mandiant / VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.
Apache License 2.0
123 stars 61 forks source link

py shortcut icon still broken #1001

Closed Ana06 closed 2 months ago

Ana06 commented 2 months ago

Details

I have just installed ida.diaphora.vm 3.2.0 and the icon of the .py file looks broken:

image

@emtuls hadn't this been addressed in https://github.com/mandiant/VM-Packages/issues/675?

We are planing to change how diaphora is installed (without shortcut): https://github.com/mandiant/VM-Packages/issues/994, so this issue is about ensuring that the .py shortcut look nice and not about fixing diaphora specifically. But I noticed the issue while testing diaphora.

emtuls commented 2 months ago

Strange...I just tried it on a fresh setup and it looks fine for me? 🤔 image

emtuls commented 2 months ago

Ah, so I was mistaken @Ana06. It appeared to work because of my vscode I had installed.

So, this issue is because we opted to go the route of requiring tools that were python based to use python as the executablePath (which will make python the Target for the shortcut), which will in turn make python the icon due to iconLocation being set to executablePath: https://github.com/mandiant/VM-Packages/blob/main/packages/common.vm/tools/vm.common/vm.common.psm1#L228

The downside that this had was that we don't default all Python files to use the Python icon as a shortcut if they are something like ida.diaphora, since it's just a python plugin and we weren't planning to execute it directly with Python.

The other downside is that we have to call VM-Install-Shortcut directly, like such: https://github.com/mandiant/VM-Packages/blob/main/packages/didier-stevens-beta.vm/tools/chocolateyinstall.ps1#L22-L25

An alternative we could do, that I think I may have suggested somewhere, would be to add inside of VM-Install-From-Zip, a check for if the $executableName has an extension of .py, and then we could do:

if ([System.IO.Path]::GetExtension($executableName) -eq ".py") {
    $executablePath = (Get-Command python).Source
    $filePath = Join-Path $toolDir "$toolName.py"
    $arguments = $filePath + $arguments
    $consoleApp = $true
    VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath -consoleApp $consoleApp -arguments $arguments
}

I've just tested that and it would work, if you want to go that route. It will also require adding python3.vm to ida.diaphora.vm since the shortcut relies on having Python existing on the system.

Ana06 commented 2 months ago

Thanks for all the research @emtuls! I do not like the idea of complicating VM-Install-From-Zip just because of one package, specially because diaphora is a very special package (and IDA plugin which we are not installing as a plugin). I think we should focus on https://github.com/mandiant/VM-Packages/issues/994 and close this issue.

emtuls commented 2 months ago

Sounds good!

Just a heads up, if I'm not mistaken, if we start to get more python tools, we will be forced to use VM-Install-Shortcut directly unless we choose to do something like https://github.com/mandiant/VM-Packages/pull/1011 in the future. 🙂