mandiant / VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.
Apache License 2.0
140 stars 62 forks source link

IDA Free download issue in future >= 9.0 #1150

Open wand3rlust opened 2 weeks ago

wand3rlust commented 2 weeks ago

What's the problem?

Recently Hex Rays has changed their download methods and put the links behind account portal. It involves registering an account and obtaining a license (even for IDA Free). The license is required when IDA is run for the first time.

Right now the IDA version getting installed with Flare VM is 8.4 and link mentioned here is working for the time being until they pull the plug. I fuzzed the link hoping to find 9.0 version, however got 404s so it's likely the new version is not hosted there.

We need to figure out a way to use the new download links (as the new links point to a S3 bucket which requires authentication tokens) or continue using the 8.4 version.

Steps to Reproduce

N/A

Environment

N/A

Additional Information

No response

Detected by test suite

No

wand3rlust commented 2 weeks ago

For more clarity:

Right now the installer pulls the binary from a download link structured like this: https[://]out7.hex-rays[.]com/files/idafree{VERSION-NUMBER}_windows.exe (for e.g: https://out7.hex-rays.com/files/idafree84_windows.exe).

However this link structure does not appear to host the current IDA version which is 9.0. To download the latest binaries (> 8.4) now, one has to register an account with Hex Rays and obtain the binary from their download centre (which appends unique AWS token to the download links). Also note that the download links won't appear in the download centre unless a license is obtained first.

So the download flow for new versions (> 8.4) of IDA is as follows:-

Step 1: Register an account with Hex Rays with an email address. Step 2: Obtain a license from their Shop page. Step 3: Download binaries from the download centre.

mr-tz commented 2 weeks ago

Thanks for the research and details here. If that's the only way moving forward it seems like we won't be able to provide future packages for IDA free :(

Ana06 commented 1 week ago

Thanks for the information @wand3rlust. IDA 9.0 has been released just a few days ago, so the way it is released may change in the future. Let's hope that HexRays will make IDA Free 9 easily available before removing IDA Free 8.4 download link so that we can continue to install it in FLARE-VM.

Ana06 commented 1 week ago

Removing the bug label, as nothing is broken at the moment and we depend on HexRays to be able to update to IDA Free 9.0.