- Windows Security Center注册分析
- 1. wsc获取
- 2. wsc注册
最近在研究如何向WSC（Windows Security Center）中注册相关组件，类似火绒等相关软件，用来替换默认的Windows Defender，如下：
查了许多资料之后，发现应该是需要加入MVI – MICROSOFT VIRUS INITIATIVE；这样的话似乎过于麻烦了，那么有没有其他方式呢？本文就来探讨一下。
1. wsc获取对于SecurityCenter信息的获取，我们可以通过WMI接口来进行获取如下：
get-wmiObject -namespace rootSecurityCenter2 -class AntiVirusProduct
__GENUS : 2
__CLASS : AntiVirusProduct
__SUPERCLASS :
__DYNASTY : AntiVirusProduct
__RELPATH : AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"
__PROPERTY_COUNT : 6
__DERIVATION : {}
__SERVER : DESKTOP-1SIKOAK
__NAMESPACE : ROOTSecurityCenter2
__PATH : \DESKTOP-1SIKOAKROOTSecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"
displayName : Windows Defender
instanceGuid : {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe : windowsdefender://
pathToSignedReportingExe : %ProgramFiles%Windows DefenderMsMpeng.exe
productState : 393472
timestamp : Sat, 21 May 2022 05:34:12 GMT
PSComputerName : DESKTOP-1SIKOAK
__GENUS : 2
__CLASS : AntiVirusProduct
__SUPERCLASS :
__DYNASTY : AntiVirusProduct
__RELPATH : AntiVirusProduct.instanceGuid="{4C17E7AE-043A-D732-91B8-D139C9EB6B26}"
__PROPERTY_COUNT : 6
__DERIVATION : {}
__SERVER : DESKTOP-1SIKOAK
__NAMESPACE : ROOTSecurityCenter2
__PATH : \DESKTOP-1SIKOAKROOTSecurityCenter2:AntiVirusProduct.instanceGuid="{4C17E7AE-043A-D732-91B8-D139C9EB6B26}"
displayName : 火绒安全软件
instanceGuid : {4C17E7AE-043A-D732-91B8-D139C9EB6B26}
pathToSignedProductExe : C:Program FilesHuorongSysdiagbinwsctrlsvc.exe
pathToSignedReportingExe : C:Program FilesHuorongSysdiagbinwsctrlsvc.exe
productState : 266240
timestamp : Sat, 21 May 2022 05:34:04 GMT
PSComputerName : DESKTOP-1SIKOAK
因此对于WMI，我们也可以使用C++语言来开发获取，如下：
HRESULT
GetSecurityProducts(
_In_ WSC_SECURITY_PROVIDER provider
)
{
HRESULT hr = S_OK;
IWscProduct* PtrProduct = nullptr;
IWSCProductList* PtrProductList = nullptr;
BSTR PtrVal = nullptr;
LONG ProductCount = 0;
WSC_SECURITY_PRODUCT_STATE ProductState;
WSC_SECURITY_SIGNATURE_STATUS ProductStatus;
if (provider != WSC_SECURITY_PROVIDER_FIREWALL &&
provider != WSC_SECURITY_PROVIDER_ANTIVIRUS &&
provider != WSC_SECURITY_PROVIDER_ANTISPYWARE)
{
hr = E_INVALIDARG;
goto exit;
}
hr = CoCreateInstance(
__uuidof(WSCProductList),
NULL,
CLSCTX_INPROC_SERVER,
__uuidof(IWSCProductList),
reinterpret_cast (&PtrProductList));
if(FAILED(hr))
{
wprintf(L"CoCreateInstance returned error = 0x%d n", hr);
goto exit;
}
hr = PtrProductList->Initialize(provider);
if(FAILED(hr))
{
wprintf(L"Initialize failed with error: 0x%dn", hr);
goto exit;
}
hr = PtrProductList->get_Count(&ProductCount);
if (FAILED(hr))
{
wprintf(L"get_Count failed with error: 0x%dn", hr);
goto exit;
}
if (provider == WSC_SECURITY_PROVIDER_FIREWALL)
{
wprintf(L"nnFirewall Products:n");
}
else if (provider == WSC_SECURITY_PROVIDER_ANTIVIRUS)
{
wprintf(L"nnAntivirus Products:n");
}
else
{
wprintf(L"nnAntispyware Products:n");
}
for (LONG i = 0; i < ProductCount; i++)
{
hr = PtrProductList->get_Item(i, &PtrProduct);
if(FAILED(hr))
{
wprintf(L"get_Item failed with error: 0x%dn", hr);
goto exit;
}
hr = PtrProduct->get_ProductName(&PtrVal);
if (FAILED(hr))
{
wprintf(L"get_ProductName failed with error: 0x%dn", hr);
goto exit;
}
wprintf(L"nProduct name: %sn", PtrVal);
SysFreeString(PtrVal);
PtrVal = nullptr;
hr = PtrProduct->get_ProductState(&ProductState);
if (FAILED(hr))
{
wprintf(L"get_ProductState failed with error: 0x%dn", hr);
goto exit;
}
LPWSTR pszState;
if (ProductState == WSC_SECURITY_PRODUCT_STATE_ON)
{
pszState = L"On";
}
else if (ProductState == WSC_SECURITY_PRODUCT_STATE_OFF)
{
pszState = L"Off";
}
else if (ProductState == WSC_SECURITY_PRODUCT_STATE_SNOOZED)
{
pszState = L"Snoozed";
}
else
{
pszState = L"Expired";
}
wprintf(L"Product state: %sn", pszState);
if (provider != WSC_SECURITY_PROVIDER_FIREWALL)
{
hr = PtrProduct->get_SignatureStatus(&ProductStatus);
if (FAILED(hr))
{
wprintf(L"get_SignatureStatus failed with error: 0x%dn", hr);
goto exit;
}
LPWSTR pszStatus = (ProductStatus == WSC_SECURITY_PRODUCT_UP_TO_DATE) ?
L"Up-to-date" : L"Out-of-date";
wprintf(L"Product status: %sn", pszStatus);
}
hr = PtrProduct->get_RemediationPath(&PtrVal);
if (FAILED(hr))
{
wprintf(L"get_RemediationPath failed with error: 0x%dn", hr);
goto exit;
}
wprintf(L"Product remediation path: %sn", PtrVal);
SysFreeString(PtrVal);
PtrVal = nullptr;
if (provider == WSC_SECURITY_PROVIDER_ANTIVIRUS)
{
hr = PtrProduct->get_ProductStateTimestamp(&PtrVal);
if (FAILED(hr))
{
wprintf(L"get_ProductStateTimestamp failed with error: 0x%dn", hr);
goto exit;
}
wprintf(L"Product state timestamp: %sn", PtrVal);
SysFreeString(PtrVal);
PtrVal = nullptr;
}
PtrProduct->Release();
PtrProduct = nullptr;
}
exit:
if (nullptr != PtrVal)
{
SysFreeString(PtrVal);
}
if (nullptr != PtrProductList)
{
PtrProductList->Release();
}
if (nullptr != PtrProduct)
{
PtrProduct->Release();
}
return hr;
}
我们就可以枚举到相关信息，如下：
Antivirus Products: Product name: Microsoft Defender ??? Product state: On Product status: Up-to-date Product remediation path: windowsdefender:// Product state timestamp: Sat, 21 May 2022 03:44:27 GMT2. wsc注册
上述WMI相关数据库，只能对WSC进行查询，那么注册的话还是行不通的，那么我们可以参考一下火绒的注册方案：
参考相关实现之后，注册结果如下（这里把名字取做我的安全）：
