From 38e4ba290db8b3bb426046c57a7708c58e438c11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Sun, 20 Sep 2026 14:21:25 +0800 Subject: [PATCH] OS (Windows): adds comments --- src/detection/os/os_windows.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/detection/os/os_windows.c b/src/detection/os/os_windows.c index e904616a0..a2ed50d0f 100644 --- a/src/detection/os/os_windows.c +++ b/src/detection/os/os_windows.c @@ -26,6 +26,19 @@ static bool getCodeName(FFOSResult* os) { void ffDetectOSImpl(FFOSResult* os) { // https://dennisbabkin.com/blog/?t=how-to-tell-the-real-version-of-windows-your-app-is-running-on#ver_string + + // Reads a single branding field from winbrand.dll. The buffer is allocated with + // GlobalAlloc(GMEM_ZEROINIT) by winbrand, so it is ours to release. + // + // Fields offered by winbrand.dll (enumerated in basebrd.dll's RES_METADATA resource): + // %WINDOWS_GENERIC% the OS family, independent of edition and release ("Windows") + // %WINDOWS_SHORT% family + release, but hardcoded to "Windows 10" since Windows 10 + // %WINDOWS_LONG% " [...]" ("Windows 11 Pro Insider Preview") + // %WINDOWS_PRODUCT% the product of the running edition + // %WINDOWS_COPYRIGHT%, %MICROSOFT_COMPANYNAME%, %MICROSOFT_ACCOUNT(S)% + // There is deliberately no field for the bare release number: basebrd.dll stores it + // inside the same per-edition resource as the rest of %WINDOWS_LONG% + // ("Windows 11 Pro%1%2"), so the release can only be peeled off that string. const wchar_t* rawName = BrandingFormatString(L"%WINDOWS_LONG%"); ffStrbufSetWS(&os->variant, rawName); GlobalFree((HGLOBAL) rawName);