search

mandiant / VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.
Apache License 2.0
123 stars 61 forks source link

Add IDA plugins helper functions & templates to script #1013

Closed Ana06 closed 2 months ago

Ana06 commented 2 months ago

Introduce VM-Install-IDA-plugin, VM-Uninstall-IDA-Plugin, and VM-Get-IDA-Plugins-Dir helper functions in common.vm to simplify IDA plugins installation. Use the new VM-Install-IDA-plugin and VM-Get-IDA-Plugins-Dir functions in ida.plugin.capa.vm.

Add support for simple IDA plugins which just download one single file to the plugins directory to our create_package_template.py script. This template can also be used as base for more complicated plugins. See ida.plugin.capa.vm for an example.

Use the new IDA plugin template in create_package_template.py to generate ida.plugin.sigmaker.vm:

python3 scripts/utils/create_package_template.py --type IDA_PLUGIN --pkg_name "ida.plugin.sigmaker" --version "1.0.2" --authors "A200K" --description "Signature Maker Plugin for IDA Pro 8.3." --tool_name "SigMaker64.dll" --target_url "https://github.com/A200K/IDA-Pro-SigMaker/releases/download/v1.0.2/SigMaker64.dll" --target_hash "0b44921a2fc35f13a2987fcf8830685d58f9d18bca760a9706ec4efe8b0d5d2f"

First step for https://github.com/mandiant/VM-Packages/issues/996

We should close the actual PR adding plugins (which have been opened for more than 2 months). https://github.com/mandiant/VM-Packages/pull/913 adds an older version of the sample plugin and all of the PRs would need to be updated to use the new helpers.

Closes https://github.com/mandiant/VM-Packages/pull/914 Closes https://github.com/mandiant/VM-Packages/pull/913 Closes https://github.com/mandiant/VM-Packages/pull/911

Ana06 commented 2 months ago

@mandiant/flare-vm opinions on adding ida.plugin.sigmaker.vm to the default configuration?