Fix false-positive successes, locale bugs, and clean-list formatting - #3
Open
TheSulak3 wants to merge 8 commits into
Open
Fix false-positive successes, locale bugs, and clean-list formatting#3TheSulak3 wants to merge 8 commits into
TheSulak3 wants to merge 8 commits into
Conversation
Get-Tpm and other elevated commands print a localized "requires administrator" message to stdout while still exiting 0, so the tool logged them as SUCCESS with error text as data. Now detects these privilege-denied phrases and reports FAILED correctly, and surfaces admin status in the console and report header.
CmdLine now bypasses Go's default Windows arg re-escaping so quoted findstr patterns (e.g. /C:"OS Serial Number") reach cmd.exe intact instead of being split into bogus file-open attempts. The Windows Product ID (Alternative) and MAC Addresses (IPConfig) checks also relied on English-only systeminfo/ipconfig labels that don't exist on non-English Windows installs; replaced both with locale-independent CIM/PowerShell equivalents.
extractCleanValue used a generic header-stripping heuristic that worked for single-value wmic output but glued every row of MAC adapter tables, volume tables, and TPM property lists into one unreadable line. Added dedicated extractors: regex-based MAC address pulling (dedup, locale-independent), TPM property summary, and volume drive/size parsing, dispatched by check description.
Win32_Tpm has no SerialNumber property; the EK public key hash is the closest thing to a real per-chip identifier, retrieved via Get-TpmEndorsementKeyInfo. That cmdlet returns an empty formatted table (header + dashes, no data, exit 0) instead of an error when not elevated, which slipped past the existing success checks as a false SUCCESS with no actual data. Added isEmptyTableOutput to catch that pattern generally. Also dropped the EK fallback command, which used an invalid -HashAlgorithm value and always errored.
Get-TpmEndorsementKeyInfo writes its "administrator privileges required" message through a channel that gets silently dropped once a downstream Select-Object stage exists in the pipeline, so the check always looked like an empty result with no explanation regardless of the real cause. Running it unpiped lets the actual message reach stdout/stderr, where isPrivilegeError now catches it correctly.
Menu, examples, and output samples were still describing the old 12-option/14-check version. Documents the current 15-option menu, 17-check scan, Clean HWID List, Compare Scans, Administrator detection, and the recent locale/false-success fixes.
Adds a native check that replicates how Samuel Tulach's tpm-info.exe reads the EK: NCryptOpenStorageProvider + NCryptGetProperty against the Microsoft Platform Crypto Provider directly (ncrypt.dll), rather than going through PowerShell's Get-TpmEndorsementKeyInfo. The raw BCRYPT_RSAPUBLIC_BLOB is DER-encoded as a PKCS#1 RSAPublicKey and hashed with MD5/SHA1/SHA256, matching tpm-info.exe's output exactly (verified byte-for-byte against the real tool). Notably this route works without Administrator privileges, unlike the PowerShell cmdlet.
Adds a note (console + written into the detailed report file) right after both EK checks run, explaining that they read the same physical key but hash different byte encodings of it: Get-TpmEndorsementKeyInfo hashes Microsoft's internal PublicKeyHash property, while the Tulach Method hashes a PKCS#1 DER encoding of the raw key pulled via ncrypt.dll directly. Otherwise the differing strings look like a bug or a sign the two methods disagree about the actual key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Get-Tpm,Confirm-SecureBootUEFI) print a localized "administrator privileges required" message to stdout while still exiting 0, so they were previously logged asSUCCESSwith the error text recorded as data. Added detection for these phrases (and for PowerShell's empty-table-with-no-error output pattern) so they now correctly reportFAILEDwith a clear reason. Also added anAdministrator: Yes/Noline to report headers and a startup warning when not elevated.findstr /C:"OS Serial Number") throughexec.Command("cmd.exe","/C", fullCommand)got double-escaped by Go's default Windows argument handling, splitting the quoted phrase into bogus separate file-open attempts. Now usessyscall.SysProcAttr.CmdLinedirectly to bypass the re-escaping.findstrlabel parsing: the "Windows Product ID (Alternative)" and "MAC Addresses (IPConfig)" checks searched for English-only labels ("OS Serial Number","Physical Address") insysteminfo/ipconfigoutput, which don't exist on non-English Windows installs. Replaced both with locale-independent CIM/PowerShell equivalents.wmicoutput but glued every row of MAC adapter tables, volume tables, and TPM property lists into one unreadable line. Added dedicated extractors (regex MAC pulling with dedup, TPM property summary, volume drive/size parsing) dispatched by check description.Win32_Tpmhas no serial number property, so addedGet-TpmEndorsementKeyInfoas the closest thing to a real per-chip TPM identifier.Test plan