mandiant/flare-vm: Automate Windows Reverse Engineering Environment Setup

Setting up a reverse engineering environment on Windows traditionally means hours of manual work: downloading individual tools, resolving dependencies, configuring paths, and ensuring everything plays nicely together. For malware analysts and security researchers, this friction directly impacts productivity—every minute spent on environment setup is a minute not spent on actual analysis. The mandiant/flare-vm project, maintained by Mandiant, addresses this exact pain point by providing a collection of software installation scripts that automate the creation and maintenance of a complete reverse engineering environment on a Windows virtual machine.

What is mandiant/flare-vm?

mandiant/flare-vm is an open-source project (Apache License 2.0) that provides PowerShell-based installation scripts for building and maintaining reverse engineering environments on Windows systems. As of its last commit on June 23, 2026, the repository has accumulated 8,861 stars and 1,100 forks, reflecting substantial adoption within the security research community.

The project was designed specifically to solve the problem of reverse engineering tool curation—the ongoing challenge of keeping dozens of specialized tools installed, updated, and properly configured. Rather than maintaining a monolithic image or manual checklist, FLARE-VM relies on two established Windows automation technologies: Chocolatey, a NuGet-based package manager for Windows, and Boxstarter, which leverages Chocolatey packages to create repeatable, scripted Windows environments.

In this architecture, each "package" is essentially a ZIP file containing PowerShell installation scripts that download and configure a specific tool. This modular approach means the environment can be extended, customized, and rebuilt with precision—critical for forensic reproducibility and team standardization. The project sits at the intersection of DevOps^{↗ Bright Coding Blog} automation practices and specialized security tooling, making it relevant for both individual researchers and enterprise incident response teams who need consistent, auditable analysis environments.

Key Features

VM-First Design with Hard Safety Boundaries

FLARE-VM is explicitly designed for virtual machine deployment only—a deliberate architectural choice given that the environment disables Windows Defender, Tamper Protection, and Windows Updates. This is not a casual recommendation; the documentation repeatedly emphasizes that these security controls must be disabled for proper functionality, making VM isolation non-negotiable.

Dual Automation Engine

The project combines Chocolatey's package management with Boxstarter's environment orchestration. Chocolatey handles individual tool installations (each as a versioned, scriptable package), while Boxstarter manages system-level configuration, reboot resilience, and end-to-end environment provisioning. This separation of concerns allows granular updates without full environment rebuilds.

Configurable Package Selection

The installer provides both a GUI and CLI interface for customizing which packages to install. Users can select from FLARE-VM's curated packages plus the broader Chocolatey community repository. Configuration is driven by an XML file (config.xml) that can be sourced locally or from a URL, enabling team-wide standardization and CI/CD integration.

Reboot-Resilient Installation

Windows tool installation often requires reboots, which traditionally break automated scripts. FLARE-VM uses Boxstarter to handle reboots automatically, logging in and continuing installation without manual intervention. The -password parameter enables this functionality; without it, the script prompts interactively.

Custom Taskbar and Registry Configuration

Beyond tool installation, the environment supports custom taskbar layouts via CustomStartLayout.xml and registry modifications through the configuration file. This includes practical hardening like showing known file extensions—small but meaningful productivity improvements for file analysis work.

Use Cases

Enterprise Malware Analysis Labs

Security operations centers and incident response teams need standardized analysis environments that can be spun up consistently across analysts. FLARE-VM's XML-driven configuration allows organizations to version-control their exact toolset and environment settings, ensuring that findings from different analysts are comparable and reproducible.

Threat Intelligence Research

Researchers tracking APT groups or analyzing novel malware families often need fresh, isolated environments for each sample to prevent cross-contamination. FLARE-VM enables rapid environment provisioning—install once, snapshot, then clone for each new investigation. The host-only networking recommendation post-installation further isolates analysis from production networks.

Reverse Engineering Training and Certification

Students preparing for certifications like GREM or OSCP, or participating in reverse engineering CTFs, need environments with specific tool combinations (disassemblers, debuggers, decompilers, network analyzers). FLARE-VM eliminates the setup barrier that often consumes the first day of any training course.

Tool Evaluation and Comparison

Analysts evaluating new reverse engineering tools can use FLARE-VM to install them in a clean, controlled environment without polluting their primary workstation. The Chocolatey package model means tools can be added or removed cleanly without manual registry or filesystem cleanup.

