hwid.c

/*
 * hwid.c — Hardware ID collection orchestrator.
 *
 * All collector implementations live in utils/hwid/*.c.
 * This file only dispatches CMD_HWID_COLLECT.
 */

#include <ntifs.h>
#include <ntddk.h>
#include "edr_shared.h"
#include "core.h"
#include "utils/hwid/hwid_internal.h"

NTSTATUS HwidHandleCommand(_Inout_ PRING_MESSAGE Msg)
{
    if (sizeof(HWID_RESULT) > RING_DATA_SIZE)
        return STATUS_BUFFER_TOO_SMALL;

    PHWID_RESULT result = (PHWID_RESULT)Msg->Data;
    RtlZeroMemory(result, sizeof(HWID_RESULT));

    HwidCollectSmbios(result);
    HwidCollectCpu(result);
    HwidCollectVolume(result);
    HwidCollectDisk(result);
    HwidCollectMac(result);
    HwidCheckFilterStack(result);

    HV_DETECTION_RESULT hvResult;
    HwidDetectHypervisor(&hvResult);
    if (hvResult.CpuidBit31 || hvResult.TimingDetected)
        result->Flags |= HWID_FLAG_HV_DETECTED;

    HwidComputeHmac(result, CommGetSessionKey(), 32);

    Msg->DataLength = sizeof(HWID_RESULT);
    return STATUS_SUCCESS;
}