flare-floss

3.1.1 verified Fri May 01 auth: no python

FLARE Obfuscated String Solver (FLOSS) is a tool for automatically extracting obfuscated strings from malware, including stacked strings, decoded strings, and statically-analyzed API strings. Current version 3.1.1, released periodically via Mandiant.

pip install flare-floss

Common errors

error ModuleNotFoundError: No module named 'floss' ↓

cause Package not installed or installed in wrong environment.

fix

Run 'pip install flare-floss' in the correct Python environment.

error ImportError: cannot import name 'main' from 'floss' ↓

cause Using incorrect import path; floss 3.x moved the API.

fix

Use 'from floss import main' instead of 'from floss.floss import main'.

Warnings

breaking FLOSS 3.0 dropped support for vivisect (old static analysis engine). Code using vivisect paths will fail. ↓

fix Upgrade to 3.x and use the new API (floss.main.scan_file).

gotcha The CLI is the primary interface; the Python API is not fully documented and may change between minor versions. ↓

fix Use subprocess to call floss CLI for stable behavior, or pin to a specific floss version.

Imports

main
wrong
```
from floss.floss import main
```
correct
```
from floss import main
```
Floss 3.x uses a flat module structure; older docs may reference nested imports.

Quickstart

Scans a binary with default settings and prints extracted strings as JSON.

import json
from floss import main

# Run FLOSS on a binary (example: /bin/ls)
result = main.scan_file('/bin/ls')
print(json.dumps(result, indent=2, default=str))