mandiant / flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Apache License 2.0
6.35k stars 896 forks source link

Error "Cannot validate argument on parameter 'Argumentlist'. #461

Closed MnFrozenFish closed 1 year ago

MnFrozenFish commented 1 year ago

I am working on the installation on Windows 10 build 19045. I did set $env:chocolateyVersion = '1.4.0'. I also tried on Window11 MSEdge Evaluation and got exactly the same error. Herewith the snapshot: image

I saw on earlier posts that many have successfully installed flare vm on Windows 11 and I am curious what may have caused the issue above. Thank you

Ana06 commented 1 year ago

I think this error has been introduced in https://github.com/mandiant/VM-Packages/pull/429

MnFrozenFish commented 1 year ago

Thanks. I just tested installation of Flare VM on Win10 19042, it failed at the same point with the same error message.

So, at this point, my attempts with Win11, Win10-19045 and Win10-19042 all stuck at the same point

Ana06 commented 1 year ago

I get the error as well when installing flarevm.installer.vm locally. It seems we are excluding flarevm.installer.vm from the tests (because it install other packages) so that's why the CI didn't catch the error.

Ana06 commented 1 year ago

From the logs:

[2023-06-07T18:14:36.3212050+02:00:::PID 2916] Boxstarter: BoxstarterWrapper::Run(list  -r -y)...
[2023-06-07T18:14:36.3212050+02:00:::PID 2916] Boxstarter: restoring current directory location to C:\Windows\system32
[2023-06-07T18:14:36.3681205+02:00:::PID 2916] 2023/06/07 18:14:36 [flarevm.installer.vm] vm.common.psm1 [+] ERROR : [ERR] Cannot validate argument on parameter 'ArgumentList'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
At C:\ProgramData\boxstarter\Boxstarter.Common\Enter-DotNet4.ps1:38 char:9
+         Invoke-Command -ScriptBlock $ScriptBlock -argumentlist $Argum ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MnFrozenFish commented 1 year ago

Are you suggesting that it is a prerequisite to have "flarevm.installer.vm" installed first before I can have any other packages installed? Prior to the issue being fixed, is there anything I can do to proceed with installation at this point?

mr-tz commented 1 year ago

Slowly looking into this (any help appreciated)!

$installedPackages = choco list -r appears to list ALL available packages, which appears off.

mr-tz commented 1 year ago
$installedPackages = choco list -r
$boxstarerInfo = $installedPackages | Select-String -Pattern "Boxstarter" | Out-String

results in:

jivkok.boxstarter1|1.0.0.4
Boxstarter.WindowsUpdate|1.1.0
Boxstarter.Azure|3.0.1
Boxstarter.TestRunner|3.0.1
boxstarter|3.0.1
boxstarter.bootstrapper|3.0.1
boxstarter.chocolatey|3.0.1
BoxStarter.Common|3.0.1
Boxstarter.HyperV|3.0.1
BoxStarter.WinConfig|3.0.1

likely not what we want

mr-tz commented 1 year ago

Best bet continues to be that the changed choco commands in https://github.com/mandiant/VM-Packages/pull/429/files are causing this. I can continue looking into this tomorrow.

mr-tz commented 1 year ago

Maybe @gep13 can chime in on the commands or if we need to do things differently now with the recent updates.

gep13 commented 1 year ago

In Chocolatey v2.0.0 the default behaviour of choco list was changed to only list locally installed packages. Prior to Chocolatey v2.0.0 choco list would by default search all remote sources, not just locally installed packages. To search for locally installed packages, you would have to use choco list --local-only, (or other alternatives to that option, such as -l).

So to summarize, in Chocolatey v2.0.0 you use choco list to list locally installed packages, and choco search to list packages from remote sources. In earlier versions of Chocolatey, choco list could list both locally installed and remote sources. This was called out in our upgrade guide here: https://docs.chocolatey.org/en-us/guides/upgrading-to-chocolatey-v2-v6#the-list-command-now-lists-local-packages-only-and-the-local-only-and-lo-options-have-been-removed

In the PR that you mention above, you were removing the usage of the chocolatey shim, since this was also removed in v2.0.0, so when seeing that, I suggested that you also correct the usage of choco list for the new default behaviour. If you are still using earlier versions of Chocolatey CLI in some other places, then choco list will be doing searches of remote sources, not just locally installed packages.

