1.5 KiB
1.5 KiB
API Reference: Setting Up an Isolated Malware Analysis Lab
Overview
scripts/analyst.py reads a VMware .vmx file and flags configuration that would break
isolation of a malware-detonation guest — NAT/bridged networking, enabled clipboard/drag-and-
drop, and shared folders. It never touches a sample.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | Regex parsing, file IO |
External tools
| Tool | Purpose |
|---|---|
| VMware Workstation/Fusion or VirtualBox | Hypervisor for the victim and services guests |
| INetSim / FakeNet-NG | Simulated internet services on the analysis guest |
| REMnux | Linux analysis distribution with INetSim, tcpdump, and RE tooling |
| FLARE-VM | Windows analysis tooling installer for the victim guest |
Core functions
parse_vmx(text)
Parses key = "value" lines from a .vmx file into a dict (keys lowercased).
check_config(config)
Returns a list of isolation problems: NAT/bridged adapters, enabled clipboard/DnD, shared folders, or a missing adapter definition.
Usage
python scripts/analyst.py --check-config vmx/victim.vmx
Exit code 1 indicates one or more isolation problems were found.
Sources
- INetSim documentation — https://www.inetsim.org/documentation.html
- FLARE-VM project — https://github.com/mandiant/flare-vm
- REMnux documentation — https://docs.remnux.org/
- VMware VMX configuration parameters (vendor documentation)