Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correctly detect Windows 11 builds #714

Merged
merged 4 commits into from
Jun 27, 2024
Merged

Correctly detect Windows 11 builds #714

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ce8129b
correctly detect windows 11 builds
JSCU-CNI May 27, 2024
9adca9c
Merge branch 'main' into improvement/windows-11-version-detection
JSCU-CNI May 27, 2024
607e1a7
Update dissect/target/plugins/os/windows/_os.py
JSCU-CNI Jun 27, 2024
f15c801
Merge branch 'main' into improvement/windows-11-version-detection
JSCU-CNI Jun 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions dissect/target/plugins/os/windows/_os.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,13 +244,21 @@ def _part_str(parts: dict[str, Any], name: str) -> str:
if any(map(lambda value: value is not None, version_parts.values())):
version = []

nt_version = _part_str(version_parts, "CurrentVersion")
build_version = _part_str(version_parts, "CurrentBuildNumber")
prodcut_name = _part_str(version_parts, "ProductName")
version.append(prodcut_name)

nt_version = _part_str(version_parts, "CurrentVersion")
# CurrentBuildNumber >= 22000 on NT 10.0 indicates Windows 11.
# https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
try:
if float(nt_version) == 10.0 and int(build_version) >= 22_000:
JSCU-CNI marked this conversation as resolved.
Show resolved Hide resolved
prodcut_name = prodcut_name.replace("Windows 10", "Windows 11")
except ValueError:
pass

version.append(prodcut_name)
version.append(f"(NT {nt_version})")

build_version = _part_str(version_parts, "CurrentBuildNumber")
ubr = version_parts["UBR"]
if ubr:
build_version = f"{build_version}.{ubr}"
Expand Down
20 changes: 20 additions & 0 deletions tests/plugins/os/windows/test__os.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,26 @@ def test_windowsplugin__nt_version(
],
"<Unknown ProductName> (NT <Unknown CurrentVersion>) <Unknown CurrentBuildNumber> 5678",
),
(
[
("ProductName", "Windows 10 Pro"),
("CurrentMajorVersionNumber", 10),
("CurrentMinorVersionNumber", 0),
("CurrentBuildNumber", 19_045),
("UBR", 1234),
],
"Windows 10 Pro (NT 10.0) 19045.1234",
),
(
[
("ProductName", "Windows 10 Enterprise"),
("CurrentMajorVersionNumber", 10),
("CurrentMinorVersionNumber", 0),
("CurrentBuildNumber", 22_000),
("UBR", 1234),
],
"Windows 11 Enterprise (NT 10.0) 22000.1234",
),
],
)
def test_windowsplugin_version(
Expand Down