Willi Ballenthin

compare how CFF explorer shows the resource names vs what we do today: c24ecd199e5e39cb7daca5e79b7af82f06fe4c2a32409c5053145b67dc0088c5

code recovery failures

2

list hashes and junk strings that get extracted. this will inform upstream code recovery analysis, such as lancelot or vivisect.

QS: r0ny123 alpha feedback

15

(spawned from #731) Hey @r0ny123! The smallest bit of documentation on QUANTUMSTRAND is here: [readme.md](https://github.com/mandiant/flare-floss/blob/quantumstrand/floss/qs/readme.md) and a prelease4 build here: [Release: quantumstrand-prerelease4](https://github.com/mandiant/flare-floss/releases/tag/quantumstrand-preview4). @mr-tz and I have a *lot* of things...

qs: automate the construction of databases

3

via #761 and @r0ny123 > For example, to build the expert db, we can use GitHub CI, to automatically add the strings from capa rules whenever a rule with a...

qs: add option to disable printing of strings with given tag

5

via #761 and @r0ny123 add an option to disable the printing of common/library strings to the console. and expanding on this: any tag specified by the user. currently #code is...

qs: make string length configurable

1

via #761 and @r0ny123 naturally a good and useful feature. we should also explain in the documentation how we came up with our default (which i think is 6).

qs: show interesting strings first within each section

1

via #761 and @r0ny123 > Currently, QS ranks strings based on offsets within sections, can we use stringsifter or something like that to show the most relevant strings first within...

build a database of known junk code strings

8

if our code recovery solution (lancelot or vivisect) fails to identify some code, then we may still display some junk strings that are actually instructions, like ``` ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ .text ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫┃...

QS: cxiao alpha feedback

4

(spawned from #731) Hey @cxiao! The smallest bit of documentation on QUANTUMSTRAND is here: [readme.md](https://github.com/mandiant/flare-floss/blob/quantumstrand/floss/qs/readme.md) and a prelease4 build here: [Release: quantumstrand-prerelease4](https://github.com/mandiant/flare-floss/releases/tag/quantumstrand-preview4). @mr-tz and I have a *lot* of things...