Beispiel #1
0
        private static object AdaptLocalTime(ValueAdapterContext context, object currentValue)
        {
            var val = context.Value.ToString();
            var pos = val.IndexOfAny(new[] { '-', '+' });

            if (pos != -1)
            {
                var pos2 = val.IndexOfAny(new[] { '-', ' ' }, pos + 1);
                if (pos2 == -1)
                {
                    context.AddCustomField("OS.Localization", "LocalDateTime.TimeZone", val.Substring(pos));
                }
            }


            DateTime time;

            if (WmiDateConverter.TryParse(context.Value.ToString(), out time))
            {
                context.AddCustomField("OS.Localization", "LocalDateTime.Hour", time.Hour.ToString());
                context.AddCustomField("OS.Localization", "LocalDateTime.Minute", time.Minute.ToString());
                context.AddCustomField("OS.Localization", "LocalDateTime.DayOfWeek", time.DayOfWeek.ToString());
                context.AddCustomField("OS.Localization", "LocalDateTime.DayOfYear", time.DayOfYear);
            }

            context.IgnoreProperty = true;
            return(currentValue);
        }
        public void Test1()
        {
            //19th minus 8 hours for the timezone
            var expected = new DateTime(2009, 02, 18, 16, 0, 0);

            var success = WmiDateConverter.TryParse("20090219000000.000000+480", out var result);

            success.Should().BeTrue();
            result.Should().Be(expected);
        }
        public void Test2()
        {
            var expected = new DateTime(2014, 04, 08, 15, 18, 35);

            expected = expected.AddMicroseconds(999999);

            var success = WmiDateConverter.TryParse("20140408141835.999999-60", out var result);

            success.Should().BeTrue();
            result.Should().Be(expected);
        }
Beispiel #4
0
        private static object AdaptInstallDate(ValueAdapterContext context, object currentValue)
        {
            DateTime time;

            if (WmiDateConverter.TryParse(context.Value.ToString(), out time))
            {
                context.AddCustomField("OS.Environment", "InstallDate.Year", time.Year.ToString());
                context.AddCustomField("OS.Environment", "InstallDate.YearMonth", time.ToString("yyyy-MM"));
            }

            context.IgnoreProperty = true;
            return(currentValue);
        }
Beispiel #5
0
        public object Adapt(ValueAdapterContext context, object currentValue)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            var val = currentValue as string;

            if (string.IsNullOrEmpty(val))
            {
                return(currentValue);
            }
            if (!context.ContextName.Equals("OperatingSystem", StringComparison.OrdinalIgnoreCase))
            {
                return(currentValue);
            }

            context.IgnoreProperty = true;
            if (context.PropertyName.Equals("OperatingSystemSKU", StringComparison.OrdinalIgnoreCase))
            {
                var name = OperatingSystemSku.GetName(currentValue.ToString()) ?? currentValue;
                context.AddCustomField("OS.Metadata", "Edition", name);
            }

            if (context.PropertyName.Equals("CSDVersion", StringComparison.OrdinalIgnoreCase))
            {
                context.AddCustomField("OS.Metadata", "ServicePack", currentValue.ToString());
                return(currentValue);
            }

            if (context.PropertyName.Equals("OSProductSuite", StringComparison.OrdinalIgnoreCase))
            {
                var value = OsProductSuite.GetNames(currentValue.ToString()) ?? currentValue;
                context.AddCustomField("OS.Metadata", "ProductSuite", value);
                return(currentValue);
            }

            if (context.PropertyName.Equals("ProductType", StringComparison.OrdinalIgnoreCase))
            {
                switch (currentValue.ToString())
                {
                case "1":
                    currentValue = "Work Station";
                    break;

                case "2":
                    currentValue = "Domain Controller";
                    break;

                case "3":
                    currentValue = "Server";
                    break;
                }
                context.AddCustomField("OS.Metadata", "ProductType", currentValue);
                return(currentValue);
            }


