FLARE - leading the world in advanced binary analysis
FLARE is a team of elite reverse engineering professionals specializing in advanced malware analysis. Known for their expertise, open source tools, and training, their vital threat intelligence enables robust incident response efforts and strengthens global cyber defenses through the Google Threat Intelligence product.
Open source projects
FLARE's open source tools empower reverse engineers, malware analysts, and security researchers to analyze malicious software and complex binaries.
FLARE-VMA Windows-based virtual machine distribution for reverse engineering and malware analysis.Find FLARE-VM on GitHub
CAPADetect capabilities in executable files using a community-driven rule collection.Find CAPA on GitHub
FLOSSUse advanced static analysis techniques to extract obfuscated strings.Find FLOSS on GitHub
FakeNet-NGIntercept and redirect network traffic while simulating network services.Find FakeNet-NG on GitHub
XREFERAn IDA Pro plugin providing advanced navigation features for efficient analysis of complex binaries.Find XREFER on GitHub
GoReSymA cross-platform Go symbol parser that extracts program and function metadata.Find GoReSym on GitHub
FLARE-On Capture-the-Flag (CTF) challenge
The Flare-On challenge is the FLARE team's annual CTF contest featuring a gauntlet of reverse engineering puzzles whose designs draw inspiration from frontline malware analysis.
- Get ready for FLARE-On 12FLARE-On 12 begins Fall 2025. Check the FLARE-On site for start time and stay up to date.
- FLARE-On 11Missed a challenge? Revisit with official solutions. It's over, so learn.
- FLARE-On 10Reverse engineering is a timeless art and these challenges can sharpen your reversing skills.
FLARE research
FLARE blog posts help shape the reverse engineering landscape by disseminating cutting-edge research, practical analysis techniques, and insights into new malware tactics.
- Unraveling time: A deep dive into TTD instruction emulation bugsThis blog post examines emulation challenges, historical context, and analyzes emulation bugs.
5-min read
- Ghost in the router: China-nexus espionage actor UNC3886 targets Juniper routersMid-2024: Mandiant: China-linked UNC3886 used TINYSHELL on Juniper Junos routers for access.
5-min read
- Suspected China-nexus threat actor actively exploiting critical Ivanti Connect Secure vulnerabilityCritical RCE in Ivanti Connect Secure (ICS) VPN. Exploited in 9.X & 22.7R2.5 or earlier.
Community projects
The FLARE team's participation in Google Summer of Code (GSoC) cultivates a lasting impact on the open source landscape, nurturing emerging talent, and enriching the capabilities of essential reversing tools.
- GSoC 2025: Explore malware analysis and reverse engineering with FLAREDive into emulation, disassembly, and more.
- GSoC 2024: Building capa explorer webVisualize capa's reverse engineering insights in your browser.
- GSoC 2023: Improving fakenet-ng, capa, and FLOSSExplore the new features and meet the authors behind them.
