{
  "added_at": "2026-10-27",
  "additional_evidence_urls": [
    "https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/macc/README.md",
    "https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/ttd/README.md",
    "https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/LICENSE",
    "https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/CONTRIBUTING.md",
    "https://docs.google.com/document/d/1I83PHeEImWacuQut02VBlkJ2-CJcuTYmt6mxa_xGqlA",
    "https://docs.google.com/document/d/15gbXsTtWyxlUr5bxWO0wvWNHDZqxqh_LEqLanyZpdyw",
    "https://docs.google.com/document/d/1AG76FBur7aagm36o-hNbny1X1Q3_IGHEjbP-JDsrJH4"
  ],
  "category": "learning",
  "description_en": "Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. The Malware Analysis Crash Course builds from x86 basics to reading Windows API use through assembly-patching exercises and labs with worked solutions; the other modules introduce WinDbg Time Travel Debugging for malware triage and provide a reference to how Go 1.24 programs look in Windows executables.",
  "description_zh": "Mandiant FLARE 团队发布的免费英文逆向工程与恶意软件分析课程模块，正文以 Google Docs 形式发布，实验用二进制文件、IDA 数据库和脚本存放在本仓库中。其中的恶意软件分析速成课从 x86 基础讲到解读 Windows API 调用，穿插汇编修改练习和附详细解答的实验；其余模块介绍如何用 WinDbg 时间旅行调试（Time Travel Debugging）分诊恶意软件，并提供一份说明 Go 1.24 程序在 Windows 可执行文件中呈现方式的参考手册。",
  "entry_url": "https://awesomerea.org/resources/flare-learning-hub/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/flare-learning-hub/",
  "evidence_url": "https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/README.md",
  "group": "learn",
  "id": "flare-learning-hub",
  "json_url": "https://awesomerea.org/resources/flare-learning-hub/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/flare-learning-hub/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/flare-learning-hub/index.md",
  "name": "FLARE Learning Hub",
  "name_zh": "FLARE 学习中心",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "At reviewed commit ebd4e3a (2026-03-31), the repository, first committed on 2026-03-19, holds three modules: Malware Analysis Crash Course (nine chapters, five labs, hacking exercises and flash quizzes), An Introduction to Time Travel Debugging (a demo, one triage lab and a JavaScript automation reference) and The Go Reverse Engineering Reference. Module text lives in web-published Google Docs that change outside the repository. The README promises refinements and new modules, but no commits followed 31 March by the review date.",
    "The crash course is the entry point: it assumes Windows command-line use, Boolean logic, two's complement, basic programming and networking. The TTD module assumes basic x86 Windows reversing and WinDbg. The Go reference assumes x86 reversing and Go, and is restricted to Windows AMD64 executables built with Go 1.24.0.",
    "The README says all modules support only Intel x86-64 environments and strongly recommends an isolated, snapshot-capable FLARE-VM virtual machine. The crash course uses IDA and FakeNet, and its exercises ship with IDA database files; the TTD module uses WinDbg, which includes TTD, and ttd.exe. Lab and demo binaries, databases and scripts are FLARE-made and come as password-protected archives. The README warns that some behave like malware and may be flagged, so they belong only in that VM; one TTD demo trace is a separate Google Drive download.",
    "The repository is Apache-2.0; the Google Docs reviewed carry no separate license statement. The project does not accept contributions and takes errata by email."
  ],
  "requirements_zh": [
    "在所审阅的提交 ebd4e3a（2026-03-31）中，该仓库首次提交于 2026-03-19，包含三个模块：恶意软件分析速成课（九章、五个实验、汇编修改练习和随堂小测）、时间旅行调试入门（一个演示、一个分诊实验和一份 JavaScript 自动化参考）以及 Go 逆向工程参考手册。模块正文位于网页发布的 Google Docs 中，会在仓库之外更新。README 称会持续完善现有模块并发布新模块，但截至审阅日，3 月 31 日之后没有新提交。",
    "速成课是入门起点，要求熟悉 Windows 命令行、布尔逻辑、补码，以及基本的编程和网络知识。TTD 模块要求具备基本的 x86 Windows 逆向能力并会使用 WinDbg。Go 参考手册要求具备 x86 逆向基础并熟悉 Go，内容仅限使用 Go 1.24.0 构建的 Windows AMD64 可执行文件。",
    "README 说明所有模块目前只支持 Intel x86-64 环境，并强烈建议使用隔离且支持快照的 FLARE-VM 虚拟机。速成课使用 IDA 和 FakeNet，练习附带 IDA 数据库文件；TTD 模块使用自带 TTD 的 WinDbg 以及 ttd.exe。实验和演示用的二进制文件、数据库和脚本均由 FLARE 制作，以带密码的压缩包提供。README 提醒其中部分程序具有类似恶意软件的行为，可能被安全软件标记，因此只应在上述虚拟机中使用；TTD 的一个演示跟踪文件需另从 Google Drive 下载。",
    "本仓库采用 Apache-2.0 许可证；所审阅的 Google Docs 未另附许可声明。项目不接受贡献，勘误通过电子邮件反馈。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/flare-learning-hub",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}