mandiant/flare-floss

Health v2 · maintenance only

Adoption not part of the score

4138 stars · 541 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

FLOSS (FLARE Obfuscated String Solver) is a Python CLI tool from Mandiant that automatically extracts and deobfuscates strings from malware binaries using advanced static analysis. It recovers static, stack, tight, and decoded strings, plus language-specific strings from Go and Rust binaries.

Use cases

• extract obfuscated strings from malware binaries
• deobfuscate stack strings in an executable
• find hidden C2 domains in a malware sample
• extract strings from Go and Rust binaries
• enhance basic static analysis of unknown binaries
• decode strings built at runtime on the stack

When to choose

• analyzing malware samples during triage or reverse engineering
• strings.exe output misses strings because they are obfuscated or stack-constructed
• you need automated deobfuscation of decoded strings in binaries
• inspecting Go or Rust executables with non-standard string formats

When to avoid

• you need dynamic analysis or sandbox detonation of malware
• the binary is packed and you haven't unpacked it first
• you need interactive disassembly rather than string extraction

Facets

cli-tool · maturity active

reverse-engineering security parser developer-tools security reverse-engineering developer-tools python cli windows malware-analysis deobfuscation static-analysis strings-extraction flare linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mandiant/flare-floss")