FLOSS review
An open-source command-line tool for recovering obfuscated strings during malware analysis.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
FLOSS, short for FireEye Labs Obfuscated String Solver, is an open-source command-line tool for analyzing malware binaries. It is aimed at security researchers and malware analysts who need to recover strings that may be hidden by obfuscation and who can use the results as part of static malware analysis. Its role is specific: it addresses a string-extraction task, not the full range of reverse-engineering work.
The published project information presents FLOSS as an open-source tool, so its described access model is distinct from a tiered commercial product. Its central capability is recovering strings that ordinary string extraction may not reveal, including strings obfuscated in malware code. That makes it a practical auxiliary for analysts investigating binaries where readable strings alone do not provide enough context. The project is hosted by Mandiant on GitHub.
FLOSS is best suited to workflows that already include malware analysis and can accommodate a command-line utility. Its narrow purpose is also its main boundary: it is not a general reverse-engineering suite, and it does not provide a decompiler. Buyers seeking a broader environment for inspecting and understanding binaries should look for a tool with those wider capabilities; analysts who specifically need help extracting obfuscated strings can consider FLOSS as a focused addition to their workflow.
FLOSS pros and cons
- Where it wins
- Recovers strings that ordinary extraction may not reveal
- Focused on malware-binary string analysis
- Open-source command-line tool hosted by Mandiant
- Where it doesn't
- Narrowly focused on string extraction rather than broad reverse engineering
- Command-line workflow may not suit buyers seeking a graphical interface
- Does not include a decompiler
FLOSS fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update