mandiant

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

The FLARE team's open-source tool to identify capabilities in executable files.

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

IDA Pro utilities from FLARE team

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

Windows kernel and user mode emulation.

Free educational content on reverse engineering and malware analysis from the FLARE team

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as...

GoCrack is a management frontend for password cracking tools written in Go

Go symbol recovery tool

The FLARE team's open-source extension to add Python 3 scripting to Ghidra.

A machine learning tool that ranks strings based on their relevance for malware analysis.

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

A complete Go port of Impacket - 63 CLI tools and 24 libraries for Windows & Active Directory protocol attacks, compiled to a single dependency-free binary.

FireEye Publicly Shared Indicators of Compromise (IOCs)

A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research

A cross platform parser for Apple UnifiedLogs!

A DTrace on Windows Reimplementation

IDA Pro loader and processor modules for WebAssembly

rVMI - A New Paradigm For Full System Analysis

FLARE Team's Binary Navigator

IDA Pro plugin to assist with complex graphs

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

GeoLogonalyzer is a utility to analyze remote access logs for anomalies such as travel feasibility and data center sources.

Python tool to resolve all strings in Go binaries obfuscated by garble

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

FLARE Kernel Shellcode Loader

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.

flare-dbg is a project meant to aid malware reverse engineers in rapidly developing debugger scripts.

Link sources to sinks in C# applications.

Programmatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types

Automatic analysis of SWF files based on some heuristics. Extensible via plugins.

Indicator of Compromise Scanner for CVE-2019-19781

The User Interface for GoCrack

Deobfuscation library for PoisionPlug.SHADOW's ScatterBrain obfuscator

Collection of scripts used to deobfuscate GOOTLOADER malware samples.

libemu shim layer and win32 environment for Unicorn Engine

AuditParser

Resolves DLL API entrypoints for a process w/ remote query capabilities.

Supporting resources and documentation for FLARE @ Google Summer of Code 2026

JITM is an automated tool to bypass the JIT Hooking protection on a .NET sample.

Data to test capa's code and rules.