# flare-emu

> Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. Its interfaces emulate an instruction range or function with chosen register and stack values, force execution down the branches needed to reach target addresses or every cross-reference to a function, walk all paths through a function, run a standalone byte blob, or emulate from an address until nothing is left, with hooks on instructions and calls. A common use in its README is decrypting malware strings by emulating the decryption routine at each call site and commenting the results.

- Type: Tool
- Targets: Binary
- Category: Binary analysis libraries
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/mandiant/flare-emu>
- Primary source: <https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/README.md>
- Catalog page: <https://awesomerea.org/resources/flare-emu/>
- Record JSON: <https://awesomerea.org/resources/flare-emu/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/flare-emu/index.md)

## Requirements & limits

- **Prerequisites:** Needs Unicorn and its Python bindings plus IDA Pro 7.x or later (older IDA APIs are not supported), Rizin with rzpipe, or Radare2 with r2pipe; the README also shows use through IDA's idalib. Installation means copying flare_emu.py, the framework module and flare_emu_hooks.py into IDA's python directory or onto Python's import path.
- **Limits:** The repository was archived on GitHub after a final release tagged 2025-08-14, which has no notes. With Rizin it runs as a command-line script or in a Python shell.
- **License:** Apache-2.0 per LICENSE-APACHE.TXT.

## Primary sources

1. <https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/README.md>
2. <https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/flare_emu.py#L13>
3. <https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/LICENSE-APACHE.TXT>
4. <https://github.com/mandiant/flare-emu/releases/tag/2025-08-14>

## More in Native binaries

- [IDA Pro](https://awesomerea.org/resources/ida-pro/index.md) · Tool
- [Binary Ninja](https://awesomerea.org/resources/binary-ninja/index.md) · Tool
- [Hopper Disassembler](https://awesomerea.org/resources/hopper-disassembler/index.md) · Tool
- [WinDbg](https://awesomerea.org/resources/windbg/index.md) · Tool
- [010 Editor](https://awesomerea.org/resources/010-editor/index.md) · Tool
- [pestudio](https://awesomerea.org/resources/pestudio/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.