{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/flare_emu.py#L13",
    "https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/LICENSE-APACHE.TXT",
    "https://github.com/mandiant/flare-emu/releases/tag/2025-08-14"
  ],
  "category": "binary-libraries",
  "description_en": "Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. Its interfaces emulate an instruction range or function with chosen register and stack values, force execution down the branches needed to reach target addresses or every cross-reference to a function, walk all paths through a function, run a standalone byte blob, or emulate from an address until nothing is left, with hooks on instructions and calls. A common use in its README is decrypting malware strings by emulating the decryption routine at each call site and commenting the results.",
  "description_zh": "Mandiant FLARE 团队的 Python 库，把 IDA Pro、Rizin 或 Radare2 与 Unicorn 模拟器结合起来，让分析人员能以脚本方式模拟执行正在分析的二进制代码，支持 32/64 位 x86、ARM 和 ARM64。它提供的接口可在指定寄存器和栈值下模拟一段指令或一个函数，强制走到目标地址或某函数全部交叉引用所需的分支，遍历函数的所有路径，单独运行一段字节，或从某个地址一直模拟到没有代码可执行为止，并支持指令级和调用级钩子。README 中的常见用法是在每个调用点模拟恶意软件的字符串解密函数，并把解密结果写成注释。",
  "entry_url": "https://awesomerea.org/resources/flare-emu/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/flare-emu/",
  "evidence_url": "https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/README.md",
  "group": "tools",
  "id": "flare-emu",
  "json_url": "https://awesomerea.org/resources/flare-emu/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/flare-emu/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/flare-emu/index.md",
  "name": "flare-emu",
  "name_zh": "flare-emu 二进制分析框架模拟执行库",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Needs Unicorn and its Python bindings plus IDA Pro 7.x or later (older IDA APIs are not supported), Rizin with rzpipe, or Radare2 with r2pipe; the README also shows use through IDA's idalib. Installation means copying flare_emu.py, the framework module and flare_emu_hooks.py into IDA's python directory or onto Python's import path.",
    "The repository was archived on GitHub after a final release tagged 2025-08-14, which has no notes. With Rizin it runs as a command-line script or in a Python shell.",
    "Apache-2.0 per LICENSE-APACHE.TXT."
  ],
  "requirements_zh": [
    "需要 Unicorn 及其 Python 绑定，并配合 IDA Pro 7.x 或更高版本（不兼容更早的 IDA API）、带 rzpipe 的 Rizin，或带 r2pipe 的 Radare2；README 还介绍了通过 IDA 的 idalib 使用的方法。安装方式是把 flare_emu.py、对应框架的模块和 flare_emu_hooks.py 复制到 IDA 的 python 目录，或放到 Python 的模块搜索路径中。",
    "仓库在最后一个发布（标签 2025-08-14，无发布说明）之后已在 GitHub 上归档。配合 Rizin 使用时，它以命令行脚本或在 Python shell 中运行。",
    "依 LICENSE-APACHE.TXT 采用 Apache-2.0 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/flare-emu",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}