mandiant / VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.
Apache License 2.0
122 stars 61 forks source link

Update package #1053

Closed naacbin closed 1 month ago

naacbin commented 1 month ago

Update/fix various packages.

I have run all packages except IDA plugins with the new version of IDA.

naacbin commented 1 month ago

The CLI fail because memprocfs.vm is installed after arsenalimagemounter.vm which already install dokan driver within the ZIP.

naacbin commented 1 month ago

Thanks a lot for fixing these packages @naacbin!

The CLI fail because memprocfs.vm is installed after arsenalimagemounter.vm which already install dokan driver within the ZIP.

We need to ensure that all packages install correctly independently on the order and on which other packages are installed. Even if the error was not introduced in this PR, we need to fix it in this PR or prior to merge this PR because if the CI fails, we can't merge the PR and the packages won't be pushed to MyGet by our CI.

Two ideas to fix the issue:

* If `dokan.vm` provides the driver we want to install in `arsenalimagemounter.vm`, remove the ZIP instalation and require `dokan.vm` as dependency in  `arsenalimagemounter.vm`

* Install the ZIP with `-ErrorAction SilentlyContinue` so that it doesn't fail if it is already installed and check that it there afterwards with `VM-Assert-Path`

I have added to arsenalimagemounter.vm, dokan.vm dependency as the ZIP is required for other drivers.

naacbin commented 1 month ago

@naacbin thanks for the changes and explanations!

I have added to arsenalimagemounter.vm, dokan.vm dependency as the ZIP is required for other drivers.

I do not understand this fix. If we need to install the ZIP, why do we need dokan as dependency and how does this fix the failure?

I think the file windbg.msixbundle added in this PR was added by accident (likely when testing #1040). Can you please remove it @naacbin?

The failure come from the fact that the install of dokan is done via MSI package. When an MSI package detect an already installed program, he won't try to "reinstall" it (you can see that with the GUI). The ZIP contains the dokan driver (as well as other) but does not install it via MSI meaning it won't fail. So by adding the dokan dependency to arsenalimagemounter.vm it will first install dokan via MSI and then the ZIP which doesn't fail. I hope it's clear.

Thanks, I push the file without paying attention.

Ana06 commented 1 month ago

@naacbin thanks for the detailed explanation. Now I understand it.

So by adding the dokan dependency to arsenalimagemounter.vm it will first install dokan via MSI and then the ZIP which doesn't fail.

I am ok with this solution! We may want to research if we can improve it, but everything works with this setup.

Ana06 commented 1 month ago

Thanks for all the work @naacbin!

naacbin commented 1 month ago

@Ana06, I have check update_package.py it already seems to replace all version strings in a file thankfully to this line (present in both update_version_url and update_github_url function). However, hayabusa as well as other packages such as upx have a problem when the version for example v2.15.0 is different that the version in the filename hayabusa-2.15.0-win-x64.zip because of the v. The update works only because it will fallback to update_github_url and the updated version is in one of the case of get_increased_version.

From my testing adding v? in the url of update_github_url will allow the update via github without breaking any other package auto updates (but I think a deeper review is required) :