84 lines
2.1 KiB
C++
84 lines
2.1 KiB
C++
#include "wudetect.h"
|
|
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
// CExpressionParser::fDetectRegSubStr
|
|
// Detect a substring in registry datum.
|
|
//
|
|
// Form: E=RegSubstr,<SubStr>,<RootKey>,<KeyPath>,<RegValue>,<RegData>
|
|
//
|
|
// Comments :
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
|
|
bool CExpressionParser::fDetectRegSubStr(TCHAR * pszBuf)
|
|
{
|
|
bool fSuccess = false;
|
|
HKEY hKeyRoot;
|
|
HKEY hKey;
|
|
DWORD type;
|
|
TCHAR szTargetKeyName[MAX_PATH];
|
|
TCHAR szTargetKeyValue[MAX_PATH];
|
|
TCHAR szKeyMissingStatus[MAX_PATH];
|
|
TCHAR szData[MAX_PATH];
|
|
TCHAR szSubStr[MAX_PATH];
|
|
DWORD iToken = 0;
|
|
|
|
|
|
// Get reg root type (HKLM, etc)
|
|
if ( fMapRegRoot(pszBuf, ++iToken, &hKeyRoot) &&
|
|
(GetStringField2(pszBuf, ++iToken, szTargetKeyName, sizeof(szTargetKeyName)/sizeof(TCHAR)) != 0) )
|
|
{
|
|
if ( RegOpenKeyEx( hKeyRoot,
|
|
szTargetKeyName,
|
|
0,
|
|
KEY_QUERY_VALUE,
|
|
&hKey) == ERROR_SUCCESS )
|
|
{
|
|
if ( (GetStringField2(pszBuf, ++iToken, szTargetKeyValue, sizeof(szTargetKeyValue)/sizeof(TCHAR)) != 0) &&
|
|
(GetStringField2(pszBuf, ++iToken, szKeyMissingStatus, sizeof(szKeyMissingStatus)/sizeof(TCHAR)) != 0) )
|
|
{
|
|
DWORD size = sizeof(szData);
|
|
|
|
if ( RegQueryValueEx(hKey,
|
|
szTargetKeyValue,
|
|
0,
|
|
&type,
|
|
(BYTE *)szData,
|
|
&size) == ERROR_SUCCESS )
|
|
{
|
|
if ( type == REG_SZ )
|
|
{
|
|
_tcslwr(szData);
|
|
|
|
// iterate thru the substrings looking for a match.
|
|
while ( GetStringField2(pszBuf, ++iToken, szSubStr, sizeof(szSubStr)) != 0 )
|
|
{
|
|
_tcslwr(szSubStr);
|
|
|
|
if ( _tcsstr(szData, szSubStr) != NULL )
|
|
{
|
|
fSuccess = true;
|
|
goto quit_while;
|
|
}
|
|
}
|
|
quit_while:;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// if we get an error, assume the key does not exist. Note that if
|
|
// the status is DETFIELD_NOT_INSTALLED then we don't have to do
|
|
// anything since that is the default status.
|
|
if ( lstrcmpi(DETFIELD_INSTALLED, szKeyMissingStatus) == 0 )
|
|
{
|
|
fSuccess = true;
|
|
}
|
|
}
|
|
}
|
|
RegCloseKey(hKey);
|
|
}
|
|
}
|
|
|
|
|
|
return fSuccess;
|
|
}
|