flare-vm

FLARE-VM is an open-source project by Mandiant that provides a collection of PowerShell installation scripts designed to set up and maintain a reverse engineering environment on Windows virtual machines. The project addresses the challenge of reverse engineering tool curation by relying on two key technologies: Chocolatey, a Windows-based NuGet package management system where each package is essentially a ZIP file containing PowerShell installation scripts, and Boxstarter, which leverages Chocolatey packages to automate software installation and create repeatable, scripted Windows environments. The tool is intended exclusively for use on virtual machines running Windows 10 or later, with PowerShell 5 or higher, at least 60 GB of disk space, and 2 GB of RAM. Users must disable Tamper Protection and anti-malware solutions (such as Windows Defender), preferably via Group Policy, and disable Windows Updates before installation. A VM snapshot is recommended prior to installation to allow reverting to a pre-installation state. Installation involves downloading the installer.ps1 script to the desktop, unblocking it, enabling script execution with Set-ExecutionPolicy, and running it as an administrator. The installer supports various CLI parameters including password specification for reboot resiliency, custom configuration files, custom taskbar layouts, and options to skip the GUI, wait messages, reboots, or validation checks. A graphical installer interface is displayed after validation checks and initial Boxstarter/Chocolatey installation, allowing users to customize package selection from FLARE-VM and Chocolatey community packages, as well as environment variable paths. The project uses a config.xml file to define the default configuration, including the list of packages to install and environment variable paths. Users can provide their own configuration via the -customConfig parameter, specifying either a local file path or URL. The taskbar layout is defined in CustomStartLayout.xml, which can also be customized via the -customLayout parameter. Items in the layout XML that are not installed will not display, and only applications or shortcuts to applications can be pinned. Post-installation steps can be included in the configuration through XML tags for apps, services, path-items, registry-items, and custom-items, allowing users to customize system settings such as showing known file extensions. The project provides troubleshooting guidance including log file locations (%VM_COMMON_DIR%\log.txt, Chocolatey logs, and Boxstarter logs) and common package failure reasons such as download timeouts, IDS/AV interference, host-specific issues, build dependency failures, outdated tool URLs, and SHA256 hash mismatches. The project is licensed under Apache 2.0, and users must review and comply with the license terms of each downloaded package. The project also maintains a mailing list for community announcements and encourages contributions through a CONTRIBUTING guide.