47 lines
1.5 KiB
Markdown
47 lines
1.5 KiB
Markdown
# API Reference: Setting Up an Isolated Malware Analysis Lab
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` reads a VMware `.vmx` file and flags configuration that would break
|
|
isolation of a malware-detonation guest — NAT/bridged networking, enabled clipboard/drag-and-
|
|
drop, and shared folders. It never touches a sample.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | Regex parsing, file IO |
|
|
|
|
## External tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| VMware Workstation/Fusion or VirtualBox | Hypervisor for the victim and services guests |
|
|
| INetSim / FakeNet-NG | Simulated internet services on the analysis guest |
|
|
| REMnux | Linux analysis distribution with INetSim, tcpdump, and RE tooling |
|
|
| FLARE-VM | Windows analysis tooling installer for the victim guest |
|
|
|
|
## Core functions
|
|
|
|
### `parse_vmx(text)`
|
|
Parses `key = "value"` lines from a `.vmx` file into a dict (keys lowercased).
|
|
|
|
### `check_config(config)`
|
|
Returns a list of isolation problems: NAT/bridged adapters, enabled clipboard/DnD, shared
|
|
folders, or a missing adapter definition.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py --check-config vmx/victim.vmx
|
|
```
|
|
|
|
Exit code `1` indicates one or more isolation problems were found.
|
|
|
|
## Sources
|
|
|
|
- INetSim documentation — https://www.inetsim.org/documentation.html
|
|
- FLARE-VM project — https://github.com/mandiant/flare-vm
|
|
- REMnux documentation — https://docs.remnux.org/
|
|
- VMware VMX configuration parameters (vendor documentation)
|