Metadata-Version: 2.4
Name: auriga-floss
Version: 2026.8.30
Summary: Unofficial PyPI snapshot of the FLARE Obfuscated String Solver
Author-email: Willi Ballenthin <william.ballenthin@mandiant.com>, Moritz Raabe <moritz.raabe@mandiant.com>
License-Expression: Apache-2.0
Project-URL: Upstream Homepage, https://www.github.com/mandiant/flare-floss
Project-URL: Upstream Repository, https://www.github.com/mandiant/flare-floss.git
Project-URL: Upstream Documentation, https://github.com/mandiant/flare-floss/tree/master/doc
Project-URL: Upstream Commit, https://github.com/mandiant/flare-floss/commit/7e1e6e5d3cff6d4a39fa85a0aa508ad3370baa30
Project-URL: Upstream Signatures, https://github.com/mandiant/flare-floss/tree/master/floss/sigs
Keywords: auriga,floss,malware,analysis,obfuscation,strings,FLARE
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Natural Language :: English
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE.txt
Requires-Dist: tabulate>=0.9
Requires-Dist: pydantic>=2
Requires-Dist: tqdm>=4
Requires-Dist: halo>=0.0.31
Requires-Dist: rich>=13
Requires-Dist: shtab>=1.7
Requires-Dist: platformdirs>=4
Requires-Dist: pefile>=2022.5.30
Requires-Dist: binary2strings>=0.1
Requires-Dist: google-re2>=1
Requires-Dist: viv-utils[flirt]>=0.8.0
Requires-Dist: vivisect>=1.1.1
Requires-Dist: dncil>=1.0.2
Requires-Dist: networkx>=3
Requires-Dist: dnfile==0.13.0
Requires-Dist: colorama==0.4.6
Requires-Dist: machofile==2026.2.4
Requires-Dist: msgspec==0.21.1
Requires-Dist: python-lancelot==0.10.0
Requires-Dist: pyelftools==0.31
Provides-Extra: dev
Requires-Dist: pre-commit==4.6.0; extra == "dev"
Requires-Dist: pyyaml==6.0.1; extra == "dev"
Requires-Dist: pytest==9.1.0; extra == "dev"
Requires-Dist: pytest-sugar==1.1.1; extra == "dev"
Requires-Dist: pytest-instafail==0.5.0; extra == "dev"
Requires-Dist: pytest-cov==7.1.0; extra == "dev"
Requires-Dist: pycodestyle==2.14.0; extra == "dev"
Requires-Dist: black==26.5.1; extra == "dev"
Requires-Dist: isort==8.0.1; extra == "dev"
Requires-Dist: mypy==2.3.0; extra == "dev"
Requires-Dist: types-PyYAML==6.0.10; extra == "dev"
Requires-Dist: types-tabulate==0.10.0.20260408; extra == "dev"
Provides-Extra: build
Requires-Dist: pyinstaller==6.22.1; extra == "build"
Requires-Dist: setuptools==84.0.0; extra == "build"
Requires-Dist: build==1.5.0; extra == "build"
Dynamic: license-file

# auriga-floss

**Temporary, packaging-only downstream snapshot.** `auriga-floss` packages the Apache-2.0-licensed FLARE Obfuscated
String Solver from upstream commit
[`7e1e6e5d3cff6d4a39fa85a0aa508ad3370baa30`](https://github.com/mandiant/flare-floss/commit/7e1e6e5d3cff6d4a39fa85a0aa508ad3370baa30),
which is 1,009 commits newer than upstream release `v3.1.1`. This package is not an official Google or Mandiant
release and is not supported by those organizations. No additional feature changes are introduced by this packaging;
the original authorship and Apache 2.0 license are retained. Users can return to `flare-floss` when upstream publishes
a newer PyPI release.

Install the downstream package from PyPI or a synchronized pip mirror:

```console
python -m pip install auriga-floss
```

The Python import namespace and command remain `floss`. Do not install `auriga-floss` and `flare-floss` in the same
environment because both distributions provide the same `floss` package and command; use a dedicated virtual
environment when switching between them.

[![PyPI version](https://img.shields.io/pypi/v/auriga-floss)](https://pypi.org/project/auriga-floss/)
![PyPI - Python Version](https://img.shields.io/pypi/pyversions/auriga-floss)
[![Last release](https://img.shields.io/github/v/release/mandiant/flare-floss)](https://github.com/mandiant/flare-floss/releases)
[![CI status](https://github.com/mandiant/flare-floss/actions/workflows/tests.yml/badge.svg)](https://github.com/mandiant/flare-floss/actions/workflows/tests.yml)
[![Downloads](https://img.shields.io/github/downloads/mandiant/flare-floss/total)](https://github.com/mandiant/flare-floss/releases)
[![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)

![FLOSS logo](https://github.com/mandiant/flare-floss/blob/master/resources/floss-logo.png)

# FLARE Obfuscated String Solver

The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced
static analysis techniques to automatically extract and deobfuscate all strings from
malware binaries. You can use it just like `strings.exe` to enhance the
basic static analysis of unknown binaries.

