Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
List Installed Windows Updates via WMI (MISCEnumerateUpdatesWMI_QFE)
SECRET//NOFORN
Miscellaneous Module
Stash Repository: Miscellaneous Library
Module Name: MISCEnumerateUpdatesWMI_QFE (Quick Fix Engineering)
Module Description: This module uses WMIWindows Management Instrumentation (Windows Management Instrumentation) to enumerate the items listed under WIN32_QuickFixEngineering. The module returns a linked list of KB Article IDs for the installed updates on the machine. This is the same list seen in a call to systeminfo. In Windows XP, the list is derived from the registry.
Usage:
/*
This function returns a linked list of the updates installed on the machine as detected by WMI. This technique
enumerates WIN32_QuickFixEngineering to get the KB IDs of the installed updates. The function returns TRUE on
success and FALSE on failure. This may not be a full list and is similar to systeminfo.
*/
static BOOL GetUpdateList(PUPDATE_LIST_WMI &pList);
/*
This function clears/frees all the data in an UPDATE_ENTRY_WMI linked list
*/
static BOOL FreeUpdateList(PUPDATE_LIST_WMI &pList);
PSP/OS Issues: No known issues.
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house (well-documented WMIWindows Management Instrumentation Class)
Notes:
- XP+
- Returns the same list as systeminfo
- Article IDs are returned with the KB prefix
Module Specific Structures:
typedef struct _UPDATE_ENTRY_WMI
{
WCHAR *wcKB; //The KB number of the installed update
_UPDATE_ENTRY_WMI *pNextEntry; //Next entry in the linked list
}UPDATE_ENTRY_WMI, *PUPDATE_ENTRY_WMI, UPDATE_LIST_WMI, *PUPDATE_LIST_WMI;
Module Return Codes:
Returns TRUE on success and FALSE on failure.
Example Code:
//KB2954879
WCHAR wcKB[] = L"KB2954879";
//Get the list of updates on the machine
PUPDATE_LIST_WMI pList;
BOOL bRet = MISCEnumerateUpdatesWMI_QFE::GetUpdateList(pList);
//print KBs and find match
BOOL bFoundMatch = FALSE;
PUPDATE_LIST_WMI pNode = pList;
while (pNode != NULL)
{
if (pNode->wcKB != NULL)
{
if (wcsicmp(pNode->wcKB, wcKB) == 0)
bFoundMatch = TRUE;
//print out article id
wprintf(L"%s\n", pNode->wcKB);
}
pNode = pNode->pNextEntry;
}
//Free the list
bRet = MISCEnumerateUpdatesWMI_QFE::FreeUpdateList(pList);
SECRET//NOFORN