EXTRACTING STRINGS FROM GO AND RUST EXECUTABLES

Summary from the TLDR InfoSec newsletter

The Mandiant FLARE team has released a new version of FLOSS that contains specialized algorithms for extracting strings from Go and Rust binaries. These languages use structs to determine string length as opposed to null-terminated strings which leads to strings.exe struggling to extract strings. This post includes details of how strings are stored in the languages and how FLOSS detects them.