flare-vm

Project Overview

FLARE-VM is a collection of software installation scripts for Windows systems from Mandiant that allows you to easily set up and maintain a reverse engineering environment on a virtual machine.It is built on Chocolatey and Boxstarter, using PowerShell scripts to automatically install and configure numerous reverse engineering tools.

Key Features

• Automated software installation: One-click installation of dozens of reverse engineering tools via Chocolatey
• Repeatable environment builds: Create repeatable, scripted Windows environments via Boxstarter
• Complete toolchain coverage: Includes debuggers, decompilers, binary analysis, malware analysis tools, and more
• IDA Pro support: Can automatically install IDA Pro (installer must be placed on Desktop)

Target Audience

• Reverse engineers and security researchers
• Malware analysts
• Teams who need to quickly set up reverse engineering environments

Quick Start

1. Prepare a Windows 10+ virtual machine (FLARE-VM should ONLY be installed on a VM)
2. Ensure requirements are met: Windows ≥ 10, PowerShell ≥ 5, disk ≥ 60GB, memory ≥ 2GB
3. Disable Windows Defender and other anti-malware solutions, and disable Windows Updates
4. Open PowerShell as Administrator
5. Download and run the installer script:

   (New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$env:USERPROFILE\Desktop\install.ps1")

Core Advantages

• Officially from Mandiant with reliable quality
• One-click installation of numerous reverse engineering tools
• Repeatable, scriptable environment builds
• Open-source and free

System Requirements

• OS: Windows 10+
• Memory: At least 2GB
• Disk: At least 60GB
• PowerShell ≥ 5
• Internet connection

Notes

• FLARE-VM should ONLY be installed on a virtual machine, not recommended for physical machines
• Take a VM snapshot before installation for rollback
• If installing IDA Pro, place the installer and license file on the Desktop