search

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Apache License 2.0
3.29k stars 454 forks source link

High memory usage when analyzing VMProtect-protected sample with FLOSS #1084

Open fariss opened 1 day ago

fariss commented 1 day ago

When running floss on this sample, it seems to run forever and consume quite a lot of memory (~6.4GB). I'd suspect this is a vivisect issue because this sample is protected with VMProtect.

https://www.virustotal.com/gui/file/1906e7d5a745a364c91f5e230e16e1566721ace1183a57e8d25ff437664c7d02

mr-tz commented 1 day ago

Thanks, vivisect and/or floss can easily go off the rails for heavily packed/protected samples but this is good to track here.