flare-learning-hub - Free educational content on reverse engineering an

项目说明

FLARE Learning Hub

!FLARE Learning Hub Logo

The FLARE Learning Hub freely distributes quality reverse engineering and malware analysis educational content from the FLARE team.

The FLARE Learning Hub modules are hosted as web-published Google Docs, which are linked in the respecti below. This repository contains all corresponding artifacts for each module, including lab exercise and demonstration binaries, disassembler databases, and scripts.

Refinements to existing modules and new modules will be published on an ongoing basis.

A Modules

* Malware Analysis Crash Course
* The Go Reverse Engineering Reference
* An Introduction to Time Tra

Getting Started

To start working on a module, we strongly recommend setting up a safely isolated machine ( using FLARE-VM, which provides the tools necessary to complete the lab exercises and demonstrations. We also recommend using a product that supports snapshots, which allows you to record the VM in a clean state and revert to that state when starting a new analysis. All modules currently only support Intel x86-64 en.

Working with Distributed Binaries

While all distributed binaries and scripts are crafted for the sole purpose of hands-on exercise and demonstration, they may be flagged as malicious by automated systems as some exhibit malware-like behavior. This project is not responsible for any damage or loss resulting from executing the binaries and scripts outside of a secured, isolated machine en.

The password for any password-protected ZIPs in this repository is flare.

Malware Analysis Crash Course

Authors: Jae Young Kim and Nick Harbour

Module Link: Malware Analysis Crash Course

Module Directory: /macc

As static analysis tools and sandbox products continue to progress, they provide increasingly information about malware binaries. However, when reliability and accuracy are critical, making definiti about a malware sample still necessitates a comprehensi of the program through manual reverse engineering.

This is a crash course on reading, interpreting, and manipulating assembly code, which remains the cornerstone of a reverse engineer’s skill set. By the end of this training, you will ha the practical skills necessary to begin analyzing typical Windows malware samples.

The course starts with the basics of x86 assembly and gradually introduces higher-le constructs. It also includes the essential Windows knowledge required to begin re Windows-based malware.

Emphasizing a learn-by-doing approach, the course progression weaves in numerous assembly hacking exercises. We believe the repetition of writing assembly and debugging the results is the most effective way to quickly master the fundamentals needed to reverse larger, complex programs. The course also features flash quizzes as well as multiple labs with detailed solutions.

The Go Reverse Engineering Reference

Authors: Jae Young Kim

Module Link: The Go Reverse Engineering Reference

The Go Reverse Engineering Reference is a comprehensi for reverse engineering Go executables. The reference consists of three sections:

* Language Reference: The Language Reference section breaks down each Go language feature and examines how the compiler implements it at the assembly level.
* Runtime Reference: The Runtime Reference section covers key Go runtime topics (including program initialization, runtime type descriptors, and write barriers) and provides an exhaustive list of compiler-emitted runtime functions with contextual explanations.
* Executable Reference: The Executable Reference section covers the structure and layout of a Windows Go executable with the goal of identifying and contextualizing every type of data and metadata in a binary.

All material in this reference is currently restricted to Windows AMD64 executables compiled with Go 1.24.0.

An Introduction to Time Tra

Authors: Josh Stroschein and Jae Young Kim

Module Link: An Introduction to Time Tra

Module Directory: /ttd

Time Tra (TTD), a technology offered by Microsoft as part of WinDbg, records a process’s execution to create a trace file that can be replayed forwards and backwards. Unlike con debugging, which only allows for forward execution tracing, TTD's "rewind" capability is particularly powerful for malware analysis and reverse engineering. This feature allows an analyst to inspect program behavior over time, significantly speeding up triage by quickly pinpointing malicious events. The ability to step forwards and backwards through execution is also instrumental in understanding and bypassing anti-analysis and obfuscation techniques.

TTD captures a program's execution path and state, creating a trace output through a transparent layer that allows full interaction with the operating system. A trace file preserves an execution record that can be shared with colleagues to facilitate collaboration, circum en differences that can affect the results of li. Specific points in execution can also be bookmarked and shared to direct a coworker’s analysis. Furthermore, it includes debugger data model objects, enabling users to query the trace with LINQ to find specific events like module loads, shellcode execution, or process injection events.

This module is an introduction to TTD and its application to Windows malware analysis. The module incorporates a detailed demo and a lab to provide guided, hands-on practice. It also includes a reference for using Ja to automate TTD tasks along with several example scripts. By the end of the module, you should be ready to start incorporating this powerful tool into your malware triage workflow and speed up your analysis under complex debugging scenarios.

Contributions

We are not currently accepting contributions to this repository, but any errata, suggestions, and feedback are welcome at .

Mailing List

Subscribe to the FLARE mailing list for community announcements by sending an email with the subject "subscribe" to .

项目信息

开发语言：JavaScript

Star 数：1485

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Free educational content on reverse engineering and malware analysis from the FLARE team展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。