mandiant/flare-floss

Cannot deobfuscate large files

it4ch1-007 opened this issue · 2 comments

image

  • I got error when deobfuscating a large file for analysis.
  • It would be much better if floss would get me the strings till 0x1000000 bytes only, if not for the whole.
mr-tz commented

See #893

It would be much better if floss would get me the strings till 0x1000000 bytes only, if not for the whole.

FLOSS does a code and data analysis of the input program. If it truncated a large file, then many of the code/data references would be broken and this would have a major impact on the accuracy of FLOSS. Therefore, we prefer to use an all-or-nothing strategy.