views:

49

answers:

2

Hey guys,

I am trying to decipher the productState property in the SecurityCenter.productState WMI namespace.

The product state is for example an int of : 262144 - which you then look at this page of documentation decipher into an actual product state meaning :

http://msdn.microsoft.com/en-us/library/bb432509(VS.85).aspx

I may have found the wrong piece of documentation but I am trying to decipher a meaning from the product state int - i.e is it up to date - is it running etc etc

But I cannot understand it.

Anyone out their got the understanding!?

Cheers,

Andy

+1  A: 

The value 262144 looks like a bit mask. Did you try to check against those values specified in the link? To perform a check you can use the following code:

int value = 262144;
if ( (value & WSC_SECURITY_PROVIDER_FIREWALL) > 0 )
{ 
     //firewall is installed
}
else if ( (value & WSC_SECURITY_PROVIDER_ANTISPYWARE) > 0 )
{
    //antispyware is installed
}
Vadmyst
262144=0x20000. While I agree that it's most likely a bitmask, that value is well outside the range of enumeration values presented at that page.
Michael Madsen
I suppose that page is incorrect. I just gave the OP a hint with a bitmask approach.
Vadmyst
+1  A: 

The page you link to has nothing to do with the productState value, it's a list of enumeration values that deal with what will be monitored by the Security Center.

The actual meaning of the values of productState, and most Security Center documentation, is, to the best of my knowledge, not public information, but only available under an NDA (see the 4th comment on http://blogs.msdn.com/b/alejacma/archive/2008/05/12/how-to-get-antivirus-information-with-wmi-vbscript.aspx).

Michael Madsen
Ouch how restrictive - I have emailed that email in order to get access to the NDA but I don't know how lenient they are - I am designing a security tool so hopefully they should pay heed to that.
RenegadeAndy
Just as a heads up you will also need to cross-sign your executable with a special Microsoft certificate in order to communicate with the Security Center / Action Center; Microsoft only provides cross-certificates for a handful of certificate authorities, so you're going to have to cough up some dough.
Luke