FLARE-VM : A Comprehensive Guide To Establishing A Reverse Engineering Lab On Windows

Welcome to FLARE-VM – a collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a virtual machine (VM).

FLARE-VM was designed to solve the problem of reverse engineering tool curation and relies on two main technologies: Chocolatey and Boxstarter.

Chocolatey is a Windows-based Nuget package management system, where a “package” is essentially a ZIP file containing PowerShell installation scripts that download and configure a specific tool.

Boxstarter leverages Chocolatey packages to automate the installation of software and create repeatable, scripted Windows environments.

Requirements

FLARE-VM should ONLY be installed on a virtual machine. The VM should satisfy the following requirements:

• Windows >= 10
• PowerShell >= 5
• Disk capacity of at least 60 GB and memory of at least 2GB
• Usernames without spaces or other special characters
• Internet connection
• Tamper Protection and any Anti-Malware solution (e.g., Windows Defender) Windows Defender disabled, preferably via Group Policy
• Windows Updates Disabled

FLARE-VM Installation

• Open a PowerShell prompt as administrator
• Download the installation script installer.ps1 to your Desktop:
  • (New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")
• Unblock the installation script:
  • Unblock-File .\install.ps1
• Enable script execution:
  • Set-ExecutionPolicy Unrestricted -Force
    • If you receive an error saying the execution policy is overridden by a policy defined at a more specific scope, you may need to pass a scope in via Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force. To view execution policies for all scopes, execute Get-ExecutionPolicy -List
• Finally, execute the installer script as follow:
  • .\install.ps1
    • To pass your password as an argument: .\install.ps1 -password <password>
    • To use the CLI-only mode with minimal user interaction: .\install.ps1 -password <password> -noWait -noGui
    • To use the CLI-only mode with minimal user interaction and a custom config file: .\install.ps1 -customConfig <config.xml> -password <password> -noWait -noGui
• After installation it is recommended to switch to host-only networking mode and take a VM snapshot

For more information click here.