oalabs

Reverse Engineering Lab Setup

Added 2024-10-15 21:22:00 +0000 UTC

If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials.

About FlareVM

If you have been with us for a while you may remember that we used to recommend FlareVM. It's still a great idea, and if you want to use their full suite of tools you can follow their install guide here FLARE-VM. However, after a few years of troubleshooting buggy installs (mostly NOT the fault of the installer) we realized that we actually only use about 5 tools out of the 100 installed.

About MacOS Mx ARM Hosts

If you have a Mac host that is running an ARM Mx series CPU you will need to take a few points into consideration. First, we highly recommend that you use ARM Windows 11 as your VM guest, and that you use the VMWare Fusion hypervisor. This setup has given us the least amount of issues, and for your static analysis VM the difference will be mostly unnoticeable. However, for dynamic analysis, specifically debugging Intel x64 malware, there are some gotchas. We will be discussion this in more detail soon but for now you can refer to our most recent (and still relevant) explainer M1 Mac Malware Analysis VM Setup with Windows 11, and our older (slightly out of date) tutorial Apple M1 Mac Malware Analysis Lab (Windows 11).

Hypervisor Setup

We recommend using VMWare, it is what we use locally, but it is a commercial product that costs a bit so if you want to put in the effort (QEMU) or deal with the bugs (VBOX) there are alternatives.

We do use QEMU in production and if you ware interested in putting in a bit of effort up front we can highly recommend this install tutorial from c3rb3ru5, Kernel Virtual Machine (KVM) TLS Decryption Tips and Favourite Tools.

⚠️ UPDATE: Since Broadcom purchased VMWare they have made it very difficult to download the product, however the non-pro versions are now FREE! You can use the following links to find the VMWare products on the Broadcom site -- you must be logged in with a (free) Broadcom account first!

Fusion

https://support.broadcom.com/group/ecx/productdetails?productName=VMware%20Fusion

Workstation (Windows)

https://support.broadcom.com/group/ecx/productdetails?productName=VMware%20Workstation%20Pro

Windows OS Setup

Windows media can be downloaded from the following sources. We recommend Windows 10 as disabling Defender is simpler and the OS is better understood but personally we use both.

Disable Windows Defender

Since you will be storing and running malware on your VMs we strongly recommend disabling Windows Defender. We used to include guides on disabling defender that quickly became out of date as new patches were released. Currently the best way to find a guide is to just google with the Windows version and service pack that you have installed. Be warned, later builds of Windows 10 are tricky and Windows 11 is even worse! The following are some references that may be of assistance.

Disable Windows Updates

We recommend disabling windows updates on your VMs as this will ensure a stable repeatable environment, and it will prevent the update traffic and processes from cluttering up your dynamic analysis results. Much like Defender updates have become increasingly tricky to disable, googling with the Windows version and service pack is likely to yield the best results. The following are some references that may be of assistance.