Skip to content

Commit 53e44d3

Browse files
farissfariss
committed
vm.common: add -iconLocation param to VM-Install-From-Zip function
1 parent 87caee3 commit 53e44d3

24 files changed

+179
-84
lines changed

‎packages/capa-explorer-web.vm/capa-explorer-web.vm.nuspec

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
33
<metadata>
44
<id>capa-explorer-web.vm</id>
5-
<version>1.0.0</version>
5+
<version>1.0.0.20241218</version>
66
<authors>Soufiane Fariss</authors>
77
<description>Web interface for exploring and understanding capa results</description>
88
<dependencies>

‎packages/capa-explorer-web.vm/tools/chocolateyinstall.ps1

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,5 @@ $zipUrl = 'https://github.com/mandiant/capa/raw/refs/heads/master/web/explorer/r
77
$zipSha256 = '3a7cf6927b0e8595f08b685669b215ef779eade622efd5e8d33efefadd849025'
88

99
$executableName = "index.html"
10-
VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -executableName $executableName -withoutBinFile -innerFolder $true
10+
$iconName = "favicon.ico"
11+
VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -executableName $executableName -iconLocation $iconName -withoutBinFile -innerFolder $true

‎packages/common.vm/common.vm.nuspec

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
33
<metadata>
44
<id>common.vm</id>
5-
<version>0.0.0.20241209</version>
5+
<version>0.0.0.20241218</version>
66
<description>Common libraries for VM-packages</description>
77
<authors>Mandiant</authors>
88
</metadata>

‎packages/common.vm/tools/vm.common/vm.common.psm1

+7-4
Original file line numberDiff line numberDiff line change
@@ -402,7 +402,9 @@ function VM-Install-From-Zip {
402402
# $powershellCommand = "Get-Content README.md"
403403
# $powershellCommand = "Import-Module module.ps1; Get-Help Main-Function"
404404
[Parameter(Mandatory=$false)]
405-
[string] $powershellCommand
405+
[string] $powershellCommand,
406+
[Parameter(Mandatory=$false)]
407+
[string] $iconLocation
406408
)
407409
try {
408410
$toolDir = Join-Path ${Env:RAW_TOOLS_DIR} $toolName
@@ -432,20 +434,20 @@ function VM-Install-From-Zip {
432434

433435
if ($powershellCommand) {
434436
$executablePath = $toolDir
435-
VM-Install-Shortcut -toolName $toolName -category $category -arguments $powershellCommand -executableDir $executablePath -powershell
437+
VM-Install-Shortcut -toolName $toolName -category $category -arguments $powershellCommand -executableDir $executablePath -powershell -iconLocation $iconLocation
436438
}
437439
elseif ($withoutBinFile) { # Used when tool does not have an associated executable
438440
if (-Not $executableName) { # Tool is located in $toolDir (c3.vm for example)
439441
$executablePath = $toolDir
440442
} else { # Tool is in a specific directory (pma-labs.vm for example)
441443
$executablePath = Join-Path $toolDir $executableName -Resolve
442444
}
443-
VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath
445+
VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath -iconLocation $iconLocation
444446
}
445447
else {
446448
if (-Not $executableName) { $executableName = "$toolName.exe" }
447449
$executablePath = Join-Path $toolDir $executableName -Resolve
448-
VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath -consoleApp $consoleApp -arguments $arguments
450+
VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath -consoleApp $consoleApp -arguments $arguments -iconLocation $iconLocation
449451
Install-BinFile -Name $toolName -Path $executablePath
450452
}
451453
return ,@($toolDir, $executablePath)
@@ -1828,6 +1830,7 @@ function VM-Create-Ico {
18281830
# Delete extracted ZIPS after unzipping them.
18291831
# Useful to extract zipped labs downloaded from GDrive keeping the folder structure.
18301832
function VM-Unzip-Recursively {
1833+
$ErrorActionPreference = 'Continue'
18311834
$desktop = Join-Path ${Env:UserProfile} "Desktop"
18321835
$zip = Get-Item "$desktop\drive-download*.zip"
18331836
if (-Not (Test-Path $zip)) {

‎packages/event-log-explorer.vm/event-log-explorer.vm.nuspec

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
33
<metadata>
44
<id>event-log-explorer.vm</id>
5-
<version>5.5.2.20240908</version>
5+
<version>5.6.0.20241212</version>
66
<authors>FSPro Labs</authors>
77
<description>Software solution for viewing, analyzing and monitoring events recorded in Microsoft Windows event logs.</description>
88
<dependencies>

‎packages/event-log-explorer.vm/tools/chocolateyinstall.ps1

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ $toolName = 'Event Log Explorer'
55
$category = 'Forensic'
66

