Learning resource
FLARE Learning Hub
Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. The Malware Analysis Crash Course builds from x86 basics to reading Windows API use through assembly-patching exercises and labs with worked solutions; the other modules introduce WinDbg Time Travel Debugging for malware triage and provide a reference to how Go 1.24 programs look in Windows executables.
Requirements & limits
- At reviewed commit ebd4e3a (2026-03-31), the repository, first committed on 2026-03-19, holds three modules: Malware Analysis Crash Course (nine chapters, five labs, hacking exercises and flash quizzes), An Introduction to Time Travel Debugging (a demo, one triage lab and a JavaScript automation reference) and The Go Reverse Engineering Reference. Module text lives in web-published Google Docs that change outside the repository. The README promises refinements and new modules, but no commits followed 31 March by the review date.
- The crash course is the entry point: it assumes Windows command-line use, Boolean logic, two's complement, basic programming and networking. The TTD module assumes basic x86 Windows reversing and WinDbg. The Go reference assumes x86 reversing and Go, and is restricted to Windows AMD64 executables built with Go 1.24.0.
- The README says all modules support only Intel x86-64 environments and strongly recommends an isolated, snapshot-capable FLARE-VM virtual machine. The crash course uses IDA and FakeNet, and its exercises ship with IDA database files; the TTD module uses WinDbg, which includes TTD, and ttd.exe. Lab and demo binaries, databases and scripts are FLARE-made and come as password-protected archives. The README warns that some behave like malware and may be flagged, so they belong only in that VM; one TTD demo trace is a separate Google Drive download.
- The repository is Apache-2.0; the Google Docs reviewed carry no separate license statement. The project does not accept contributions and takes errata by email. This collection read the README, module directory notes and the three published documents; it did not run the labs, and nothing in the material mentions AI or REA.
About this entry
- Type
- Learning resource
- Category
- Learning resources
- Relationship
- Learning resource
- Targets
- Binary
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · mandiant/flare-learning-hub · Revision ebd4e3a
- macc/README.md GitHub · mandiant/flare-learning-hub · Revision ebd4e3a
- ttd/README.md GitHub · mandiant/flare-learning-hub · Revision ebd4e3a
- LICENSE GitHub · mandiant/flare-learning-hub · Revision ebd4e3a
- CONTRIBUTING.md GitHub · mandiant/flare-learning-hub · Revision ebd4e3a
- https://docs.google.com/document/d/1I83PHeEImWacuQut02VBlkJ2-CJcuTYmt6mxa_xGqlA
- https://docs.google.com/document/d/15gbXsTtWyxlUr5bxWO0wvWNHDZqxqh_LEqLanyZpdyw
- https://docs.google.com/document/d/1AG76FBur7aagm36o-hNbny1X1Q3_IGHEjbP-JDsrJH4
More in References and learning
- Nintendo Switch Reverse Engineering · Learning resource
- Android App Reverse Engineering 101 · Learning resource
- Reverse Engineering iOS Applications · Learning resource
- tiny-dec · Learning resource
- Reverse Engineering Reading List · Learning resource
- Decomp Academy · Learning resource