#include "wudetect.h"
/////////////////////////////////////////////////////////////////////////////
// CExpressionParser::dwKeyType
//
//
// Parameters:
//
// Comments :
/////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
//
// Class CExpressionParser
// Function fKeyType
//---------------------------------------------------------------------------
//
// Return Value --- TRUE if key type match made, FALSE if no match made
// Parameter
// TCHAR* szRootType --- [IN] string contains the value of key type
// HKEY* phkey --- [OUT] retrieved key type value
/////////////////////////////////////////////////////////////////////////////
//
// Modified by RogerJ, 03/09/00
// Original Creator Unknown
// Modification --- UNICODE and Win64 ready
//
/////////////////////////////////////////////////////////////////////////////
bool CExpressionParser::fKeyType(TCHAR *szRootType, HKEY *phKey)
{
bool fError = false;
if ( lstrcmpi(HKEY_LOCAL_MACHINE_ROOT, szRootType) == 0 )
{
*phKey = HKEY_LOCAL_MACHINE;
}
else if ( lstrcmpi(HKEY_CURRENT_USER_ROOT, szRootType) == 0 )
{
*phKey = HKEY_CURRENT_USER;
}
else if ( lstrcmpi(HKEY_CLASSES_ROOT_ROOT, szRootType) == 0 )
{
*phKey = HKEY_CLASSES_ROOT;
}
else if ( lstrcmpi(HKEY_CURRENT_CONFIG_ROOT, szRootType) == 0 )
{
*phKey = HKEY_CURRENT_CONFIG;
}
else if ( lstrcmpi(HKEY_USERS_ROOT, szRootType) == 0 )
{
*phKey = HKEY_USERS;
}
else if ( lstrcmpi(HKEY_PERFORMANCE_DATA_ROOT, szRootType) == 0 )
{
*phKey = HKEY_PERFORMANCE_DATA;
}
else if ( lstrcmpi(HKEY_DYN_DATA_ROOT, szRootType) == 0 )
{
*phKey = HKEY_DYN_DATA;
}
else
{
fError = true;
}
return fError;
}
/////////////////////////////////////////////////////////////////////////////
// CExpressionParser::fDetectRegSubStr
// Detect a substring in registry datum.
//
// Form: E=RegSubstr,<SubStr>,<RootKey>,<KeyPath>,<RegValue>,<RegData>
//
// Comments :
/////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
// This function is not modifed to be UNICODE ready, since it is not compiled
/////////////////////////////////////////////////////////////////////////////
#if 0
bool CExpressionParser::fDetectRegSubStr(TCHAR * pszBuf)
{
DWORD dwInstallStatus = DET_NOTINSTALLED;
HKEY hKeyRoot;
HKEY hKey;
DWORD type;
char szTargetKeyName[MAX_PATH];
char szTargetKeyValue[MAX_PATH];
char szKeyMissingStatus[MAX_PATH];
char szData[MAX_PATH];
char szSubStr[MAX_PATH];
char szBuf[MAX_PATH];
// get the registry key name from the components section of the
// CIF file.
if ( FGetCifEntry(pDetection, DETREG_KEY, szBuf, sizeof(szBuf)) &&
(dwKeyType(szBuf, &hKeyRoot, szTargetKeyName, sizeof(szTargetKeyName)) == ERROR_SUCCESS) )
{
if ( RegOpenKeyEx( hKeyRoot,
szTargetKeyName,
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS )
{
if ( FGetCifEntry(pDetection, DETREG_SUBSTR, szBuf, sizeof(szBuf)) &&
(GetStringField2(szBuf, 0, szTargetKeyValue, sizeof(szTargetKeyValue)) != 0) &&
(GetStringField2(szBuf, 1, szKeyMissingStatus, sizeof(szKeyMissingStatus)) != 0) )
{
DWORD size = sizeof(szData);
if ( RegQueryValueEx(hKey,
szTargetKeyValue,
0,
&type,
(BYTE *)szData,
&size) == ERROR_SUCCESS )
{
if ( type == REG_SZ )
{
_strlwr(szData);
// iterate thru the substrings looking for a match.
