diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h index b9e14bcc3..f934c6f45 100644 --- a/src/common/windows/nt.h +++ b/src/common/windows/nt.h @@ -1,7 +1,11 @@ #pragma once -#include #include +#include + +enum { + SystemBootEnvironmentInformation = 90, +}; #define D3DKMT_ALIGN64 __attribute__((aligned(8))) @@ -329,3 +333,27 @@ typedef struct _SECTION_IMAGE_INFORMATION ULONG ImageFileSize; // The size of the image, in bytes, including all headers. ULONG CheckSum; // The image file checksum, from the PE optional header. } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION; + +typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION +{ + GUID BootIdentifier; + FIRMWARE_TYPE FirmwareType; + union + { + ULONGLONG BootFlags; + struct + { + ULONGLONG DbgMenuOsSelection : 1; // REDSTONE4 + ULONGLONG DbgHiberBoot : 1; + ULONGLONG DbgSoftBoot : 1; + ULONGLONG DbgMeasuredLaunch : 1; + ULONGLONG DbgMeasuredLaunchCapable : 1; // 19H1 + ULONGLONG DbgSystemHiveReplace : 1; + ULONGLONG DbgMeasuredLaunchSmmProtections : 1; + ULONGLONG DbgMeasuredLaunchSmmLevel : 7; // 20H1 + ULONGLONG DbgBugCheckRecovery : 1; // 24H2 + ULONGLONG DbgFASR : 1; + ULONGLONG DbgUseCachedBcd : 1; + }; + }; +} SYSTEM_BOOT_ENVIRONMENT_INFORMATION; diff --git a/src/detection/bios/bios_windows.c b/src/detection/bios/bios_windows.c index 059ebce46..716add370 100644 --- a/src/detection/bios/bios_windows.c +++ b/src/detection/bios/bios_windows.c @@ -5,28 +5,7 @@ #include "common/windows/registry.h" #include -#include - -typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION -{ - GUID BootIdentifier; - FIRMWARE_TYPE FirmwareType; - union - { - ULONGLONG BootFlags; - struct - { - ULONGLONG DbgMenuOsSelection : 1; // REDSTONE4 - ULONGLONG DbgHiberBoot : 1; - ULONGLONG DbgSoftBoot : 1; - ULONGLONG DbgMeasuredLaunch : 1; - ULONGLONG DbgMeasuredLaunchCapable : 1; // 19H1 - ULONGLONG DbgSystemHiveReplace : 1; - ULONGLONG DbgMeasuredLaunchSmmProtections : 1; - ULONGLONG DbgMeasuredLaunchSmmLevel : 7; // 20H1 - }; - }; -} SYSTEM_BOOT_ENVIRONMENT_INFORMATION; +#include "common/windows/nt.h" #elif __OpenBSD__ #include "common/io.h" @@ -90,7 +69,7 @@ const char* ffDetectBios(FFBiosResult* bios) // Same as GetFirmwareType, but support (?) Windows 7 // https://ntdoc.m417z.com/system_information_class SYSTEM_BOOT_ENVIRONMENT_INFORMATION sbei; - if (NT_SUCCESS(NtQuerySystemInformation(90 /*SystemBootEnvironmentInformation*/, &sbei, sizeof(sbei), NULL))) + if (NT_SUCCESS(NtQuerySystemInformation(SystemBootEnvironmentInformation, &sbei, sizeof(sbei), NULL))) { switch (sbei.FirmwareType) {