mandiant / flare-vm

# FLARE-VM
Welcome to FLARE-VM - a collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a virtual machine (VM). FLARE-VM was designed to solve the problem of reverse engineering tool curation and relies on two main technologies: Chocolatey and Boxstarter. Chocolatey is a Windows-based Nuget package management system, where a "package" is essentially a ZIP file containing PowerShell installation scripts that download and configure a specific tool. Boxstarter leverages Chocolatey packages to automate the installation of software and create repeatable, scripted Windows environments.
## Requirements
**FLARE-VM should ONLY be installed on a virtual machine**.
The VM should satisfy the following requirements:
* Windows ≥ 10
* PowerShell ≥ 5
* Disk capacity of at least 60 GB and memory of at least 2GB
* Usernames without spaces or other special characters
* Internet connection
* Tamper Protection and any Anti-Malware solution (e.g., Windows Defender) disabled, preferably via Group Policy
* Windows Updates Disabled
## Installation instruction
This section documents the steps to install FLARE-VM. You may also find useful the _Building a VM for Reverse Engineering and Malware Analysis! Installing the FLARE-VM_ video.
### Pre-installation
* Prepare a Windows 10+ virtual machine
 * Install Windows in the virtual machine, for example using the raw Windows 10 ISO from https://www.microsoft.com/en-us/software-download/windows10ISO
 * Ensure the requirements above are satisfied, including:
 * Disable Windows Updates (at least until installation is finished)
 * https://www.windowscentral.com/how-stop-updates-installing-automatically-windows-10
 * Disable Tamper Protection and any Anti-Malware solution (e.g., Windows Defender), preferably via Group Policy.
 * GPO: https://stackoverflow.com/questions/62174426/how-to-permanently-disable-windows-defender-real-time-protection-with-gpo
 * Non-GPO - Manual: https://www.maketecheasier.com/permanently-disable-windows-defender-windows-10/
 * Non-GPO - Automated: https://github.com/ionuttbara/windows-defender-remover
 * Non-GPO - Semi-Automated (User needs to toggle off Tamper Protection): https://github.com/AveYo/LeanAndMean/blob/main/ToggleDefender.ps1
* Take a VM snapshot so you can always revert to a state before the FLARE-VM installation
* NOTE for IDA Pro: If you are installing IDA Pro via `idapro.vm`, you must place your IDA Pro installer (and optionally, your license file) on the Desktop before running the FLARE-VM installer.
### FLARE-VM installation
* Open a `PowerShell` prompt as administrator
* Download the installation script `installer.ps1` to your Desktop:
 * `(New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")`
* Unblock the installation script:
 * `Unblock-File .\install.ps1`
* Enable script executio