77
$exeUrl = 'https://eventlogxp.com/download/elex_setup.exe'
8-
$exeSha256 = '8dc2c9d4a620bf421dac9c9bce2ab690798005edbf5d7ccb202717a14f8cc894'
8+
$exeSha256 = '5049c96130396f407197a74fa571f10e4106bd0c13858e717fc11c535fded678'
99

1010
$toolDir = Join-Path ${Env:ProgramFiles(x86)} $toolName
1111
$executablePath = Join-Path $toolDir "elex.exe"

‎packages/fakenet-ng.vm/fakenet-ng.vm.nuspec

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
33
<metadata>
44
<id>fakenet-ng.vm</id>
5-
<version>3.3</version>
5+
<version>3.3.0.20241124</version>
66
<description>FakeNet-NG is a dynamic network analysis tool.</description>
77
<authors>Mandiant</authors>
88
<dependencies>

‎packages/fakenet-ng.vm/tools/default.ini

+3-3
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ DefaultUDPListener: ProxyUDPListener
114114
# NOTE: This setting is only honored when 'RedirectAllTraffic' is enabled.
115115

116116
BlackListPortsTCP: 139
117-
BlackListPortsUDP: 67, 68, 137, 138, 443, 1900, 5355, 53
117+
BlackListPortsUDP: 67, 68, 137, 138, 443, 1900, 5355
118118

119119
# Specify processes to ignore when diverting traffic. Windows example used
120120
# here.
@@ -275,6 +275,7 @@ Listener: HTTPListener
275275
UseSSL: No
276276
Webroot: defaultFiles/
277277
Timeout: 10
278+
#ProcessBlackList: dmclient.exe, OneDrive.exe, svchost.exe, backgroundTaskHost.exe, GoogleUpdate.exe, chrome.exe
278279
DumpHTTPPosts: Yes
279280
DumpHTTPPostsFilePrefix: http
280281
Hidden: False
@@ -345,5 +346,4 @@ Port: 110
345346
Protocol: TCP
346347
Listener: POPListener
347348
UseSSL: No
348-
Hidden: False
349-
349+
Hidden: False

‎packages/ida.plugin.capa.vm/ida.plugin.capa.vm.nuspec

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
33
<metadata>
44
<id>ida.plugin.capa.vm</id>
5-
<version>7.0.1.20240425</version>
5+
<version>8.0.1</version>
66
<description>capa explorer is an IDAPython plugin that integrates capa with IDA Pro.</description>
77
<authors>@mike-hunhoff, @williballenthin, @mr-tz</authors>
88
<dependencies>

‎packages/ida.plugin.capa.vm/tools/chocolateyinstall.ps1

+7-6
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,20 @@ Import-Module vm.common -Force -DisableNameChecking
33

44
try {
55
# Install dependency: capa Python library
6-
VM-Pip-Install "flare-capa"
6+
$version = "8.0.1"
7+
VM-Pip-Install "flare-capa==$version"
78

89
# Install plugin
910
$pluginName = "capa_explorer.py"
10-
$pluginUrl = "https://raw.githubusercontent.com/mandiant/capa/v7.0.1/capa/ida/plugin/capa_explorer.py"
11-
$pluginSha256 = "a9a60d9066c170c4e18366eb442f215009433bcfe277d3c6d0c4c9860824a7d3"
11+
$pluginUrl = "https://raw.githubusercontent.com/mandiant/capa/v$version/capa/ida/plugin/capa_explorer.py"
12+
$pluginSha256 = "bf6c9a0e5fd2c75a93bb3c19e0221c36cda441c878af3c23ea3aafef4fecf3e9"
1213
VM-Install-IDA-Plugin -pluginName $pluginName -pluginUrl $pluginUrl -pluginSha256 $pluginSha256
1314

1415

1516
# Download capa rules
1617
$pluginsDir = VM-Get-IDA-Plugins-Dir
17-
$rulesUrl = "https://github.com/mandiant/capa-rules/archive/refs/tags/v7.0.1.zip"
18-
$rulesSha256 = "f4ed60bcf342007935215ea76175dddfbcbfb3f97d95387543858e0c1ecf8bcd"
18+
$rulesUrl = "https://github.com/mandiant/capa-rules/archive/refs/tags/v$version.zip"
19+
$rulesSha256 = "7c5f932b1da4e18eed50add117e7fc55c14dc51487495cb31e33e0b44c522fbc"
1920
$packageArgs = @{
2021
packageName = ${Env:ChocolateyPackageName}
2122
unzipLocation = $pluginsDir
@@ -24,7 +25,7 @@ try {
2425
checksumType = 'sha256'
2526
}
2627
Install-ChocolateyZipPackage @packageArgs
27-
$rulesDir = Join-Path $pluginsDir "capa-rules-7.0.1" -Resolve
28+
$rulesDir = Join-Path $pluginsDir "capa-rules-$version" -Resolve
2829

