Add VMware detection based on network adapter name

This commit is contained in:
Alberto Ortega 2015-08-30 18:35:22 +02:00
parent 618037ba25
commit 017d5dfbbd
5 changed files with 33 additions and 0 deletions

View File

@ -247,6 +247,8 @@ int main(void)
&vmware_mac,
"VMware traced using MAC address starting with 00:05:69, 00:0C:29, 00:1C:14 or 00:50:56",
"hi_vmware");
exec_check("Looking for network adapter name", &vmware_adapter_name,
"VMware traced using network adapter name", "hi_vmware");
exec_check("Looking for pseudo devices", &vmware_devices, NULL,
"hi_vmware");
exec_check("Looking for VMware serial number", &vmware_wmi_serial,

View File

@ -178,6 +178,29 @@ int pafish_check_mac_vendor(char * mac_vendor) {
return res;
}
int pafish_check_adapter_name(char * name) {
unsigned long alist_size = 0, ret;
wchar_t aux[1024];
mbstowcs(aux, name, sizeof(aux)-sizeof(aux[0]));
ret = GetAdaptersAddresses(AF_UNSPEC, 0, 0, 0, &alist_size);
if (ret == ERROR_BUFFER_OVERFLOW) {
IP_ADAPTER_ADDRESSES *palist = (IP_ADAPTER_ADDRESSES*)LocalAlloc(LMEM_ZEROINIT, alist_size);
if (GetAdaptersAddresses(AF_UNSPEC, 0, 0, palist, &alist_size) == ERROR_SUCCESS) {
while (palist) {
if (wcsstr(palist->Description, aux)) {
LocalFree(palist);
return TRUE;
}
palist = palist->Next;
}
}
LocalFree(palist);
}
return FALSE;
}
/**
* Initialise the WMI client that will connect to the local machine WMI
* namespace. It will return TRUE if the connection was successful, FALSE

View File

@ -18,6 +18,8 @@ inline int pafish_exists_file(char * filename);
int pafish_check_mac_vendor(char * mac_vendor);
int pafish_check_adapter_name(char * name);
/**
* Prototype for the WMI caller implemented function for checking the
* WMI query results.

View File

@ -55,6 +55,10 @@ int vmware_mac() {
}
}
int vmware_adapter_name() {
return pafish_check_adapter_name("VMware");
}
int vmware_devices(int writelogs) {
HANDLE h;
const int count = 2;

View File

@ -12,6 +12,8 @@ int vmware_sysfile2();
int vmware_mac();
int vmware_adapter_name();
int vmware_devices();
int vmware_wmi_serial();