Hope that makes sense.

gep13 commented 1 year ago

Reading through the issue, seems like this is the problem:

I did set $env:chocolateyVersion = '1.4.0'.

With that in play, choco list will be doing a search of remote sources, not only locally installed packages.

If you need to support both older and newer versions of Chocolatey CLI, I would suggest that you change the command back to:

choco list -l -r

However, bear in mind that support for -l will be removed completely in future versions of Chocolatey CLI. It was left in place specifically when using -r in Chocolatey CLI v2.0.0, so that folks are not completely broken, and things will keep working, but this support is not guaranteed going forward.

The suggestion that I made in the earlier PR was based on the fact that I believed that you would only be using Chocolatey CLI v2.0.0.

mr-tz commented 1 year ago

Thanks for the details and clarification. We'll want to support v2.0.0 and newer moving forward and I've updated a few other places in the linked PR.

However, the original issue appears to persist in 1.4 and 2.0. Maybe it's a Boxstarter bug or we're using it wrong?

 *** LOADING BOXSTARTER ***
ERROR: Cannot validate argument on parameter 'ArgumentList'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
The install of flarevm.installer.vm was NOT successful.
Error while running 'C:\ProgramData\chocolatey\lib\flarevm.installer.vm\tools\chocolateyinstall.ps1'.
 See log for details.

Chocolatey installed 0/1 packages. 1 packages failed.
 See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).

Failures
 - flarevm.installer.vm (exited -1) - Error while running 'C:\ProgramData\chocolatey\lib\flarevm.installer.vm\tools\chocolateyinstall.ps1'.
 See log for details.
[2023-06-08T10:54:37.1857954+02:00:::PID 3528] Boxstarter: Using current PowerShell...
[2023-06-08T10:54:37.2016138+02:00:::PID 3528] Boxstarter: Current runtime is 4.0.30319.42000
[2023-06-08T10:54:37.2324091+02:00:::PID 3528] Boxstarter: setting current directory location to C:\Users\flare\Desktop
[2023-06-08T10:54:37.2484522+02:00:::PID 3528] Boxstarter: BoxstarterWrapper::Run(list  -r -y)...
[2023-06-08T10:54:37.2484522+02:00:::PID 3528] Boxstarter: restoring current directory location to C:\Users\flare\Desktop
[2023-06-08T10:54:37.3110502+02:00:::PID 3528] 2023/06/08 10:54:37 [flarevm.installer.vm] vm.common.psm1 [+] ERROR : [ERR] Cannot validate argument on parameter 'ArgumentList'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
At C:\ProgramData\boxstarter\Boxstarter.Common\Enter-DotNet4.ps1:38 char:9
+         Invoke-Command -ScriptBlock $ScriptBlock -argumentlist $Argum ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[2023-06-08T10:54:39.8110376+02:00:::PID 6536] Boxstarter: BoxstarterWrapper::Run => 
[2023-06-08T10:54:39.8110376+02:00:::PID 6536] Boxstarter: restoring current directory location to C:\Windows\system32
[2023-06-08T10:54:39.8260647+02:00:::PID 6536] Boxstarter: Exit Code: 0
mr-tz commented 1 year ago

Call-Stack

[2023-06-08T11:27:35.0098028+02:00:::PID 4908] Boxstarter: at Enter-Dotnet4, C:\ProgramData\boxstarter\Boxstarter.Common\Enter-DotNet4.ps1: line 31 at Invoke-LocalChocolatey, C:\ProgramData\boxstarter\Boxstarter.Chocolatey\Chocolatey.ps1: line 487 at Call-Chocolatey, C:\ProgramData\boxstarter\Boxstarter.Chocolatey\Chocolatey.ps1: line 458 at chocolatey, C:\ProgramData\boxstarter\Boxstarter.Chocolatey\Chocolatey.ps1: line 149 at choco, C:\ProgramData\boxstarter\Boxstarter.Chocolatey\Chocolatey.ps1: line 111 at Get-InstalledPackages, C:\ProgramData\chocolatey\lib\flarevm.installer.vm\tools\chocolateyinstall.ps1: line 7 at <ScriptBlock>, C:\ProgramData\chocolatey\lib\flarevm.installer.vm\tools\chocolateyinstall.ps1: line 19 at <ScriptBlock>, C:\ProgramData\chocolatey\helpers\chocolateyScriptRunner.ps1: line 63 at <ScriptBlock>, <No file>: line 1

