README

FLARE-VM
Welcome to FLARE-VM - a collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a virtual machine (VM). FLARE-VM was designed to solve the problem of reverse engineering tool curation and relies on two main technologies: Chocolatey and Boxstarter. Chocolatey is a Windows-based Nuget package management system, where a "package" is essentially a ZIP file containing PowerShell installation scripts that download and configure a specific tool. Boxstarter leverages Chocolatey packages to automate the installation of software and create repeatable, scripted Windows environments.


  


 Requirements
FLARE-VM should ONLY be installed on a virtual machine.
The VM should satisfy the following requirements:

 Windows ≥ 10
 PowerShell ≥ 5
 Disk capacity of at least 60 GB and memory of at least 2GB
 Usernames without spaces or other special characters
 Internet connection
 Tamper Protection and any Anti-Malware solution (e.g., Windows Defender) disabled, preferably via Group Policy
 Windows Updates Disabled

 Installation instruction
This section documents the steps to install FLARE-VM. You may also find useful the _Building a VM for Reverse Engineering and Malware Analysis! Installing the FLARE-VM_ video.

 Pre-installation
 Prepare a Windows 10+ virtual machine
   Install Windows in the virtual machine, for example using the raw Windows 10 ISO from https://www.microsoft.com/en-us/software-download/windows10ISO
   Ensure the requirements above are satisfied, including:
     Disable Windows Updates (at least until installation is finished)
       https://www.windowscentral.com/how-stop-updates-installing-automatically-windows-10
     Disable Tamper Protection and any Anti-Malware solution (e.g., Windows Defender), preferably via Group Policy.
       GPO: https://stackoverflow.com/questions/62174426/how-to-permanently-disable-windows-defender-real-time-protection-with-gpo
       Non-GPO - Manual: https://www.maketecheasier.com/permanently-disable-windows-defender-windows-10/
       Non-GPO - Automated: https://github.com/ionuttbara/windows-defender-remover
       Non-GPO - Semi-Automated (User needs to toggle off Tamper Protection): https://github.com/AveYo/LeanAndMean/blob/main/ToggleDefender.ps1
 Take a VM snapshot so you can always revert to a state before the FLARE-VM installation
 NOTE for IDA Pro: If you are installing IDA Pro via idapro.vm, you must place your IDA Pro installer (and optionally, your license file) on the Desktop before running the FLARE-VM installer.

 FLARE-VM installation
 Open a PowerShell prompt as administrator
 Download the installation script installer.ps1 to your Desktop:
   (New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")
 Unblock the installation script:
   Unblock-File .\install.ps1
 Enable script execution: