How to install/use FLOSS (FLARE Obfuscated String Solver) in Ubuntu?

[Jlclab]

Hi,

Need help to install and use FLOSS (FLARE Obfuscated String Solver) in ubuntu.

Instructions are provided in the following github page but I still don't know how to install it properly.

https://github.com/mandiant/flare-floss https://github.com/mandiant/flare-floss/releases
https://github.com/mandiant/flare-floss/releases

I just tried pip install floss and it seems to have installed but command line doesn't seem to work.

hello@ubuntu: ~
$ pip install floss
Defaulting to user installation because normal site-packages is not writeable
Collecting floss
  Using cached floss-0.0.1-py3-none-any.whl
Installing collected packages: floss
Successfully installed floss-0.0.1
WARNING: You are using pip version 21.0.1; however, version 21.3.1 is available.
You should consider upgrading via the '/usr/bin/python3 -m pip install --upgrade pip' command.

What is the exact command line that I need to use in ubuntu to install or just use floss?

Also how can I verify floss is working properly once it's installed?

I'm new to floss and have not much experience with linux and github. I need step by step instructions on how to install and use floss.

Thanks in advance.
JL

[williballenthin]

You'll want to review the documentation here: https://github.com/mandiant/flare-floss/blob/master/doc/installation.md#installation

Ideally, you can download the standalone binaries and invoke them from your Linux system. If you want to install from pip, then you'll need to use the package flare-floss, not floss.

[Jlclab]

You'll want to review the documentation here: https://github.com/mandiant/flare-floss/blob/master/doc/installation.md#installation

Ideally, you can download the standalone binaries and invoke them from your Linux system. If you want to install from pip, then you'll need to use the package flare-floss, not floss.

I already reviewed the installation document but don't understand how to install it as I'm new to all.

I tried pip install flare-floss but getting following error. What next?

$ pip install flare-floss
Defaulting to user installation because normal site-packages is not writeable
Collecting flare-floss
  Downloading flare-floss-1.7.0a1.tar.gz (32 kB)
Collecting enum34
  Downloading enum34-1.1.10-py3-none-any.whl (11 kB)
Collecting plugnplay
  Downloading plugnplay-0.5.4.tar.gz (11 kB)
Requirement already satisfied: pyyaml in /usr/lib/python3/dist-packages (from flare-floss) (5.3.1)
Requirement already satisfied: simplejson in /usr/lib/python3/dist-packages (from flare-floss) (3.16.0)
Collecting tabulate
  Downloading tabulate-0.8.9-py3-none-any.whl (25 kB)
Collecting viv-utils==0.3.17
  Downloading viv_utils-0.3.17-py3-none-any.whl (20 kB)
ERROR: Could not find a version that satisfies the requirement vivisect==0.1.0 (from flare-floss)
ERROR: No matching distribution found for vivisect==0.1.0
WARNING: You are using pip version 21.0.1; however, version 21.3.1 is available.
You should consider upgrading via the '/usr/bin/python3 -m pip install --upgrade pip' command.

[mr-tz]

The flare-floss package isn't Python 3 compatible yet. Please try again with Python 2 or install from source using Python 3 via https://github.com/mandiant/flare-floss/blob/master/doc/installation.md#method-3-inspecting-the-floss-source-code.

[Jlclab]

Still seem to be getting an error message and I don't understand what it means.

