Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more useful tools to Flare default #584

Merged
merged 1 commit into from
Apr 22, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion config.xml
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,10 @@
</envs>
<packages>
<package name="010editor.vm"/>
<package name="7zip-15-05.vm"/>
<package name="7zip.vm"/>
<package name="apimonitor.vm"/>
<package name="apktool.vm"/>
<package name="bindiff.vm"/>
<package name="blobrunner.vm"/>
<package name="blobrunner64.vm"/>
<package name="bytecodeviewer.vm"/>
Expand All @@ -31,6 +32,7 @@
<package name="dotnet3.5"/> <!-- To run old .NET binaries -->
<package name="explorersuite.vm"/>
<package name="extreme_dumper.vm"/>
<package name="ezviewer.vm"/>
<package name="fakenet-ng.vm"/>
<package name="file.vm"/>
<package name="floss.vm"/>
Expand All @@ -39,6 +41,7 @@
<package name="hashmyfiles.vm"/>
<package name="hollowshunter.vm"/>
<package name="hxd.vm"/>
<package name="ida.diaphora.vm"/>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this tool and would like it in the VM. But it just copies the file into the VM instead of installing it as plugin. I thought this may be confusing and that's the reason it hasn't been added to the default config before. There is an issue to explore installing it as a plugin: mandiant/VM-Packages#994 Should we wait for that or would you prefer to add the current version now?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think adding it now is fine, since it isn't effecting anything and gives the user the ability to play with it in its current state while also allowing it to be updated in the future if the package changes, without us needing to modify this config again. :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we would need to change the config as the name of the package would change, but is not a big thing. 😄

<package name="ida.plugin.capa.vm"/>
<package name="idafree.vm"/>
<package name="idr.vm"/>
Expand All @@ -48,6 +51,7 @@
<package name="innounp.vm"/>
<package name="isd.vm"/>
<package name="libraries.python3.vm"/>
<package name="magika.vm"/>
<package name="malware-jail.vm"/>
<package name="map.vm"/>
<package name="nasm.vm"/>
Expand All @@ -59,13 +63,15 @@
<package name="notepadpp.plugin.xmltools.vm"/>
<package name="offvis.vm"/>
<package name="onenoteanalyzer.vm"/>
<package name="pdbresym.vm"/>
<package name="pdfstreamdumper.vm"/>
<package name="pebear.vm"/>
<package name="peid.vm"/>
<package name="pesieve.vm"/>
<package name="pestudio.vm"/>
<package name="pkg-unpacker.vm"/>
<package name="pma-labs.vm"/>
<package name="procdot.vm"/>
<package name="processdump.vm"/>
<package name="reg_export.vm"/>
<package name="regshot.vm"/>
Expand All @@ -81,6 +87,7 @@
<package name="upx.vm"/>
<package name="vcbuildtools.vm"/>
<package name="vcredist-all"/>
<package name="vscode.vm"/>
<package name="windbg.vm"/>
<package name="windows-terminal.vm"/>
<package name="wireshark.vm"/>
Expand Down