80 lines
2.3 KiB
C++
80 lines
2.3 KiB
C++
#include "wudetect.h"
|
|
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
// CExpressionParser::fDetectRegKeyVersion
|
|
// Detect a substring in registry datum.
|
|
//
|
|
// Form: E=RegKeyVersion,<root registry key>,<relative registry path>,<value name>,<comparison type>,[version]
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
|
|
bool CExpressionParser::fDetectRegKeyVersion(TCHAR * pszBuf)
|
|
{
|
|
bool fSuccess = false;
|
|
HKEY hKeyRoot;
|
|
HKEY hKey;
|
|
DWORD type;
|
|
TCHAR szTargetKeyName[MAX_PATH];
|
|
TCHAR szTargetKeyValue[MAX_PATH];
|
|
//TCHAR szVersion[MAX_VERSION_STRING_LEN];
|
|
TCHAR szBuf[MAX_PATH];
|
|
//TCHAR szCompToken[MAX_PATH];
|
|
//DWORD dwStatus;
|
|
//DWORD dwLen;
|
|
DWORD dwVer;
|
|
DWORD dwBuild;
|
|
DWORD iToken = 0;
|
|
|
|
// Get reg root type (HKLM, etc)
|
|
if ( fMapRegRoot(pszBuf, ++iToken, &hKeyRoot) &&
|
|
(GetStringField2(pszBuf, ++iToken, szTargetKeyName, sizeof(szTargetKeyName)/sizeof(TCHAR)) != 0) )
|
|
{
|
|
if ( RegOpenKeyEx( hKeyRoot,
|
|
szTargetKeyName,
|
|
0,
|
|
KEY_QUERY_VALUE,
|
|
&hKey) == ERROR_SUCCESS )
|
|
{
|
|
if ( GetStringField2(pszBuf, ++iToken, szTargetKeyValue, sizeof(szTargetKeyValue)/sizeof(TCHAR)) != 0 )
|
|
{
|
|
DWORD size = sizeof(szBuf);
|
|
|
|
if ( RegQueryValueEx(hKey,
|
|
szTargetKeyValue,
|
|
0,
|
|
&type,
|
|
(BYTE *)szBuf,
|
|
&size) == ERROR_SUCCESS )
|
|
{
|
|
enumToken enComparisonToken;
|
|
|
|
if ( (type == REG_SZ) &&
|
|
fConvertDotVersionStrToDwords(szBuf, &dwVer, &dwBuild) &&
|
|
(GetStringField2(pszBuf, ++iToken, szBuf, sizeof(szBuf)/sizeof(TCHAR)) != 0) &&
|
|
// look at the type of the comparison
|
|
fMapComparisonToken(szBuf, &enComparisonToken) )
|
|
{
|
|
DWORD dwAskVer = m_pDetection->dwAskVer;
|
|
DWORD dwAskBuild = m_pDetection->dwAskBuild;
|
|
|
|
// now, the version can be either stated explicitely or come from
|
|
// the version key in the cif file.
|
|
if ( GetStringField2(pszBuf, ++iToken, szBuf, sizeof(szBuf)/sizeof(TCHAR)) != 0 )
|
|
{
|
|
fConvertDotVersionStrToDwords(szBuf, &dwAskVer, &dwAskBuild);
|
|
}
|
|
|
|
if ( fCompareVersion(dwVer, dwBuild, enComparisonToken, dwAskVer, dwAskBuild) )
|
|
{
|
|
fSuccess = true;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
RegCloseKey(hKey);
|
|
}
|
|
}
|
|
|
|
//cleanup:
|
|
return fSuccess;
|
|
}
|