$ show mandiant/flare-vm
FLARE-VM is a collection of PowerShell and Python scripts for automating the setup of a Windows-based reverse engineering virtual machine. The core installer (`install.ps1`) uses Chocolatey and Boxstarter to deploy a curated set of malware analysis tools, configure environment variables, registry settings, and taskbar layout. It provides both a GUI and CLI mode for package selection. The repository also includes a set of VirtualBox helper scripts (`virtualbox/`) for building, exporting, and cleaning VM snapshots, as well as monitoring network adapter status. These scripts are well-structured and can be reused independently for VirtualBox automation. The project is actively maintained by Mandiant (Google) and serves the malware analysis community.
The LLM identified 3 files worth highlighting for reuse:
A reusable Python module providing common functions for VirtualBox management via VBoxManage. It handles command execution with environment cleanup for PyInstaller bundles, guest control with retry logic, host-only interface management, snapshot operations (restore, take, rename), VM state checks, and OVA export with SHA256 generation. The module is well-documented, handles errors gracefully, and is isolated from FLARE-VM-specific logic, making it suitable for extraction into other VirtualBox automation projects.
A standalone script that deletes VirtualBox snapshots recursively, with the ability to protect snapshots containing specified substrings in their names. It parses the snapshot tree from VBoxManage output, allows specifying a root snapshot, and deletes children in reverse order to avoid dependency issues. The script includes user confirmation and handles running VM states gracefully. Its pattern of recursive deletion with protection is reusable for any VirtualBox snapshot management task.
A script that checks the network adapter configuration of all VirtualBox VMs and optionally disables non-allowed adapter types (e.g., NAT, bridged) for VMs with '.dynamic' in their name. It uses PyGObject for desktop notifications and integrates with vboxcommon for VBoxManage calls. The pattern of monitoring and automatically correcting VM network settings is reusable for security or lab environments.