Skip to content

Releases: mandiant/flare-floss

v3.1.1

26 Sep 13:13
3cd3ee6
Compare
Choose a tag to compare

The v3.1.1 release relaxes restrictions on dependencies, which enables you to use FLOSS with Python 3.12 and newer.

Full Changelog: v3.1.0...v3.1.1

v3.1.0

15 Apr 10:52
db9af41
Compare
Choose a tag to compare

New Features

Other Updates

New Contributors

Full Changelog: v3.0.1...v3.1.0

v3.0.1

12 Dec 10:28
3782dc9
Compare
Choose a tag to compare

This release fixes the missing language module in the v3.0.0 PyPI build.

v3.0.0

12 Dec 09:48
494372c
Compare
Choose a tag to compare

New Features

  • identification of programs written in Go, Rust, and .NET
  • extraction of strings embedded in Go programs
  • extraction of strings embedded in Rust programs

Other Updates

  • updates to the IDA plugin
  • upgraded minimum required Python version to 3.8
  • various bug fixes
  • various code quality improvements

Google Summer of Code 2023

@Arker123 contributed the majority of features and improvements during the Google Summer of Code working closely with the Mandiant FLARE team. We'd like to thank him for the great collaboration and discussions before, during, and after the twelve week program.

Contributors

Thanks to all our contributors, including @symbolicvoid, @DiegoRomeo, @sara-rn and especially @Arker123

Full Changelog: v2.3.0...v3.0.0

QUANTUMSTRAND preview 7

22 Jun 15:00
Compare
Choose a tag to compare
Pre-release

fixes:

  • PyInstaller build

QUANTUMSTRAND preview 6

22 Jun 14:51
Compare
Choose a tag to compare
Pre-release

changes:

  • add column to show U to indicated UTF-16LE string (versus ASCII default)
  • add database of common junk code strings
  • add -n minimum string length CLI option

QUANTUMSTRAND preview 5

06 Jun 14:56
Compare
Choose a tag to compare
Pre-release

readme

changes:

  • parse and display PE Authenticode signature region

fixes:

  • handling of non-PE files
  • various PE and code parsing fixes in lancelot
image image image

v2.3.0

01 Jun 11:58
037fc4b
Compare
Choose a tag to compare

New Features

  • added false positive string filters
  • use rich library for rendering of output and traceback
  • initial detection of binaries compiled using Go
  • updated dependencies

Other Updates

  • various bug fixes

Contributors

Thanks to all our contributors, including @d01a, @Arker123, @Dobatymo, @Aayush-Goel-04, @symbolicvoid, @EmperialX, @ggold7046, @ooprathamm, @deepaksirohiwal, and @DeeyaSingh!

QUANTUMSTRAND preview 4

01 Jun 16:30
Compare
Choose a tag to compare
Pre-release

readme

changes:

  • re-enable structure hints for strings found in known structures
  • tweak color used to display string address

image

image

QUANTUMSTRAND preview 3

31 May 11:46
Compare
Choose a tag to compare
Pre-release

readme

changes:

  • recursively parse PE files, such as those found with resources
  • add additional global prevalence database derived from 7 days of VT downloads
  • render regions with borders to better show groupings
  • don't show library tags when there are less than five matches to avoid false positives
  • hide strings that overlap with code
image image image