mandiant/flare-ida

Health v2 · maintenance only

Flags: no_releases archived

Adoption not part of the score

2453 stars · 472 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes tools for shellcode hash searching, struct typing, stack string recovery, MSDN annotations, FLIRT signature generation, and argument tracking.

Use cases

• search precalculated string hashes used by shellcode in IDA
• recover manually constructed stack strings in malware
• annotate IDA database with MSDN API documentation
• generate FLIRT signatures from an existing IDB
• apply function types to indirect calls
• identify static arguments passed to functions
• apply types to structure fields in IDA

When to choose

• you analyze malware or unknown binaries in IDA Pro
• you want battle-tested reversing plugins from an expert team
• you need to identify library functions via FLIRT signatures
• you want to enrich IDB databases with API documentation

When to avoid

• you don't use IDA Pro
• you need a standalone disassembler or decompiler
• you work exclusively with Ghidra or Binary Ninja

Facets

plugin · maturity active

reverse-engineering security developer-tools parser reverse-engineering security developer-tools windows python editor-plugin ida-pro idapython malware-analysis disassembly flirt-signatures shellcode mandiant-flare

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mandiant/flare-ida")