Hello@ubuntu:~$ python --version
Python 2.7.17

Hello@ubuntu:~$ pip install flare-floss
Collecting flare-floss
  Using cached https://files.pythonhosted.org/packages/9e/c6/bb6e49c4ce64cfa9c23433d13862c4464fe82cce19d9164aef2b9a9363e3/flare_floss-1.7.0a1-py2-none-any.whl
Collecting pyyaml (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/ba/d4/3cf562876e0cda0405e65d351b835077ab13990e5b92912ef2bf1a2280e0/PyYAML-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Collecting enum34 (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/6f/2c/a9386903ece2ea85e9807e0e062174dc26fdce8b05f216d00491be29fad5/enum34-1.1.10-py2-none-any.whl
Collecting simplejson (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/5c/e8/f126464f75ceb477f4daeee52bfc9d1a055bca88b31492136cd86b4608d4/simplejson-3.17.6-cp27-cp27mu-manylinux1_x86_64.whl
Collecting viv-utils==0.3.17 (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/16/b8/5a70a75f1f07746a86d1b963a5399c9ff07e9781bd923782b15ff62e32ee/viv_utils-0.3.17.tar.gz
Collecting plugnplay (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/7e/b1/46bf913524b93361a4749da565204a924feeceb05c06e73830ad4c90c527/plugnplay-0.5.4.tar.gz
Collecting vivisect==0.1.0 (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/c0/17/748e7096497d37628faa1f89bbeed28d2eed5704361fb31ee37e994fb038/vivisect-0.1.0-py2-none-any.whl
Collecting tabulate (from flare-floss)
  Using cached https://files.pythonhosted.org/packages/ae/3d/9d7576d94007eaf3bb685acbaaec66ff4cdeb0b18f1bf1f17edbeebffb0a/tabulate-0.8.9.tar.gz
Collecting argparse (from viv-utils==0.3.17->flare-floss)
  Using cached https://files.pythonhosted.org/packages/f2/94/3af39d34be01a24a6e65433d19e107099374224905f1e0cc6bbe1fd22a2f/argparse-1.4.0-py2.py3-none-any.whl
Collecting funcy (from viv-utils==0.3.17->flare-floss)
  Using cached https://files.pythonhosted.org/packages/44/52/5cf7401456a461e4b481650dfb8279bc000f31a011d0918904f86e755947/funcy-1.16-py2.py3-none-any.whl
Collecting intervaltree (from viv-utils==0.3.17->flare-floss)
  Using cached https://files.pythonhosted.org/packages/50/fb/396d568039d21344639db96d940d40eb62befe704ef849b27949ded5c3bb/intervaltree-3.1.0.tar.gz
Collecting pefile (from viv-utils==0.3.17->flare-floss)
  Using cached https://files.pythonhosted.org/packages/f9/1e/fc4fac0169d16a98577809400bbcfac8ad1900fa792184327b360ea51fc6/pefile-2021.5.13.tar.gz
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-build-nxblXN/pefile/setup.py", line 86, in <module>
        long_description = "\n".join(_read_doc().split('\n')),
      File "/tmp/pip-build-nxblXN/pefile/setup.py", line 30, in _read_doc
        tree = ast.parse(f.read())
      File "/usr/lib/python2.7/ast.py", line 37, in parse
        return compile(source, filename, mode, PyCF_ONLY_AST)
      File "<unknown>", line 3789
        f'Export directory contains more than 10 repeated entries '
                                                                  ^
    SyntaxError: invalid syntax
    
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-nxblXN/pefile/

What's the easiest way to use floss? whether you need to install it or not?

I'm newb to ubuntu so need step by step instructions please.

[mr-tz]

Looks like the pefile version is Python 3 only. Sorry for the issues, we'll soon be Python 3 only.

For the easiest way to use FLOSS download a standalone executable from https://github.com/mandiant/flare-floss/releases.

[Jlclab]

So for Ubuntu do I download standalone executable floss-v1.7.0-linux.zip and unzip it?

what's the command line to download/unzip and run it?

[mr-tz]

Correct. You can use wget to download and unzip to unzip for example.

[williballenthin]

wget https://github.com/mandiant/flare-floss/releases/download/v1.7.0/floss-v1.7.0-linux.zip
unzip floss-v1.7.0-linux.zip
./floss /path/to/file.exe

[Jlclab]

./floss /path/to/file.exe

Finally got it working, this is what I needed step by step instructions. Initially before start of this article, I download/unzipped standalone file in to a different path and was trying to execute floss that's why wasn't able to execute the file but just figured it needs to be on the same folder/path and it works fine.
Thanks!!