            if (context.PropertyName.Equals("SuiteMask", StringComparison.OrdinalIgnoreCase))
            {
                var bitMask = 0;
                var value   = "";
                if (int.TryParse(currentValue.ToString(), out bitMask))
                {
                    if ((bitMask & 1) != 0)
                    {
                        value += "Small Business, ";
                    }
                    if ((bitMask & 2) != 0)
                    {
                        value += "Enterprise, ";
                    }
                    if ((bitMask & 4) != 0)
                    {
                        value += "BackOffice, ";
                    }
                    if ((bitMask & 8) != 0)
                    {
                        value += "Communications, ";
                    }
                    if ((bitMask & 16) != 0)
                    {
                        value += "Terminal Services, ";
                    }
                    if ((bitMask & 32) != 0)
                    {
                        value += "Small Business Restricted, ";
                    }
                    if ((bitMask & 64) != 0)
                    {
                        value += "Embedded Edition, ";
                    }
                    if ((bitMask & 128) != 0)
                    {
                        value += "Datacenter Edition, ";
                    }
                    if ((bitMask & 256) != 0)
                    {
                        value += "Single User, ";
                    }
                    if ((bitMask & 512) != 0)
                    {
                        value += "Home Edition, ";
                    }
                    if ((bitMask & 1024) != 0)
                    {
                        value += "Web Server Edition, ";
                    }
                }
                if (value != "")
                {
                    currentValue = value.Remove(value.Length - 2, 2);
                }
                context.AddCustomField("OS.Metadata", "Suite2", currentValue);
                return(currentValue);
            }
            if (context.PropertyName.Equals("QuantumLength", StringComparison.OrdinalIgnoreCase))
            {
                switch (currentValue.ToString())
                {
                case "0":
                    currentValue = "Unknown ";
                    break;

                case "1":
                    currentValue = "One tick";
                    break;

                case "2":
                    currentValue = "Two ticks";
                    break;
                }
                context.AddCustomField("OS.Metadata", "QuantumLength", currentValue);
                return(currentValue);
            }

            if (context.PropertyName.Equals("QuantumType", StringComparison.OrdinalIgnoreCase))
            {
                switch (currentValue.ToString())
                {
                case "0":
                    currentValue = "Unknown ";
                    break;

                case "1":
                    currentValue = "Fixed";
                    break;

                case "2":
                    currentValue = "Variable";
                    break;
                }
                context.AddCustomField("OS.Metadata", "QuantumType", currentValue);
                return(currentValue);
            }


            if (context.PropertyName == "InstallDate")
            {
                return(AdaptInstallDate(context, currentValue));
            }


            if (context.PropertyName == "LastBootUpTime")
            {
                DateTime time;
                if (WmiDateConverter.TryParse(context.Value.ToString(), out time))
                {
                    context.AddCustomField("OS.Environment", "LastBootup.Hour", time.Hour);
                    context.AddCustomField("OS.Environment", "LastBootup.DayOfWeek", time.DayOfWeek.ToString());
                }
            }


            if (context.PropertyName == "LocalDateTime")
            {
                return(AdaptLocalTime(context, currentValue));
            }

            if (context.PropertyName.StartsWith("Free", StringComparison.OrdinalIgnoreCase) ||
                context.PropertyName.StartsWith("Total", StringComparison.OrdinalIgnoreCase) ||
                context.PropertyName.Equals("SizeStoredInPagingFiles", StringComparison.OrdinalIgnoreCase))
            {
                var divisor = context.TypeOfApplication == "Server" ? 512 : 256;
                var value   = MemoryNormalizer.Divide(currentValue as string, divisor);
                if (!string.IsNullOrEmpty(value))
                {
                    context.AddCustomField("OS.Environment", context.PropertyName, value);
                }

                return(currentValue);
            }

            //allow as-is
            if (context.PropertyName.StartsWith("DataExecutionPrevention", StringComparison.OrdinalIgnoreCase))
            {
                context.AddCustomField("OS.Metadata", context.PropertyName, currentValue);
                return(currentValue);
            }

            if (LocalizationProperties.Any(x => x.Equals(context.PropertyName, StringComparison.OrdinalIgnoreCase)))
            {
                if (context.PropertyName == "Locale")
                {
                    int lcid;
                    if (int.TryParse(currentValue.ToString(), NumberStyles.HexNumber, NumberFormatInfo.InvariantInfo,
                                     out lcid))
                    {
                        currentValue = CultureInfo.GetCultureInfo(lcid).Name;
                    }
                }

                context.AddCustomField("OS.Localization", context.PropertyName, currentValue);
                return(null);
            }

            if (OsEnvironment.Any(x => x.Equals(context.PropertyName, StringComparison.OrdinalIgnoreCase)))
            {
                if (context.PropertyName == "NumberOfUsers")
                {
                    if ("0".Equals(currentValue))
                    {
                        currentValue = "0";
                    }
                    else if ("1".Equals(currentValue))
                    {
                        currentValue = "1";
                    }
                    else
                    {
                        currentValue = "> 1";
                    }
                    context.AddCustomField("OS.Environment", "NumberOfLoggedInUsers", currentValue);
                    return(currentValue);
                }

                if (context.PropertyName == "NumberOfProcesses")
                {
                    currentValue = NumberNormalizer.Normalize(currentValue as string, 20, 1000);
                }

                context.AddCustomField("OS.Environment", context.PropertyName, currentValue);
                return(currentValue);
            }

            return(currentValue);
        }