### Obfuscated Strings

Rather than heavily protecting backdoors with hardcore packers, many
malware authors evade heuristic detections by obfuscating only key
portions of an executable. Often, these portions are strings and resources
used to configure domains, files, and other artifacts of an infection.
These key features will not show up as plaintext in the output of the `strings.exe` utility
that we commonly use during basic static analysis.

FLOSS extracts all the following string types:
1. static strings: "regular" ASCII and UTF-16LE strings
2. stack strings: strings constructed on the stack at run-time
3. tight strings: a special form of stack strings, decoded on the stack
4. decoded strings: strings decoded in a function

Please review the theory behind FLOSS [here](doc/theory.md).

Our [blog post](https://cloud.google.com/blog/topics/threat-intelligence/automatically-extracting-obfuscated-strings/) talks more about the motivation behind FLOSS and details how the tool works.

FLOSS version 2.0 updates are detailed in this [blog post](https://cloud.google.com/blog/topics/threat-intelligence/floss-version-2/).

### Language-specific Strings
Not all compilers use string formats that the classic `strings.exe` algorithm supports. For example, if strings are UTF-8 encoded or stored without a NULL-terminator. FLOSS can identify and extract strings from programs compiled from the following languages:
 1. Go
 2. Rust

The strings FLOSS extracts specific to a compiler are much easier to inspect by humans.

Please consult the documentation to learn more about the [language-specific string extraction](doc/language_specific_strings.md).

### Layout-aware static strings

FLOSS enriches static strings by default with
file structure context and tags (global prevalence, open-source libraries,
expert rules, and more). Stack, tight, and decoded strings still appear after
the layout-aware static listing when deobfuscation is enabled.

```console
$ floss sample.exe
$ floss sample.exe -j
```

Features:

- extract ASCII and UTF-16LE strings
- show strings next to right-aligned, colored context, including tags and file offset
- render strings within PE section range delimiters
- annotate strings from known PE structures, like the import table
- don't show junk strings that overlap with instructions
- mute strings known to be globally prevalent, via an embedded database
- mute strings from popular open source libraries, via embedded databases
- highlight strings that match expert rules, via embedded databases

![screenshot 1](https://github.com/mandiant/flare-floss/assets/156560/f2d471a3-2624-498c-aaa9-928e2909c338)
![screenshot 2](https://github.com/mandiant/flare-floss/assets/156560/23bd20a1-7dff-46b5-be65-12582cb90d64)

Tag databases and FLIRT signature files are tracked with Git LFS; contributors
cloning the repo may need Git LFS installed to fetch those files. Maintenance of
tag databases is documented in [scripts/tags/README.md](scripts/tags/README.md)
and the per-database notes under `floss/tags/data/`.

## Installation
Install this downstream distribution from PyPI or a synchronized pip mirror:

```console
python -m pip install auriga-floss
```

For upstream standalone executables, use the upstream releases page:
https://github.com/mandiant/flare-floss/releases

See the [installation documentation](doc/installation.md) for a detailed description of all methods to install FLOSS.

## Usage Examples
Extract obfuscated strings from a malware binary:

    $ floss malware.exe

Only extract stack and tight strings:

    $ floss --string-type stack tight -- suspicious.exe

Do not extract static strings:

    $ floss --no-string-type static -- backdoor.exe

Display the help/usage screens:

    $ floss -h  # show all supported arguments

Enable tab completion for flags, choice values, and file paths with `floss --print-completion bash`
(also zsh, fish); installation instructions are in [doc/usage.md](doc/usage.md#shell-completions).

For a detailed description of using FLOSS, review the documentation
 [here](doc/usage.md).

## Scripts
FLOSS also contains additional Python scripts in the [scripts](scripts) directory
which can be used to load its output into other tools such as Binary Ninja or IDA Pro.
For detailed description of these scripts review the documentation [here](scripts/README.md).

## Graphical viewer
Explore `floss -j` output in the hosted [web viewer](https://mandiant.github.io/flare-floss/):
upload the JSON, filter strings by search term, minimum length, tags, or
structures, and copy what you keep. You can also build it yourself into a single,
self-contained offline HTML file that opens directly in a browser, see
[viewer/README.md](viewer/README.md).

## Documentation

- [doc/usage.md](doc/usage.md) — CLI usage: extraction, filtering, rendering, and environment variables
- [doc/results_document.md](doc/results_document.md) — the versioned JSON results schema
- [doc/tags.md](doc/tags.md) — the semantic tag system and its tag families
- [doc/language_specific_strings.md](doc/language_specific_strings.md) — Go and Rust string extraction
- [doc/theory.md](doc/theory.md) — the deobfuscation algorithm
- [doc/installation.md](doc/installation.md) — all installation methods
- [doc/test.md](doc/test.md) — how to build and run the test suite
- [viewer/README.md](viewer/README.md) — web viewer development

## Mailing List
Subscribe to the FLARE mailing list for community announcements by sending an email with the subject "subscribe" to [flare-external@google.com](mailto:flare-external@google.com?subject=subscribe&body=subscribe).
