search

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Apache License 2.0
3.1k stars 448 forks source link

Extend FLOSS to use the rendering techniques pioneered by QUANTUMSTRAND #943

Open mr-tz opened 5 months ago

mr-tz commented 5 months ago

QUANTUMSTRAND is an experiment that augments traditional strings.exe output with context to aid in malware analysis and reverse engineering. For example, we show the structure of a file alongside its strings and mute/highlight entries based on their global prevalence, library association, expert rules, and more.

FLOSS should use the techniques pioneered by QUANTUMSTRAND to highlight important information while muting common and/or analytically irrelevant noise.

Anu-Ra-g commented 4 months ago

@mr-tz Can I setup floss on WSL2? Or flare-vm is preferred?

williballenthin commented 4 months ago

no preference, as long as the environment is comfortable for you to develop Python

andy0712dik commented 3 months ago

@mr-tz i would like to contribute to this project because it is looking interesting I am final-year student and my interest is in cybersecurity can you please guide me that where should i start to get involve in this project

mr-tz commented 3 months ago

A good start would be to familiarize yourself with the tool, documentation, and source. Then you can browse the open issue list and/or ask focused questions.

officialasishkumar commented 3 months ago

Is there any slack or element channel?

danishzulfiqar commented 3 months ago

Can you assign issue to me, I can start getting understanding of it

williballenthin commented 3 months ago

@danishzulfiqar no, this is a large-scoped issue tracking a project candidate for GSoC'24. If you'd like to contribute there, please follow our posted guidance on how to get started.