Add ida.plugin.scyllahide.vm

mandiant · Oct 19, 2023 · 49570bf · 49570bf
1 parent 745ce73
commit 49570bf
Show file tree

Hide file tree

Showing 4 changed files with 52 additions and 1 deletion.
diff --git a/packages/common.vm/tools/vm.common/vm.common.psm1 b/packages/common.vm/tools/vm.common/vm.common.psm1
@@ -157,7 +157,7 @@ function VM-Check-Reboot {
     )
     try {
         if (Test-PendingReboot){
-            VM-Write-Log "ERROR" "Host must be rebooted before continuing install of $package.`n"
+            VM-Write-Log "ERROR" "Host must be rebooted before continuing installation of $package.`n"
             Invoke-Reboot
             exit 1
         }

diff --git a/packages/ida.plugin.scyllahide.vm/ida.plugin.scyllahide.vm.nuspec b/packages/ida.plugin.scyllahide.vm/ida.plugin.scyllahide.vm.nuspec
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>ida.plugin.scyllahide.vm</id>
+    <version>1.4</version>
+    <description>ScyllaHide is an advanced open-source x64/x86 user mode Anti-Anti-Debug library.</description>
+    <authors>NtQuery</authors>
+    <dependencies>
+      <dependency id="common.vm" />
+    </dependencies>
+  </metadata>
+</package>
diff --git a/packages/ida.plugin.scyllahide.vm/tools/chocolateyinstall.ps1 b/packages/ida.plugin.scyllahide.vm/tools/chocolateyinstall.ps1
@@ -0,0 +1,30 @@
+$ErrorActionPreference = 'Stop'
+Import-Module vm.common -Force -DisableNameChecking
+
+try {
+	# Download the plugin
+    $toolDir    = Join-Path ${Env:chocolateyPackageFolder} "temp_$([guid]::NewGuid())"
+    $toolUrl    = "https://github.com/x64dbg/ScyllaHide/releases/download/v1.4/ScyllaHide_2023-03-24_13-03.zip"
+    $toolSha256 = "edeb0dd203fd1ef38e1404e8a1bd001e05c50b6096e49533f546d13ffdcb7404"
+    $packageArgs   =
+    @{
+        packageName    = ${Env:ChocolateyPackageName}
+        unzipLocation  = $toolDir
+        url            = $toolUrl
+        checksum       = $toolSha256
+        checksumType   = 'sha256'
+    }
+    Install-ChocolateyZipPackage @packageArgs
+
+	# Install the plugin
+    $pluginsDir = New-Item "$Env:APPDATA\Hex-Rays\IDA Pro\plugins" -ItemType "directory" -Force
+    $pluginPath = Join-Path $toolDir "IDA\HookLibraryx64.dll" -Resolve
+    $configPath = Join-Path $toolDir "IDA\scylla_hide.ini" -Resolve
+    Copy-Item $pluginPath -Destination $pluginsDir
+    Copy-Item $configPath -Destination $pluginsDir
+
+	# Remove the temp installation folder
+	Remove-Item $toolDir -Recurse
+} catch {
+  VM-Write-Log-Exception $_
+}
diff --git a/packages/ida.plugin.scyllahide.vm/tools/chocolateyuninstall.ps1 b/packages/ida.plugin.scyllahide.vm/tools/chocolateyuninstall.ps1
@@ -0,0 +1,9 @@
+$ErrorActionPreference = 'Continue'
+Import-Module vm.common -Force -DisableNameChecking
+
+# Remove the plugin
+$pluginsDir = "$Env:APPDATA\Hex-Rays\IDA Pro\plugins"
+$pluginPath = Join-Path $pluginsDir "HookLibraryx64.dll" -Resolve
+$configPath = Join-Path $pluginsDir "scylla_hide.ini" -Resolve
+Remove-Item $pluginPath
+Remove-Item $configPath