Forensic Investigation Standardization

Legal and compliance requirements often mandate documented, repeatable processes for digital evidence handling. FLARE-VM's scripted installation provides an auditable trail of exactly what tools were installed, when, and how—supporting chain-of-custody documentation.

Installation & Setup

The installation process is documented in detail in the repository. Below are the exact commands and steps, reproduced precisely from the README.

Pre-Installation Requirements

Before running the installer, prepare a Windows 10+ virtual machine with:

• Windows ≥ 10
• PowerShell ≥ 5
• At least 60 GB disk and 2 GB RAM
• Username without spaces or special characters
• Internet connection
• Tamper Protection and any Anti-Malware solution disabled, preferably via Group Policy
• Windows Updates disabled

Critical preparation steps:

1. Install Windows from the official ISO (https://www.microsoft.com/en-us/software-download/windows10ISO)
2. Disable Windows Updates (at least until installation completes)
3. Disable Tamper Protection and Windows Defender—GPO method preferred, with manual and automated alternatives documented
4. Take a VM snapshot before running FLARE-VM installation
5. For IDA Pro users: place your installer (and optional license file) on the Desktop before running the installer

Running the Installer

Open PowerShell as Administrator and execute:

# Download the installation script to Desktop
(New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1', "$([Environment]::GetFolderPath("Desktop"))\install.ps1")

# Unblock the downloaded script
Unblock-File .\install.ps1

# Enable script execution
Set-ExecutionPolicy Unrestricted -Force
# Note: If policy is overridden at a specific scope, use:
# Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force
# View all policies with: Get-ExecutionPolicy -List

# Execute the installer
.\install.ps1

Installer Parameters

The script supports several CLI parameters for automation:

# Pass password for reboot resiliency
.\install.ps1 -password <password>

# Minimal interaction CLI mode
.\install.ps1 -password <password> -noWait -noGui

# Custom configuration with CLI mode
.\install.ps1 -customConfig <config.xml> -password <password> -noWait -noGui

Full parameter documentation:

Get complete help with: Get-Help .\install.ps1 -Detailed

Post-Installation

After installation completes:

1. Switch to host-only networking mode
2. Take a VM snapshot for future reversion

Real Code Examples

Example 1: Basic Automated Installation

The most common deployment scenario uses the CLI-only mode for unattended installation:

# Download installer
(New-Object net.webclient).DownloadFile(
    'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
    "$([Environment]::GetFolderPath("Desktop"))\install.ps1"
)

Unblock-File .\install.ps1
Set-ExecutionPolicy Unrestricted -Force

# Run with minimal interaction, providing password for reboot handling
.\install.ps1 -password "YourSecurePassword" -noWait -noGui

This pattern is essential for CI/CD pipelines or when provisioning multiple analyst workstations. The -noWait flag eliminates the confirmation pause, while -noGui bypasses the interactive package selection screen, using only the default or custom-configured package set.

Example 2: Custom Configuration from URL

Teams maintaining standardized environments can host their own config.xml and reference it directly:

.\install.ps1 `
    -customConfig "https://raw.githubusercontent.com/mandiant/flare-vm/main/config.xml" `
    -password "YourSecurePassword" `
    -noWait `
    -noGui

The configuration file controls which packages are installed and environment variable paths. This enables scenarios like: a core package set for all analysts, plus team-specific extensions for mobile malware, firmware reverse engineering, or Windows kernel analysis.

Example 3: Registry Customization via Configuration

The default config.xml demonstrates post-installation registry modifications. A practical example shows known file extensions:

<registry-items>
    <registry-item 
        name="Show known file extensions" 
        path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" 
        value="HideFileExt" 
        type="DWord" 
        data="0"/>
</registry-items>

This directly addresses a common malware analysis pain point: Windows hides extensions by default, which attackers exploit with double extensions (invoice.pdf.exe). Exposing extensions is a basic but critical hardening step.

Example 4: Custom Taskbar with Admin Shortcuts

For tools requiring elevated privileges, the documentation describes creating shortcuts with VM-Install-Shortcut and the -runAsAdmin flag, then pinning these shortcuts via CustomStartLayout.xml. Only .exe files or shortcuts to applications can be pinned; for non-application items, create a shortcut pointing to cmd.exe or powershell with arguments.

