Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the Time Travel Debugging CLI package #1092

Merged
merged 1 commit into from
Jun 24, 2024

Conversation

d35ha
Copy link
Member

@d35ha d35ha commented Jun 13, 2024

Closes #965.

@d35ha d35ha self-assigned this Jun 13, 2024
@d35ha d35ha added 🆕 package New package request/idea/PR 🌀 FLARE-VM A package or feature to be used by FLARE-VM labels Jun 13, 2024
@d35ha d35ha requested a review from Ana06 June 13, 2024 15:18
@d35ha d35ha force-pushed the time-travel-debugging-cli branch from ab1ee9b to 78f6886 Compare June 13, 2024 15:20
@d35ha d35ha added this to the FLARE-VM 2024 Q2 milestone Jun 13, 2024
@d35ha d35ha force-pushed the time-travel-debugging-cli branch 2 times, most recently from b17636f to b77acb1 Compare June 13, 2024 15:54
@emtuls
Copy link
Member

emtuls commented Jun 14, 2024

Installs correctly and works well!

I want to make sure @Ana06 checks it over to agree that it will work with this method rather than needing to use VM-Assert-Signature like she had suggested here: #965 (comment)

If this URL format works for future updates, then I think it should be good to go. :)

packages/ttd-cli.vm/ttd-cli.vm.nuspec Outdated Show resolved Hide resolved
packages/ttd-cli.vm/ttd-cli.vm.nuspec Outdated Show resolved Hide resolved
packages/ttd-cli.vm/tools/chocolateyinstall.ps1 Outdated Show resolved Hide resolved
packages/ttd-cli.vm/tools/chocolateyinstall.ps1 Outdated Show resolved Hide resolved
# Attempt to remove temporary directory
Remove-Item $tempDownloadDir -Recurse -Force -ea 0

VM-Install-Shortcut -toolName $toolName -category $category -executablePath "$toolName.exe" -consoleApp $true -runAsAdmin
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about adding an icon? 😄

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This tool doesn't have an icon, it's using the default executable icon.

@d35ha d35ha force-pushed the time-travel-debugging-cli branch 4 times, most recently from ca09758 to db84bb5 Compare June 14, 2024 18:59
$bundleUrl = "https://windbg.download.prss.microsoft.com/dbazure/prod/1-11-319-0/TTD.msixbundle"
$bundleSha256 = "f7b80731c3a6994b3763c4100073b101965327d6556fa4bfb553d70ce49be366"
$bundlePath = Join-Path ${Env:TEMP} "$($toolName)_1-11-319-0.msixbundle"
Get-ChocolateyWebFile -PackageName $toolName -FileFullPath $bundlePath -Url $bundleUrl -Checksum $bundleSha256 -ChecksumType "sha256"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] I would prefer to use the $packageArgs = @{} syntax for consistency with other packages

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In #1058 I have done it like below :

$packageArgs = @{
    packageName   = ${Env:ChocolateyPackageName}
    url           = $bundleUrl
    checksum      = $bundleSha256
    checksumType  = "sha256"
    fileFullPath  = Join-Path ${Env:TEMP} "$toolName.msixbundle"
}

Get-ChocolateyWebFile @packageArgs
Add-AppxPackage -Path $packageArgs.fileFullPath

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@naacbin Done.

@Ana06
Copy link
Member

Ana06 commented Jun 18, 2024

@naacbin can you take a look at this PR? It is similar to windbg that you are refactoring in @1058, so ideally the code of the th two packages should look very similar.

@Ana06 Ana06 requested review from naacbin and emtuls June 18, 2024 10:56
# From https://aka.ms/ttd/download
$bundleUrl = "https://windbg.download.prss.microsoft.com/dbazure/prod/1-11-319-0/TTD.msixbundle"
$bundleSha256 = "f7b80731c3a6994b3763c4100073b101965327d6556fa4bfb553d70ce49be366"
$bundlePath = Join-Path ${Env:TEMP} "$($toolName)_1-11-319-0.msixbundle"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it's necessary to specify the version here. Join-Path ${Env:TEMP} "$toolName.msixbundle" is enough.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, it will need less changes when updating

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@naacbin Done.

@d35ha d35ha force-pushed the time-travel-debugging-cli branch from db84bb5 to fc6f73a Compare June 24, 2024 06:46
Copy link
Member

@Ana06 Ana06 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the work @d35ha!

@Ana06 Ana06 merged commit 8238f34 into mandiant:main Jun 24, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🌀 FLARE-VM A package or feature to be used by FLARE-VM 🆕 package New package request/idea/PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add Windows Time Travel Debugging Cli
4 participants