2930
# Set capa rules in the capa plugin
3031
$registryPath = 'HKCU:\SOFTWARE\IDAPython\IDA-Settings\capa'

‎packages/ida.plugin.capa.vm/tools/chocolateyuninstall.ps1

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ $pluginPath = Join-Path $pluginsDir "capa_explorer.py"
88
Remove-Item $pluginPath
99

1010
# Delete capa rules
11-
$rulesDir = Join-Path $pluginsDir "capa-rules-6.1.0"
12-
Remove-Item $rulesDir
11+
$rulesDir = Get-ChildItem "$pluginsDir\capa-rules-*"
12+
Remove-Item $rulesDir -Recurse
1313

1414
# Delete registry information
1515
Remove-Item 'HKCU:\SOFTWARE\IDAPython\IDA-Settings\capa'

‎packages/ida.plugin.xrefer.vm/ida.plugin.xrefer.vm.nuspec

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
3+
<metadata>
4+
<id>ida.plugin.xrefer.vm</id>
5+
<version>1.0.0</version>
6+
<description>Custom navigation interface within IDA.</description>
7+
<authors>Muhammad Umair</authors>
8+
<dependencies>
9+
<dependency id="common.vm" version="0.0.0.20241029"/>
10+
<dependency id="libraries.python3.vm" version="0.0.0.20241213"/>
11+
<dependency id="openjdk.vm" />
12+
</dependencies>
13+
</metadata>
14+
</package>

‎packages/libraries-extra.python3.vm/tools/chocolateyinstall.ps1 ‎packages/ida.plugin.xrefer.vm/tools/chocolateyinstall.ps1

+6
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ Import-Module vm.common -Force -DisableNameChecking
44
try {
55
$dependencies = "asciinet,bs4,flare_capa,langchain,langchain_google_genai,langchain_openai,networkx,python-statemachine,requests,tabulate,tenacity"
66
VM-Pip-Install $dependencies
7+
8+
$pluginName = 'xrefer.py'
9+
$pluginUrl = 'https://github.com/mandiant/xrefer/archive/refs/tags/v1.0.0.zip'
10+
$pluginSha256 = '8c1b5cee59674e104e0bac20f908e9b3cf17af25b18b3ed80a845b62b257e7f1'
11+
12+
VM-Install-IDA-Plugin -pluginName $pluginName -pluginUrl $pluginUrl -pluginSha256 $pluginSha256
713
} catch {
814
VM-Write-Log-Exception $_
915
}

‎packages/ida.plugin.xrefer.vm/tools/chocolateyuninstall.ps1

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
$ErrorActionPreference = 'Continue'
2+
Import-Module vm.common -Force -DisableNameChecking
3+
4+
$pluginName = 'xrefer.py'
5+
VM-Uninstall-IDA-Plugin -pluginName $pluginName

‎packages/internet_detector.vm/internet_detector.vm.nuspec

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
33
<metadata>
44
<id>internet_detector.vm</id>
5-
<version>1.0.0.20241112</version>
5+
<version>1.0.0.20241217</version>
66
<authors>Elliot Chernofsky and Ana Martinez Gomez</authors>
77
<description>Tool that changes the background and a taskbar icon if it detects internet connectivity</description>
88
<dependencies>
99
<dependency id="common.vm" version="0.0.0.20241029" />
1010
<dependency id="libraries.python3.vm" version="0.0.0.20240726" />
11-
<dependency id="fakenet-ng.vm" version="3.2.0.20240902" />
11+
<dependency id="fakenet-ng.vm" version="3.3" />
1212
</dependencies>
1313
</metadata>
1414
</package>

‎packages/internet_detector.vm/tools/chocolateyinstall.ps1

+5-6
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,9 @@ Start-Process -FilePath 'cmd.exe' -WorkingDirectory $toolDir -ArgumentList "/c p
2121
$imagesPath = Join-Path $packageToolDir "images"
2222
Copy-Item "$imagesPath\*" ${Env:VM_COMMON_DIR} -Force
2323

24-
VM-Install-Shortcut -toolName $toolName -category $category -executablePath "$toolDir/$toolName.exe"
24+
VM-Install-Shortcut -toolName $toolName -category $category -executablePath "$toolDir\$toolName.exe"
2525

26-
# TODO - Uncomment when FakeNet BlackList for DNS is fixed/addressed. https://github.com/mandiant/flare-fakenet-ng/issues/190
27-
# # Create scheduled task for tool to run every 2 minutes.
28-
# $action = New-ScheduledTaskAction -Execute $rawToolPath
29-
# $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2)
30-
# Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'Internet Detector' -Force
26+
# Create scheduled task for tool to run every 2 minutes.
27+
$action = New-ScheduledTaskAction -Execute "$toolDir\$toolName.exe"
28+
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1)
29+
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'Internet Detector' -Force

0 commit comments

Comments
 (0)