AwesomeREA.org

Tool

FLARE IDA Pro utilities

Archived collection of IDAPython plugins and scripts from Mandiant's FLARE team for malware and native-code analysis in IDA Pro. It searches code for precomputed API-name hashes used by shellcode, recovers strings built on the stack (statically, or by emulation with flare-emu in ironstrings), applies function types to structure fields and indirect calls, annotates imports with MSDN function, argument and constant information, and uses idb2pat to generate pattern files from an IDB's functions for building FLIRT signatures. Other scripts track static arguments to functions such as string decoders, link Objective-C selector references to their implementations in Mach-O files, and graft stub implementations of common Windows API imports so that decoding or unpacking code can run under IDA's Bochs emulation.

Requirements & limits

  • The repository is archived and read-only, with no releases or tags; the reviewed master commit of 2024-10-29 is its last. Nothing is packaged: the README says to copy plugins/ into IDA's plugins folder and python/ into IDA's python folder or onto PYTHONPATH, and scripts such as annotate_IDB_MSDN.py, ironstrings.py and code_grafter.py are run through File → Script file.
  • Needs IDA Pro with IDAPython; the README gives Windows %PROGRAMFILES% paths and names no supported IDA version. The code spans several IDA generations: apply_callee_type was fixed for IDA 7.6 SP1 and idb2pat was ported to Python 3, while stackstrings, argtracker and the decompiler_scripts still use Python 2 syntax, and the StackStrings plugin warns that it only works under Python 2 because of its vivisect dependency. Dialog-based tools import PyQt5; ironstrings, objc2_analyzer and revil_string_decrypt need flare-emu and Unicorn, the decompiler_scripts need the Hex-Rays decompiler, and code_grafter targets IDA's Bochs IDB emulation mode.
  • Samples and IDBs come from the analyst. The repository bundles sc_hashes.db, a SQLite database of about 50 MB holding precomputed hashes of export names from Microsoft DLLs, with make_sc_hash_db.py to rebuild it from a DLL directory the user chooses. The MSDN annotator expects an MSDN_data directory that is not shipped; the MSDN_crawler script builds it with Python 2.7 from an extracted copy of the MSDN documentation and IDA's tilib.
  • There are no tests or CI. Behaviour is documented through the README, per-tool READMEs and linked FireEye and Mandiant blog posts, and the scripts were not checked against current IDA releases here.
  • Apache-2.0 for the repository, while msdn_crawler.py is a GPL-2.0-or-later derivative of the zynamics msdn-crawler. IDA Pro, the Hex-Rays decompiler and Microsoft DLLs and documentation keep their own terms. No scripts were run and no samples were analyzed; the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mandiant/flare-ida · Revision fc667de
  2. python/flare/ironstrings/README.md GitHub · mandiant/flare-ida · Revision fc667de
  3. code_grafter/README.md GitHub · mandiant/flare-ida · Revision fc667de
  4. shellcode_hashes/README.md GitHub · mandiant/flare-ida · Revision fc667de
  5. plugins/stackstrings_plugin.py GitHub · mandiant/flare-ida · Revision fc667de
  6. python/flare/argtracker.py GitHub · mandiant/flare-ida · Revision fc667de
  7. python/flare/annotate_IDB_MSDN.py GitHub · mandiant/flare-ida · Revision fc667de
  8. MSDN_crawler/msdn_crawler.py GitHub · mandiant/flare-ida · Revision fc667de
  9. LICENSE GitHub · mandiant/flare-ida · Revision fc667de
  10. https://github.com/mandiant/flare-ida/commit/14c771f456fd3c1fcd3fb7d681db92279a0e63d7
  11. https://github.com/mandiant/flare-ida/commit/c9a39c4328fc39004d18e80b750a720fbe56af7d

More in Native binaries

All 119 entries in Native binaries