int index = 2;
while ( GetStringField2(szBuf, index, szSubStr, sizeof(szSubStr)) != 0 )
{
_strlwr(szSubStr);
if ( strstr(szData, szSubStr) != NULL )
{
*pDetection->pdwInstalledVer = 1;
*pDetection->pdwInstalledBuild = 1;
dwInstallStatus = DET_INSTALLED;
goto quit_while;
}
index++;
}
quit_while:;
}
}
else
{
// if we get an error, assume the key does not exist. Note that if
// the status is DETFIELD_NOT_INSTALLED then we don't have to do
// anything since that is the default status.
if ( lstrcmpi(DETFIELD_INSTALLED, szKeyMissingStatus) == 0 )
{
dwInstallStatus = DET_INSTALLED;
}
}
}
RegCloseKey(hKey);
}
}
cleanup:
return dwInstallStatus;
return false;
}
#endif
/////////////////////////////////////////////////////////////////////////////
// CExpressionParser::fMapComparisonToken
// Detect file version.
//
// Form: _E1=FileVer,sysdir,ntdll.dll,=,4.06.00.0407,4.06.00.0407
//
// Comments :
/////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
//
// Class CExpressionParser
// Function fMapComparisonToken
//---------------------------------------------------------------------------
//
// Return Value --- TRUE if a matching is found, FALSE otherwise
// Parameter
// TCHAR* pszComparisonToken --- [IN] the token need to find a match
// enumToken* penToken --- [OUT] token enum value found, if no token found, the value is undetermined
/////////////////////////////////////////////////////////////////////////////
//
// Modified by RogerJ, 03/09/00
// Original Creator Unkown
// Modification --- UNICODE and Win64 ready
//
/////////////////////////////////////////////////////////////////////////////
bool CExpressionParser::fMapComparisonToken(TCHAR *pszComparisonToken,
enumToken *penToken)
{
static TokenMapping grComparisonTokenMap[] =
{
{TEXT("="), COMP_EQUALS},
{TEXT("!="), COMP_NOT_EQUALS},
{TEXT("<"), COMP_LESS_THAN},
{TEXT("<="), COMP_LESS_THAN_EQUALS},
{TEXT(">"), COMP_GREATER_THAN},
{TEXT(">="), COMP_GREATER_THAN_EQUALS}
};
return fMapToken(pszComparisonToken,
sizeof(grComparisonTokenMap)/sizeof(grComparisonTokenMap[0]),
grComparisonTokenMap,
penToken);
}
/////////////////////////////////////////////////////////////////////////////
// CExpressionParser::fMapRootDirToken
// Detect file version.
//
// Form: _E1=FileVer,sysdir,ntdll.dll,=,4.06.00.0407,4.06.00.0407
//
// Comments :
/////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
//
// Class CExpressionParser
// Function fMapRootDirToken
//---------------------------------------------------------------------------
//
// Return Value --- TRUE if a matching is found, FALSE otherwise
// Parameter
// TCHAR* pszRootDirToken --- [IN] the token need to find a match
// enumToken* penToken --- [OUT] token enum value found, if no token found, the value is undetermined
/////////////////////////////////////////////////////////////////////////////
//
// Modified by RogerJ, 03/09/00
// Original Creator Unkown
// Modification --- UNICODE and Win64 ready
//
/////////////////////////////////////////////////////////////////////////////
bool CExpressionParser::fMapRootDirToken(TCHAR *pszRootDirToken, enumToken *penToken)
{
static TokenMapping grDirectoryTokenMap[] =
{
{TEXT("sysdir"), DIR_SYSTEM},
{TEXT("windir"), DIR_WINDOWS},
};
return fMapToken(pszRootDirToken,
sizeof(grDirectoryTokenMap)/sizeof(grDirectoryTokenMap[0]),
grDirectoryTokenMap,
penToken);
}
/////////////////////////////////////////////////////////////////////////////
// CExpressionParser::fMapToken
// Detect file version.
