# mandiant/flare-ida

IDA Pro utilities from FLARE team

Repository: https://github.com/mandiant/flare-ida
Canonical: https://ross.abutalabs.com/products/flare-ida
Language: Python
License: Apache-2.0
License Family: permissive
Topics: ida, fireeye-flare, ida-pro, idapython, ida-plugin, reverse-engineering
Archived: true
Last push: 2024-10-29T14:38:07+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 4417, "days_push": 673, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2453, forks 472 (observed 2026-08-28T04:06:53.028772+00:00)

## What it is
A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes tools for shellcode hash searching, struct typing, stack string recovery, MSDN annotations, FLIRT signature generation, and argument tracking.

## Use cases
- search precalculated string hashes used by shellcode in IDA
- recover manually constructed stack strings in malware
- annotate IDA database with MSDN API documentation
- generate FLIRT signatures from an existing IDB
- apply function types to indirect calls
- identify static arguments passed to functions
- apply types to structure fields in IDA

## When to choose
- you analyze malware or unknown binaries in IDA Pro
- you want battle-tested reversing plugins from an expert team
- you need to identify library functions via FLIRT signatures
- you want to enrich IDB databases with API documentation

## When to avoid
- you don't use IDA Pro
- you need a standalone disassembler or decompiler
- you work exclusively with Ghidra or Binary Ninja

## Facets
- artifact type: plugin
- maturity: active
- function: reverse-engineering, security, developer-tools, parser
- domain: reverse-engineering, security, developer-tools
- platform: windows, python, editor-plugin
- tags: ida-pro, idapython, malware-analysis, disassembly, flirt-signatures, shellcode, mandiant-flare

## Member repositories
- mandiant/flare-ida (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:53.028772+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:30:09.301506+00:00, confidence not recorded.
  - readme: https://github.com/mandiant/flare-ida (fetched 2026-08-28T04:06:53.028772+00:00, sha 252cd8339f01)
- Data as of 2026-08-30T08:39:29.467469+00:00.