Tool
flare-emu
Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. Its interfaces emulate an instruction range or function with chosen register and stack values, force execution down the branches needed to reach target addresses or every cross-reference to a function, walk all paths through a function, run a standalone byte blob, or emulate from an address until nothing is left, with hooks on instructions and calls. A common use in its README is decrypting malware strings by emulating the decryption routine at each call site and commenting the results.
- Targets
- Binary
- Category
- Binary analysis libraries
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Needs Unicorn and its Python bindings plus IDA Pro 7.x or later (older IDA APIs are not supported), Rizin with rzpipe, or Radare2 with r2pipe; the README also shows use through IDA's idalib. Installation means copying flare_emu.py, the framework module and flare_emu_hooks.py into IDA's python directory or onto Python's import path.
- Limits: The repository was archived on GitHub after a final release tagged 2025-08-14, which has no notes. With Rizin it runs as a command-line script or in a Python shell.
- License: Apache-2.0 per LICENSE-APACHE.TXT.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · mandiant/flare-emu · Revision 6688c32
- flare_emu.py#L13 GitHub · mandiant/flare-emu · Revision 6688c32
- LICENSE-APACHE.TXT GitHub · mandiant/flare-emu · Revision 6688c32
- https://github.com/mandiant/flare-emu/releases/tag/2025-08-14
More in Native binaries
- IDA Pro · Tool
- Binary Ninja · Tool
- Hopper Disassembler · Tool
- WinDbg · Tool
- 010 Editor · Tool
- pestudio · Tool