Advanced Usage & Best Practices

Snapshot Discipline

The documentation explicitly recommends snapshots at two points: before installation (for recovery) and after installation (for clean working state). Experienced practitioners extend this to layered snapshots: base Windows, post-FLARE-VM, then per-investigation branches. This prevents tool contamination between unrelated malware families.

Network Isolation Timing

The recommendation to switch to host-only networking post-installation is security-critical but timing-sensitive. Some packages may require internet access for final configuration or license validation. Test your specific package set to determine the optimal switch point—immediately post-install, or after first tool launch.

Handling Package Failures

The troubleshooting section identifies seven failure categories, with important guidance on where community contribution is effective. Failures from Chocolatey/MyGet timeouts, remote host issues, IDS/AV interference, or untested Windows versions are generally not fixable by the maintainers. However, build failures, outdated URLs, and SHA256 hash mismatches are actionable—report these to the VM-Packages repository, not FLARE-VM itself.

Update Strategy

Package updates are explicitly best-effort and untested. For production analysis environments, the recommended pattern is fresh reinstall rather than in-place update. This avoids subtle configuration drift that can compromise analysis reproducibility.

Log Analysis Workflow

When failures occur, examine three log locations in order:

• %VM_COMMON_DIR%\log.txt — FLARE-VM specific operations
• %PROGRAMDATA%\chocolatey\logs\chocolatey.log — Package manager activity
• %LOCALAPPDATA%\Boxstarter\boxstarter.log — Environment orchestration and reboot handling

Comparison with Alternatives

FLARE-VM's Windows-native design is its defining characteristic. While REMnux provides a polished Linux alternative, many Windows-specific analysis tools (certain debuggers, .NET decompilers, Windows kernel utilities) run more naturally or exclusively on Windows. The Chocolatey/Boxstarter foundation also enables easier customization for Windows-centric teams compared to maintaining custom Linux packages.

Kali Linux's broader scope can be advantageous for red teams needing integrated workflows, but its reverse engineering tooling is less curated for dedicated malware analysis. The choice often reduces to: Windows target analysis favors FLARE-VM; Linux-native or cross-platform workflows favor REMnux; general security testing with occasional RE needs favors Kali.

FAQ

Is FLARE-VM safe to install on my main Windows machine?

No. The documentation explicitly states it should only be installed on a virtual machine, as it disables security controls including Windows Defender and Tamper Protection.

What Windows versions are supported?

Windows 10 or newer. Untested versions may work but are not guaranteed.

Do I need to disable Windows Updates permanently?

At minimum, disable during installation. The documentation recommends this to prevent update interruptions during the automated process.

Can I use FLARE-VM without an internet connection?

No. Internet access is required for downloading packages and tools from Chocolatey, MyGet, and original tool sources.

Is commercial software like IDA Pro automatically included?

No. You must provide your own IDA Pro installer and optional license file, placed on the Desktop before running the installer. The idapro.vm package handles configuration only.

What license covers FLARE-VM?

Apache License 2.0. Individual packages have their own licenses that you must review and accept.

How do I troubleshoot a failed installation?

Check the three log files documented above, ensure requirements are met, and verify you're using the latest installer version. Report script bugs to FLARE-VM; package-specific issues to VM-Packages.

Conclusion

mandiant/flare-vm solves a genuinely tedious problem for Windows-based reverse engineering: the hours of manual setup that precede actual analysis work. By combining Chocolatey's package management with Boxstarter's environment orchestration, it provides reproducible, customizable, and reboot-resilient environment provisioning that scales from individual researchers to enterprise teams.

The project is best suited for malware analysts, incident responders, and reverse engineers who work primarily with Windows-targeted samples and need consistent, isolated environments. The VM-only requirement and security control disablement are architectural constraints, not oversights—reflecting the reality that effective malware analysis requires execution in controlled, observable conditions.

With 8,861 stars and active maintenance through mid-2026, FLARE-VM represents a mature, community-validated approach to environment automation. For teams still maintaining manual installation checklists or monolithic VM images, migrating to FLARE-VM's script-driven model offers immediate reproducibility benefits and long-term maintainability.

Ready to automate your reverse engineering environment? Get started at https://github.com/mandiant/flare-vm.