Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » Knowledge Base » Tech Topics and Techniques Knowledge Base » Windows » Windows Code Snippets » Machine Information (Windows) » Update Information (Windows Updates)
List Installed Windows Updates via WMI (MISCEnumerateUpdatesWMI_QFE)
SECRET//NOFORN
Miscellaneous Module
Stash Repository: Miscellaneous Library
Module Name: MISCEnumerateUpdatesWMI_QFE (Quick Fix Engineering)
Module Description: This module uses WMIWindows Management Instrumentation (Windows Management Instrumentation) to enumerate the items listed under WIN32_QuickFixEngineering. The module returns a linked list of KB Article IDs for the installed updates on the machine. This is the same list seen in a call to systeminfo. In Windows XP, the list is derived from the registry.
Usage:
/*
This function returns a linked list of the updates installed on the machine as detected by WMI. This technique
enumerates WIN32_QuickFixEngineering to get the KB IDs of the installed updates. The function returns TRUE on
success and FALSE on failure. This may not be a full list and is similar to systeminfo.
*/
static BOOL GetUpdateList(PUPDATE_LIST_WMI &pList);
/*
This function clears/frees all the data in an UPDATE_ENTRY_WMI linked list
*/
static BOOL FreeUpdateList(PUPDATE_LIST_WMI &pList);
pList [in/out]: A pointer to a list of UPDATE_ENTRY_WMIs containing the KB Article IDs of all installed updates. In GetUpdateList the pList is populated with the list of updates installed on the machine. In FreeUpdateList, the list is cleared and freed.
Returns TRUE on success and FALSE on failure.
PSP/OS Issues: No known issues.
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house (well-documented WMIWindows Management Instrumentation Class)
Notes:
- XP+
- Returns the same list as systeminfo
- Article IDs are returned with the KB prefix
Module Specific Structures:
typedef struct _UPDATE_ENTRY_WMI
{
WCHAR *wcKB; //The KB number of the installed update
_UPDATE_ENTRY_WMI *pNextEntry; //Next entry in the linked list
}UPDATE_ENTRY_WMI, *PUPDATE_ENTRY_WMI, UPDATE_LIST_WMI, *PUPDATE_LIST_WMI;
Module Return Codes:
Returns TRUE on success and FALSE on failure.
Example Code:
//KB2954879
WCHAR wcKB[] = L"KB2954879";
//Get the list of updates on the machine
PUPDATE_LIST_WMI pList;
BOOL bRet = MISCEnumerateUpdatesWMI_QFE::GetUpdateList(pList);
//print KBs and find match
BOOL bFoundMatch = FALSE;
PUPDATE_LIST_WMI pNode = pList;
while (pNode != NULL)
{
if (pNode->wcKB != NULL)
{
if (wcsicmp(pNode->wcKB, wcKB) == 0)
bFoundMatch = TRUE;
//print out article id
wprintf(L"%s\n", pNode->wcKB);
}
pNode = pNode->pNextEntry;
}
//Free the list
bRet = MISCEnumerateUpdatesWMI_QFE::FreeUpdateList(pList);
SECRET//NOFORN