and still reports version 3.1.1.",
    "Decoding uses static emulation with embedded FLIRT signatures to identify library functions; files above 64 MB abort deobfuscation unless --large-file is given. Shellcode is recognized by .sc32/.raw32/.sc64/.raw64 extensions or selected with -f. Source clones need Git LFS for the tag databases and signature files, and the installation guide calls the Python API unstable between releases, leaving the CLI as the stable interface.",
    "Samples come from the analyst. v3.2.0 fixed an issue in which crafted .viv vivisect workspace files, either the sample itself or one beside it, could execute code during analysis in v3.1.1 and earlier and in the QUANTUMSTRAND pre-releases; saved workspaces now load only with FLOSS_LOAD_VIV_WORKSPACE=1. Decoded strings come only from routines that FLOSS identifies as decoders and emulates.",
    "Apache-2.0."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v3.2.0，发布于 2026-10-16，提供 Linux、macOS 和 Windows 独立可执行文件，并在 PyPI 上发布（需要 Python 3.10+）；该版本新增基本的 ELF 支持，并把 Ghidra 导入脚本迁移到 PyGhidra。所审阅的 master 提交中有 857 个提交不在 v3.2.0 中，而 v3.2.0 也有 8 个提交不在 master 上：master 已合并 QUANTUMSTRAND 预览版，因此其 README 中介绍的带文件结构上下文和标签的布局感知静态字符串、HTML 报告和在线查看器，目前只随 quantumstrand 预发布版本提供（最新为 2026-04-22 的 quantumstrand-beta3）。master 要求 Python 3.12+，版本号仍为 3.1.1。",
    "解码采用静态模拟执行，并借助内置的 FLIRT 签名识别库函数；超过 64 MB 的文件会中止去混淆，除非指定 --large-file。shellcode 可通过 .sc32/.raw32/.sc64/.raw64 扩展名识别，或用 -f 指定。从源码克隆时需要 Git LFS 来获取标签数据库和签名文件；安装指南指出 Python API 在不同版本之间可能变化，稳定的接口是命令行。",
    "样本由分析人员自行提供。v3.2.0 修复了一个问题：在 v3.1.1 及更早版本和 QUANTUMSTRAND 预发布版本中，精心构造的 .viv vivisect 工作区文件（无论是样本本身还是样本旁的同名文件）可在分析时执行代码；现在只有设置 FLOSS_LOAD_VIV_WORKSPACE=1 时才会加载已保存的工作区。解码出的字符串只来自 FLOSS 识别为解码函数并成功模拟执行的例程。",
    "采用 Apache-2.0 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/flare-floss",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}