From d5401b211c59277da26b878bc58c47e126ae0017 Mon Sep 17 00:00:00 2001
From: vm-packages <vm-packages@mandiant.com>
Date: Thu, 13 Jul 2023 01:30:15 +0000
Subject: [PATCH 1/3] Add processhacker.vm

Closes https://github.com/mandiant/VM-Packages/issues/565.
---
 .../processhacker.vm/processhacker.vm.nuspec     | 13 +++++++++++++
 .../processhacker.vm/tools/chocolateyinstall.ps1 | 16 ++++++++++++++++
 .../tools/chocolateyuninstall.ps1                |  7 +++++++
 3 files changed, 36 insertions(+)
 create mode 100644 packages/processhacker.vm/processhacker.vm.nuspec
 create mode 100644 packages/processhacker.vm/tools/chocolateyinstall.ps1
 create mode 100644 packages/processhacker.vm/tools/chocolateyuninstall.ps1

diff --git a/packages/processhacker.vm/processhacker.vm.nuspec b/packages/processhacker.vm/processhacker.vm.nuspec
new file mode 100644
index 000000000..724737c46
--- /dev/null
+++ b/packages/processhacker.vm/processhacker.vm.nuspec
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>processhacker.vm</id>
+    <version>2.39</version>
+    <authors>Wen Jia Liu</authors>
+    <description>A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.</description>
+    <dependencies>
+      <dependency id="common.vm" />
+      <dependency id="processhacker" version="[2.39]" />
+    </dependencies>
+  </metadata>
+</package>
diff --git a/packages/processhacker.vm/tools/chocolateyinstall.ps1 b/packages/processhacker.vm/tools/chocolateyinstall.ps1
new file mode 100644
index 000000000..74fb8a809
--- /dev/null
+++ b/packages/processhacker.vm/tools/chocolateyinstall.ps1
@@ -0,0 +1,16 @@
+$ErrorActionPreference = 'Stop'
+Import-Module vm.common -Force -DisableNameChecking
+
+try {
+  $toolName = 'ProcessHacker'
+  $category = 'Utilities'
+  $shimPath = 'C:\Program Files\Process Hacker 2\ProcessHacker.exe'
+
+  $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category
+  $shortcut = Join-Path $shortcutDir "$toolName.lnk"
+  $executablePath = Join-Path ${Env:ChocolateyInstall} $shimPath -Resolve
+  Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $executablePath -RunAsAdmin
+  VM-Assert-Path $shortcut
+} catch {
+  VM-Write-Log-Exception $_
+}
diff --git a/packages/processhacker.vm/tools/chocolateyuninstall.ps1 b/packages/processhacker.vm/tools/chocolateyuninstall.ps1
new file mode 100644
index 000000000..088f50b7b
--- /dev/null
+++ b/packages/processhacker.vm/tools/chocolateyuninstall.ps1
@@ -0,0 +1,7 @@
+$ErrorActionPreference = 'Continue'
+Import-Module vm.common -Force -DisableNameChecking
+
+$toolName = 'ProcessHacker'
+$category = 'Utilities'
+
+VM-Remove-Tool-Shortcut $toolName $category

From 898579eb4ce9edbf059f65258ecd455f4e0aa41e Mon Sep 17 00:00:00 2001
From: nos3curity <72961537+nos3curity@users.noreply.github.com>
Date: Wed, 12 Jul 2023 18:32:08 -0700
Subject: [PATCH 2/3] deleting shortcut

---
 packages/processhacker.vm/tools/chocolateyinstall.ps1 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/packages/processhacker.vm/tools/chocolateyinstall.ps1 b/packages/processhacker.vm/tools/chocolateyinstall.ps1
index 74fb8a809..4e1f98361 100644
--- a/packages/processhacker.vm/tools/chocolateyinstall.ps1
+++ b/packages/processhacker.vm/tools/chocolateyinstall.ps1
@@ -11,6 +11,12 @@ try {
   $executablePath = Join-Path ${Env:ChocolateyInstall} $shimPath -Resolve
   Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $executablePath -RunAsAdmin
   VM-Assert-Path $shortcut
+
+  # Delete Desktop shortcut
+  $desktopShortcut = Join-Path ${Env:Public} "Desktop\Process Hacker 2.lnk"
+  if (Test-Path $desktopShortcut) {
+    Remove-Item $desktopShortcut -Force -ea 0
+  }
 } catch {
   VM-Write-Log-Exception $_
 }

From 8b54c6b26f89515fd5bc1faa3b875e30203cccc1 Mon Sep 17 00:00:00 2001
From: nos3curity <72961537+nos3curity@users.noreply.github.com>
Date: Wed, 12 Jul 2023 18:33:31 -0700
Subject: [PATCH 3/3] fixed exe path

---
 packages/processhacker.vm/tools/chocolateyinstall.ps1 | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/processhacker.vm/tools/chocolateyinstall.ps1 b/packages/processhacker.vm/tools/chocolateyinstall.ps1
index 4e1f98361..20dd9e3bb 100644
--- a/packages/processhacker.vm/tools/chocolateyinstall.ps1
+++ b/packages/processhacker.vm/tools/chocolateyinstall.ps1
@@ -4,11 +4,10 @@ Import-Module vm.common -Force -DisableNameChecking
 try {
   $toolName = 'ProcessHacker'
   $category = 'Utilities'
-  $shimPath = 'C:\Program Files\Process Hacker 2\ProcessHacker.exe'
 
   $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category
   $shortcut = Join-Path $shortcutDir "$toolName.lnk"
-  $executablePath = Join-Path ${Env:ChocolateyInstall} $shimPath -Resolve
+  $executablePath = Join-Path ${Env:ProgramFiles} "\Process Hacker 2\ProcessHacker.exe" -Resolve
   Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $executablePath -RunAsAdmin
   VM-Assert-Path $shortcut