./Boxstarter.Chocolatey/Chocolatey.ps1:483: Enter-DotNet4 {

function Invoke-LocalChocolatey($chocoArgs) {
    if (Get-IsRemote) {
        $global:Boxstarter.DisableRestart = $true
    }
    Export-BoxstarterVars

    Enter-DotNet4 {
        if ($env:BoxstarterVerbose -eq 'true') {
            $global:VerbosePreference = "Continue"
        }

        Import-Module "$($args[1].BaseDir)\Boxstarter.chocolatey\Boxstarter.chocolatey.psd1" -DisableNameChecking
        Invoke-Chocolatey $args[0]
    } $chocoArgs, $Boxstarter
}

The below error message comes from VM-Write-Log-Exception defined in vm.common.psm1 likely called from VM-Packages\packages\flarevm.installer.vm\tools\chocolateyinstall.ps1.

[2023-06-08T10:54:37.3110502+02:00:::PID 3528] 2023/06/08 10:54:37 [flarevm.installer.vm] vm.common.psm1 [+] ERROR : [ERR] Cannot validate argument on parameter 'ArgumentList'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
At C:\ProgramData\boxstarter\Boxstarter.Common\Enter-DotNet4.ps1:38 char:9
+         Invoke-Command -ScriptBlock $ScriptBlock -argumentlist $Argum ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Not sure I'm on the right track here though and unfortunately have to stop for now.

gep13 commented 1 year ago

Short answer is, I am not sure. Perhaps @mwallner or @flcdrg might be able to provide some better insight here?

mwallner commented 1 year ago

Hey, Yes this is a bug in Boxstarter indeed. most likely somewhere here

I unfortunately will not be in a position to fix this until next week, if you're looking for a solution that will work with your current fixes for choco 2.0 as well as older versions, may I suggest you do something like this?

$installedPackages = @($(Get-ChildItem "${env:ChocolateyInstall}/lib/*/*.nuspec") | Foreach-Object {
                [xml]$nuspec = Get-Content $_.FullName
                @{
                    id      = $nuspec.package.metadata.id
                    version = $nuspec.package.metadata.version
                }
            })
dimfot3 commented 1 year ago

do we have any quick fix for this?

mwallner commented 1 year ago

watch out for Boxstarter 3.0.2 - should be ready soon.

JuanParaCatala commented 1 year ago

image

JuanParaCatala commented 1 year ago

I have tried to downgrade choco to v1.3.0 but I keep getting the same error. Please help!! I thought the issue was with choco v2 and v1.4

Ana06 commented 1 year ago

https://github.com/mandiant/VM-Packages/pull/429 added support for Chocolatey v2 and removed support for Chocolatey < 2. But as there is a bug in Boxstarter that breaks choco list, FLARE-VM doesn't work at the moment for any Chocolatey version.

We have two options:

@mwallner thanks for taking a look into this and for the fix! When can we expect the release of Boxstarter 3.0.2?

@gep13 thanks for the explanations!

mwallner commented 1 year ago

@Ana06 I'd suggest you wait for Boxstarter 3.0.2 (if possible), I think it should only be a matter of a day or two. CC @gep13

dimfot3 commented 1 year ago

This problem should have been resolved, the version Boxstarter 3.0.2 is now available

gep13 commented 1 year ago

It would be great to get confirmation if this problem is now resolved. Has anyone been able to take this for a spin?

Ana06 commented 1 year ago

Installing flare-vm with Boxstarter 3.0.2 and Chocolatey 2.0.0 works 🎉 Thanks everybody for the help and the quick release of the fix! 😊

https://github.com/mandiant/flare-vm/pull/462 requires the newest versions of Boxstarter and Chocolatey and include choco 2.0.0 command fixes.