◆ Malware Analysis

FLOSS

v3.2.0 open-source

FLOSS uses advanced static analysis to automatically extract and deobfuscate all strings from malware binaries.

source ↗ rss ↗ What is a cyber toolchain? last repo push Oct 16, 2026

FLOSS_LOAD_VIV_WORKSPACE=1 floss malware.exe
floss --large-file /path/to/malware.bin
floss --static-json malware.bin
floss --max-emulation-instructions 1000 malware.bin
floss --json malware.bin > results.json
floss --no-filter <binary_path>
floss --static malware.bin
floss --quiet malware.bin | grep 'HTTP'
import floss
# Usage depends on library API which is not explicitly detailed in release notes for specific function calls.

Summary

FLOSS is an open-source (Apache-2.0) command-line tool that automatically extracts and deobfuscates strings from malware binaries, going beyond what a plain strings.exe pass would find by pulling out stack strings, tight strings, and strings decoded at runtime, including those from Go and Rust binaries. It is aimed at malware analysts and reverse engineers doing static analysis on unknown executables, and its README frames it as a drop-in enhancement to the basic strings.exe workflow rather than a replacement for deeper reverse-engineering tools. First committed in 2016 and maintained by 65 contributors, it has seen 208 commits in the past year across six releases, though the most recent release landed 694 days ago.

FLOSS uses advanced static analysis to automatically extract and deobfuscate all strings from malware binaries.

How FLOSS helps

What strings is this binary hiding from a plain static-analysis pass?

walks the binary's stack operations and decoding routines to recover strings never present as flat ASCII/UTF-16 data, catching what a basic strings pass would miss entirely

Is this executable's configuration or C2 data obfuscated on purpose?

separates plaintext static strings from stack strings, tight strings, and runtime-decoded strings, surfacing the categories malware authors typically use to hide domains and file paths

Can I get readable strings out of this Go or Rust sample?

applies language-specific parsing for Go and Rust binaries, recovering strings stored in formats the classic extraction algorithm cannot read, such as UTF-8 without null terminators

How do I hand this analysis to a teammate or feed it into another tool?

emits results as structured output or a standalone report, so the extracted strings can be reviewed or parsed without rerunning the analysis

all 19 features, with the evidence for each →

Languages

Not documented

Features

19 capabilities across 2 capability groups · 6 backed by code, an API document or a real run

Built from FLOSS's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

FLOSS covers 2 of the 8 investigation and response capabilities we track.

Static malware analysis 9 features Investigation and response since 2016

Static strings extraction shipped Extracts cleartext strings from binary files using a fast static analysis mode similar to standard strings tools, including support for Go and Rust formats. 6 releases · 4 other sources · first seen Apr 2016