search

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Apache License 2.0
3.12k stars 448 forks source link

exclude/tag common standard library strings #406

Open williballenthin opened 2 years ago

williballenthin commented 2 years ago

"This program cannot be run in DOS mode" "January February ..."

at the very least, we can colorize this entries differently.

### Tasks
- [ ] https://github.com/mandiant/flare-floss/issues/714
- [ ] https://github.com/mandiant/flare-floss/issues/715
- [ ] https://github.com/mandiant/flare-floss/issues/716
- [ ] https://github.com/mandiant/flare-floss/issues/717
- [ ] https://github.com/mandiant/flare-floss/issues/732
- [ ] https://github.com/mandiant/flare-floss/issues/733
- [ ] https://github.com/mandiant/flare-floss/issues/734
- [ ] https://github.com/mandiant/flare-floss/issues/735
- [ ] https://github.com/mandiant/flare-floss/issues/736
- [ ] https://github.com/mandiant/flare-floss/issues/737
- [ ] https://github.com/mandiant/flare-floss/issues/738
- [ ] https://github.com/mandiant/flare-floss/issues/739
- [ ] https://github.com/mandiant/flare-floss/issues/740
- [ ] https://github.com/mandiant/flare-floss/issues/741
- [ ] https://github.com/mandiant/flare-floss/issues/742
- [ ] https://github.com/mandiant/flare-floss/issues/749
- [ ] https://github.com/mandiant/flare-floss/issues/750
- [ ] https://github.com/mandiant/flare-floss/issues/751
- [ ] https://github.com/mandiant/flare-floss/issues/752
- [ ] https://github.com/mandiant/flare-floss/issues/753
- [ ] https://github.com/mandiant/flare-floss/issues/754
- [ ] oss: collect ...

wolfssl

r0ny123 commented 2 years ago

Maybe we can also rank those string using stringsifter. What do you think?

williballenthin commented 2 years ago

I think this is a good idea. I wonder if we can have the stringsifter training scripts + dataset open sourced so we can rebuild the project for inclusion here.

r0ny123 commented 2 years ago

That would be awesome!

mr-tz commented 1 year ago

We can start with some existing data on FreeBSD, Go, Jemalloc, Libpcap, Openssl, etc.