From cd8c15d01e25a83fd2a0e7d4029b26b88bb88a99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Wed, 7 Jan 2026 09:32:40 +0800
Subject: [PATCH] OS (Windows): acquires OS name from registry

---
 src/detection/os/os_windows.cpp | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/detection/os/os_windows.cpp b/src/detection/os/os_windows.cpp
index 71b1163ae..d56cdd7b3 100644
--- a/src/detection/os/os_windows.cpp
+++ b/src/detection/os/os_windows.cpp
@@ -69,6 +69,17 @@ void ffDetectOSImpl(FFOSResult* os)
     if(ffStrbufStartsWithS(&os->variant, "Microsoft "))
         ffStrbufSubstrAfter(&os->variant, strlen("Microsoft ") - 1);
 
+    if(os->variant.length == 0) // Windows PE?
+    {
+        wchar_t buf[128];
+        DWORD bufSize = (DWORD) sizeof(buf); // with trailing '\0'
+        if(RegGetValueW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", L"ProductName", RRF_RT_REG_SZ, NULL, buf, &bufSize) == ERROR_SUCCESS)
+        {
+            assert(bufSize >= sizeof(wchar_t));
+            ffStrbufSetNWS(&os->variant, bufSize / sizeof(wchar_t) - 1, buf);
+        }
+    }
+
     ffStrbufSet(&os->prettyName, &os->variant);
 
     if(ffStrbufStartsWithS(&os->variant, "Windows "))
@@ -83,6 +94,9 @@ void ffDetectOSImpl(FFOSResult* os)
             ffStrbufSubstrAfter(&os->variant, strlen(" Server") - 1);
         }
 
+        if(ffStrbufStartsWithIgnCaseS(&os->variant, "(TM) "))
+            ffStrbufSubstrAfter(&os->variant, strlen(" (TM)") - 1);
+
         uint32_t index = ffStrbufFirstIndexC(&os->variant, ' ');
         ffStrbufAppendNS(&os->version, index, os->variant.chars);
         ffStrbufSubstrAfter(&os->variant, index);