flare-dbg is a project meant to aid malware reverse engineers in rapidly developing debugger scripts.
- Install the
pykdwindbg extension from: https://pykd.codeplex.com/releases
- Download the Bootstrapper dll.
- Add the Bootstrapper pykd.dll file into your winext directory. Something like
%ProgramFiles%\Debugging Tools for Windows\winext.
- Install the latest 0.3.x version of pykd using
pip install pykd.
- Ensure you can import
pykdfrom within windbg:
pip install winappdbg
- Install vivisect using one of the following options:
1. Install source using pip:
pip install https://github.com/williballenthin/vivisect/zipball/master2. Download and extract upstream vivisect and set
PYTHONPATHto the extracted directory.
- Ensure you can import vivisect from a python shell:
- Install flaredbg using
There are two options for running scripts:
- Create a script directory and set
PYTHONPATHto the newly created script directory and add your scripts here.
- Copy scripts to the root of your windbg directory. Something like:
%ProgramFiles%\Debugging Tools for Windows\. Once your script path is setup, scripts are run from the windbg console as follows:
> .load pykd > !py <script_name>
Installing and running plugins
The recommended way to install scripts is to add the plugins directory of this project to your
Another option is to follow the second option described above in the
Running scripts section. Simply copy the plugin scripts to the root of your windbg directory.