mandiant/flare-floss

Improve language-strings storage (JSON) and show value to users

mr-tz opened this issue · 2 comments

mr-tz commented

Currently, the result document JSON contains:

  1. static_strings: all static strings
  2. language_strings: language-specific strings
  3. language_strings_missed: all static strings minus what was found in 2.

This results in:

  • a bunch of duplicate data
  • false/confusing entries in 3., e.g., it currently includes all strings found outside the targeted language-specific sections like .data or .rdata

We also don't show the real value clearly yet. Like with FLOSS we see x more strings now easily digestible by humans.

Solution ideas:

  1. remove language_strings and language_strings_missed and just update static_strings - easiest
  2. don't include static strings for language samples
  3. ...

until we guarantee the format of the JSON output, we may want to consider using keys like language_strings_UNSTABLE so that people know not to rely on them yet.

mr-tz commented

My current ideas:

  • leave 1. and 2. but update 3. language_strings_missed to only include language strings that FLOSS should have extracted but didn't
  • render language strings separately from static strings

Language strings are part of static strings and it's currently not possible to display them separately. This can be added later, if desired.