//
// Form: _E1=FileVer,sysdir,ntdll.dll,=,4.06.00.0407,4.06.00.0407
//
// Comments :
/////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
//
// Class CExpressionParser
// Function fMapToken
//---------------------------------------------------------------------------
//
// Return Value --- TRUE if a matching is found, FALSE otherwise
// Parameter
// TCHAR* pszToken --- [IN] the token need to find a match
// int nSize --- [IN] number of tokens to be matched as the template
// TokenMapping grTokenMap[] --- [IN] token template to be matched
// enumToken* penToken --- [OUT] token enum value found, if no token found, the value is undetermined
/////////////////////////////////////////////////////////////////////////////
//
// Modified by RogerJ, 03/09/00
// Original Creator Unkown
// Modification --- UNICODE and Win64 ready
//
/////////////////////////////////////////////////////////////////////////////
bool CExpressionParser::fMapToken(TCHAR *pszToken,
int nSize,
TokenMapping grTokenMap[],
enumToken *penToken)
{
for ( int index = 0; index < nSize; index++ )
{
if ( _tcscmp(pszToken, grTokenMap[index].pszToken) == 0 )
{
*penToken = grTokenMap[index].enToken;
return true;
}
}
return false;
}
/////////////////////////////////////////////////////////////////////////////
// CExpressionParser::fDetectFileVer
// Detect file version.
//
// Form: _E1=FileVer,sysdir,ntdll.dll,=,4.06.00.0407,4.06.00.0407
//
// Comments :
/////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////
//
// Class CExpressionParser
// Function fDetectFileVer
//---------------------------------------------------------------------------
//
// Return Value --- TRUE if version of input files matched the file version in the system, FALSE otherwise
// Parameter
// TCHAR* pszBuf --- [IN] the name of the input file
//////////////////////////////////////////////////////////////////////////////
//
// Modified by RogerJ, 03/09/00
// Original Creator Unkown
// Modification --- UNICODE and Win64 ready
//
/////////////////////////////////////////////////////////////////////////////
const DWORD WU_MAX_COMPARISON_LEN = 3;
const DWORD WU_MAX_VERSION_LEN = 30;
bool CExpressionParser::fDetectFileVer(TCHAR * pszBuf)
{
bool fResult = false;
TCHAR szRootDir[MAX_PATH];
TCHAR szFile[MAX_PATH];
TCHAR szFilePath[MAX_PATH];
TCHAR szComparison[WU_MAX_COMPARISON_LEN];
TCHAR szVersion[WU_MAX_VERSION_LEN];
enumToken enComparisonToken;
enumToken enRootDirToken;
// Get reg root type (HKLM, etc)
if ( (GetStringField2(pszBuf, 1, szRootDir, sizeof(szRootDir)/sizeof(TCHAR)) != 0) &&
(GetStringField2(pszBuf, 2, szFile, sizeof(szFile)/sizeof(TCHAR)) != 0) &&
fMapRootDirToken(szRootDir, &enRootDirToken) )
{
// create the file path
if ( enRootDirToken == DIR_SYSTEM )
{
if ( GetSystemDirectory(szFilePath, sizeof(szFilePath)/sizeof(TCHAR)) == 0 )
return false;
}
else // DIR_WINDOWS
{
if ( GetWindowsDirectory(szFilePath, sizeof(szFilePath)/sizeof(TCHAR)) == 0 )
return false;
}
if (szFilePath[_tcslen(szFilePath)-1]!='\\') _tcscat(szFilePath, TEXT("\\"));
_tcscat(szFilePath, szFile);
if ( (GetStringField2(pszBuf, 3, szComparison, sizeof(szComparison)/sizeof(TCHAR)) != 0) &&
fMapComparisonToken(szComparison, &enComparisonToken) )
{
DWORD dwSize;
DWORD dwReserved;
DWORD dwVer, dwBuild;
VS_FIXEDFILEINFO *pVerInfo;
UINT uLen;
dwSize = GetFileVersionInfoSize(szFilePath, &dwReserved);
if ( dwSize > 0)
{
TCHAR *pbVerInfo = (TCHAR *)malloc(dwSize);
if ( GetFileVersionInfo(szFilePath, dwReserved, dwSize, pbVerInfo) &&
(VerQueryValue(pbVerInfo, TEXT("\\"), (void **)&pVerInfo, &uLen) != 0) )
{
for ( int index = 4;
!fResult && (GetStringField2(pszBuf, index, szVersion, sizeof(szVersion)/sizeof(TCHAR)) != 0);
index++ )
{
fConvertDotVersionStrToDwords(szVersion, &dwVer, &dwBuild);
fResult = fCompareVersion(pVerInfo->dwProductVersionMS,
pVerInfo->dwProductVersionLS,
enComparisonToken,
dwVer,
dwBuild);
}
}
free(pbVerInfo);
}
}
else
// just a file existence check.
fResult = (_taccess(szFilePath, 00) != -1);
}
return fResult;
}