Skip to content
FireEye Labs Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Branch: master
Clone or download
williballenthin Merge pull request #306 from fevral/master
Add Binary Ninja annotation script
Latest commit 56fc202 Jan 29, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
doc
floss Add Binary Ninja annotation script Jan 29, 2019
resources initial import Mar 4, 2016
scripts scripts: add IDA script to run FLOSS and mark up the results. Sep 19, 2017
tests generate function index in decode_strings function Apr 24, 2017
.appveyor.yml appveyor: add arch specific artifacts Aug 5, 2016
.gitignore Added an option to set the maximum number of times emulation can Jan 8, 2019
.travis.yml travis: disable osx builds due to travis non-support Jul 2, 2018
LICENSE.txt add license Mar 10, 2016
README.md fix header Apr 20, 2017
floss.spec rebuild nightlies May 17, 2016
setup.py add copyright information Jan 10, 2017

README.md

FireEye Labs Obfuscated String Solver

Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key features will not show up as plaintext in output of the strings.exe utility that we commonly use during basic static analysis.

The FireEye Labs Obfuscated String Solver (FLOSS) uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries. You can use it just like strings.exe to enhance basic static analysis of unknown binaries.

Please review the theory behind FLOSS here.

Quick Run

To try FLOSS right away, download a standalone executable file from the releases page: https://github.com/fireeye/flare-floss/releases

For a detailed description of installing FLOSS, review the documention here.

Standalone nightly builds:

Usage

Extract obfuscated strings from a malware binary:

$ floss /path/to/malware/binary

Display the help/usage screen to see all available switches.

$ ./floss -h

For a detailed description of using FLOSS, review the documention here.

For a detailed description of testing FLOSS, review the documention here.

Sample Output

$ floss malware.bin
FLOSS static ASCII strings
!This program cannot be run in DOS mode.
_YY
RichYY
MdfQ
.text
`.rdata
@.data
.idata
.didat
.reloc
U  F
?;}
A@;E
_^[
HttHt-H
'9U
WS2_32.dll
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
DeleteFileA
WriteFile
[..snip...]

FLOSS static UTF-16 strings
,%d

FLOSS decoded 4 strings
WinSta0\Default
Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings
ProxyEnable
ProxyServer

FLOSS extracted 81 stack strings
WinSta0\Default
'%s' executed.
ERR '%s' error[%d].
Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings
ProxyEnable
ProxyServer
wininet.dll
InternetOpenA
0\A4
InternetSetOptionA
InternetConnectA
InternetQueryOptionA
Mozilla/4.0 (compatible; MSIE 7.0; Win32)
-ERR
FILE(%s) wrote(%d).
Invalid ojbect.
SetFilepoint error[%d].
b64_ntop error[%d].
GetFileSize error[%d].
Creates file error[%d].
KCeID5Y/96QTJc1pzi0ZhEBqVG83OnXaL+oxsRdymHS4bFgl7UrWfP2v=wtjNukM
[..snip...]
You can’t perform that action at this time.