FLOSS
FLOSS is a free static-analysis tool for extracting and deobfuscating strings from malware binaries.
What FLOSS is
FLOSS is a free static-analysis tool for extracting and deobfuscating strings from malware binaries. It can recover static, stack, tight, and decoded strings, and identify language-specific strings in Go and Rust programs. Its layout-aware output adds file-structure context and tags to static strings, including information from embedded databases. For PE files, analysis options include section delimiters, structure annotations, filtering strings that overlap instructions, and highlighting or muting strings with embedded databases. The project offers standalone executables, a Python package, and source installation, with installation documentation for Windows, Linux, and macOS. FLOSS can be called from Python in automated analysis systems, but its documented Python API requires Python 3.10 or later and may change between releases. The CLI is the project's stable documented interface. Additional scripts can load output into Binary Ninja or IDA Pro. For review, FLOSS provides a hosted viewer for JSON output with search and filters, and can generate a standalone HTML report. The project identifies its license as Apache-2.0.
Good
- Extracts static, stack, tight, and decoded strings.
- Recognizes language-specific strings in Go and Rust.
- Available for Windows, Linux, and macOS.
- JSON results have a hosted viewer with search and filters.
- Apache-2.0 licensed.
Watch out
- The documented Python API requires Python 3.10 or later.
- The Python API can change between releases.
- The project identifies the CLI as its stable interface.
Who it suits
FLOSS suits malware analysts who need to recover strings from binaries or incorporate string extraction into automated analysis. Users who need a stable documented interface can work with its CLI.
Verdict
FLOSS provides several string extraction methods and output-review options for malware analysis. Its CLI is the stable documented interface; the Python API is available for automation but may change.
Plans and prices
From FLOSS's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| FLOSS | Free | Apache-2.0 licensed software · standalone binaries, Python package, or source installation |
The facts
Each one read from FLOSS's own pages, with the date it was checked.
What it does
- Analysis features
- Features include PE section delimiters, PE structure annotations, filtering of strings overlapping instructions, and highlighting or muting strings using embedded databases.checked 5 Oct 2026
- API stability
- The project describes its CLI as the stable documented interface and says the Python API can change between releases.checked 5 Oct 2026
- Automation
- FLOSS can be used from Python in automated analysis systems; its documented Python API requires Python 3.10 or later.checked 5 Oct 2026
- Context
- Layout-aware output adds file structure context and tags to static strings, including information from embedded databases.checked 5 Oct 2026
- Installation
- The project offers standalone executables, a Python package, and installation from source.checked 5 Oct 2026
- Integrations
- Additional scripts can load FLOSS output into tools such as Binary Ninja or IDA Pro.checked 5 Oct 2026
- Language support
- It can identify and extract language-specific strings from Go and Rust programs.checked 5 Oct 2026
- License
- The repository identifies its license as Apache-2.0.checked 5 Oct 2026
- Purpose
- FLOSS uses static analysis to extract and deobfuscate strings from malware binaries.checked 5 Oct 2026
- Results viewer
- The project provides a hosted viewer for FLOSS JSON output with search and filters, and supports generating a standalone HTML report.checked 5 Oct 2026
- String types
- It extracts static, stack, tight, and decoded strings.checked 5 Oct 2026
- Supported systems
- The installation documentation refers to standalone executables and commands for Windows, Linux, and macOS.checked 5 Oct 2026
Alternatives to FLOSS
- 1
Binary Ninja
Free planWebAPILinuxmacOS7.8$199 one-time - 2
Frida
Free planOpen sourceAndroidiOSAPILinux7.7Free plan - 3
rev.ng
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4
JEB
Free planAPILinuxmacOSSelf-hosted7.6From $1,200 a year - 5
Ghidra
Free planOpen sourceAPIExtensionLinuxmacOS7.3Free plan - 6
IDA Pro
Free planLinuxmacOSWindows7.0From $1,099 a year