FireEye's FLARE-On 2015: an eleven-challenge reverse engineering gauntlet
FLARE-On is an annual reverse-engineering competition run by FireEye's Labs Advanced Reverse Engineering team, aimed at giving analysts a structured way to practise against realistic, if deliberately obfuscated, binaries. The 2015 run was the second edition and consisted of eleven challenges of increasing difficulty.
What the series covered
Across the eleven stages, the set of skills exercised included unpacking custom and off-the-shelf packers, working through hand-rolled obfuscation and anti-disassembly tricks, recognising common cryptographic and encoding primitives inside disassembled code, and analysing simple network protocols to understand what a sample was trying to communicate. Later challenges combined several of these techniques in a single binary, requiring an analyst to work through layers rather than solve one trick in isolation.
Why a structured series like this is useful
Competitions like FLARE-On are designed to compress months of incidental exposure to obfuscation techniques into a few weeks of focused practice. Because the challenges are released publicly after the event, including the challenge binaries and FireEye's own write-ups, they remain a durable training resource long after the live competition ends, and later entries in the series built directly on techniques introduced in earlier years.
Why it matters for defenders
The obfuscation and anti-analysis techniques used in these challenges, packing, indirect calls, custom encodings, are the same techniques malware authors use to slow down incident responders. Practising on a CTF binary where the answer is known is a safer way to build the muscle memory needed to recognise those patterns in a live investigation.
Key takeaways
- FLARE-On is FireEye's annual public reverse-engineering competition, aimed at building practical analyst skill
- The 2015 edition had eleven challenges of increasing difficulty covering unpacking, obfuscation and protocol analysis
- Later challenges in a series typically combine techniques introduced in earlier ones
- Public challenge archives remain useful training material well after the live event ends
- The obfuscation techniques practised here mirror what real malware uses to resist analysis
This note has been rewritten and checked for this edition; it is not a copy of the original post.