# FLARE Learning Hub

> Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. The Malware Analysis Crash Course builds from x86 basics to reading Windows API use through assembly-patching exercises and labs with worked solutions; the other modules introduce WinDbg Time Travel Debugging for malware triage and provide a reference to how Go 1.24 programs look in Windows executables.

- Type: Learning resource
- Targets: Binary
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-27
- Original resource: <https://github.com/mandiant/flare-learning-hub>
- Primary source: <https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/README.md>
- Catalog page: <https://awesomerea.org/resources/flare-learning-hub/>
- Record JSON: <https://awesomerea.org/resources/flare-learning-hub/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/flare-learning-hub/index.md)

## Requirements & limits

- At reviewed commit ebd4e3a (2026-03-31), the repository, first committed on 2026-03-19, holds three modules: Malware Analysis Crash Course (nine chapters, five labs, hacking exercises and flash quizzes), An Introduction to Time Travel Debugging (a demo, one triage lab and a JavaScript automation reference) and The Go Reverse Engineering Reference. Module text lives in web-published Google Docs that change outside the repository. The README promises refinements and new modules, but no commits followed 31 March by the review date.
- The crash course is the entry point: it assumes Windows command-line use, Boolean logic, two's complement, basic programming and networking. The TTD module assumes basic x86 Windows reversing and WinDbg. The Go reference assumes x86 reversing and Go, and is restricted to Windows AMD64 executables built with Go 1.24.0.
- The README says all modules support only Intel x86-64 environments and strongly recommends an isolated, snapshot-capable FLARE-VM virtual machine. The crash course uses IDA and FakeNet, and its exercises ship with IDA database files; the TTD module uses WinDbg, which includes TTD, and ttd.exe. Lab and demo binaries, databases and scripts are FLARE-made and come as password-protected archives. The README warns that some behave like malware and may be flagged, so they belong only in that VM; one TTD demo trace is a separate Google Drive download.
- The repository is Apache-2.0; the Google Docs reviewed carry no separate license statement. The project does not accept contributions and takes errata by email.

## Primary sources

1. <https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/README.md>
2. <https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/macc/README.md>
3. <https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/ttd/README.md>
4. <https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/LICENSE>
5. <https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/CONTRIBUTING.md>
6. <https://docs.google.com/document/d/1I83PHeEImWacuQut02VBlkJ2-CJcuTYmt6mxa_xGqlA>
7. <https://docs.google.com/document/d/15gbXsTtWyxlUr5bxWO0wvWNHDZqxqh_LEqLanyZpdyw>
8. <https://docs.google.com/document/d/1AG76FBur7aagm36o-hNbny1X1Q3_IGHEjbP-JDsrJH4>

## More in References and learning

- [Nintendo Switch Reverse Engineering](https://awesomerea.org/resources/nintendo-switch-joycon-re-notes/index.md) · Learning resource
- [Android App Reverse Engineering 101](https://awesomerea.org/resources/android-app-re-101/index.md) · Learning resource
- [Reverse Engineering iOS Applications](https://awesomerea.org/resources/re-ios-apps-course/index.md) · Learning resource
- [tiny-dec](https://awesomerea.org/resources/tiny-dec/index.md) · Learning resource
- [Reverse Engineering Reading List](https://awesomerea.org/resources/onethawt-re-reading-list/index.md) · Learning resource
- [Decomp Academy](https://awesomerea.org/resources/decomp-academy/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.