Jump to content

parsing bitlocker encryption results

gcue

By gcue,
in AutoIt General Help and Support

 Share

Recommended Posts

gcue Universalist

gcue

Posted
Posted (edited)

hello world =)

i am using the script below to capture the bitlocker encryption status of a remote PC.  works great but breaks if the user has another drive like a usb flash drive connected

is there a way to isolate each device result into an array?  it gets difficult because theres a blank line in between results..

#include <Constants.au3>
#include <array.au3>

$msg_normal = 0

$strComputer = "."

Local $line

$values = "'" & $strComputer & "',"


Local $foo = Run(@ComSpec & ' /c manage-bde -status -cn ' & $strComputer, @SystemDir, @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD)


While 1
$line = StdoutRead($foo)
If @error Then ExitLoop
If StringInStr($line, "Size:") <> 0 Then
$array = StringRegExp($line, "Size:([\h\w\W\d_]*)", 3)
Debug($array)
$size = StringStripWS($array[0], 1 + 2)
$values &= "'" & $size & "',"
EndIf

If StringInStr($line, "Conversion Status:") <> 0 Then
$array = StringRegExp($line, "Conversion Status:([\h\w\d_]*)", 3)
$conversion_status = StringStripWS($array[0], 1 + 2)
$values &= "'" & $conversion_status & "',"
EndIf

If StringInStr($line, "Percentage Encrypted:") <> 0 Then
$array = StringRegExp($line, "Percentage Encrypted:([\h\W\d_]*)", 3)
$percentage_encrypted = StringStripWS($array[0], 1 + 2)
$values &= "'" & $percentage_encrypted & "',"
EndIf

If StringInStr($line, "Protection Status:") <> 0 Then
$array = StringRegExp($line, "Protection Status:([\h\w\d_]*)", 3)
$protection_status = StringStripWS($array[0], 1 + 2)
$values &= "'" & $protection_status & "',"
EndIf

If StringInStr($line, "Lock Status:") <> 0 Then
$array = StringRegExp($line, "Lock Status:([\h\w\d_]*)", 3)
$lock_status = StringStripWS($array[0], 1 + 2)
$values &= "'" & $lock_status & "'"
EndIf
WEnd

Debug($values)

Func Debug($variable1 = "", $variable2 = "", $variable3 = "")

;~  #include <array.au3>
;~  $msg_normal = 0

If IsArray($variable1) Then
_ArrayDisplay($variable1)
Else
If $variable2 <> "" Then
$variable1 &= @CRLF & $variable2
EndIf

If $variable3 <> "" Then
$variable1 &= @CRLF & $variable3
EndIf

ClipPut($variable1)
MsgBox($msg_normal, "Debug", $variable1)
EndIf


EndFunc   ;==>Debug

example output to process (including more than 1 device)

BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright © Microsoft Corporation. All rights reserved.
 
Computer Name: GHAR2912
 
Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume E: [GSDBOOTKEY]
[Data Volume]
 
    Size:                 1.24 GB
    BitLocker Version:    None
    Conversion Status:    Fully Decrypted
    Percentage Encrypted: 0%
    Encryption Method:    None
    Protection Status:    Protection Off
    Lock Status:          Unlocked
    Identification Field: None
    Automatic Unlock:     Disabled
    Key Protectors:       None Found
 
Volume C: [L0132011 ]
[OS Volume]
 
    Size:                 167.39 GB
    BitLocker Version:    Windows 7
    Conversion Status:    Fully Encrypted
    Percentage Encrypted: 100%
    Encryption Method:    AES 128 with Diffuser
    Protection Status:    Protection On
    Lock Status:          Unlocked
    Identification Field: CGC
    Key Protectors:
        TPM
        Numerical Password

 

 

Thank you in advance!

Edited by gcue
Link to comment
Share on other sites
guinness Universalist

guinness

Posted
Posted

If you post code make sure it's runnable. What is the expected output for each element? i.e. What do you expect?

 I am sure someone will come along and make a lucky guess, but I am not up for second guessing what you want. Oh, and in the class having w d _ is bloat, as w includes digits and underscore.

UDF List:

 
_AdapterConnections() • _AlwaysRun() • _AppMon() • _AppMonEx() • _ArrayFilter/_ArrayReduce • _BinaryBin() • _CheckMsgBox() • _CmdLineRaw() • _ContextMenu() • _ConvertLHWebColor()/_ConvertSHWebColor() • _DesktopDimensions() • _DisplayPassword() • _DotNet_Load()/_DotNet_Unload() • _Fibonacci() • _FileCompare() • _FileCompareContents() • _FileNameByHandle() • _FilePrefix/SRE() • _FindInFile() • _GetBackgroundColor()/_SetBackgroundColor() • _GetConrolID() • _GetCtrlClass() • _GetDirectoryFormat() • _GetDriveMediaType() • _GetFilename()/_GetFilenameExt() • _GetHardwareID() • _GetIP() • _GetIP_Country() • _GetOSLanguage() • _GetSavedSource() • _GetStringSize() • _GetSystemPaths() • _GetURLImage() • _GIFImage() • _GoogleWeather() • _GUICtrlCreateGroup() • _GUICtrlListBox_CreateArray() • _GUICtrlListView_CreateArray() • _GUICtrlListView_SaveCSV() • _GUICtrlListView_SaveHTML() • _GUICtrlListView_SaveTxt() • _GUICtrlListView_SaveXML() • _GUICtrlMenu_Recent() • _GUICtrlMenu_SetItemImage() • _GUICtrlTreeView_CreateArray() • _GUIDisable() • _GUIImageList_SetIconFromHandle() • _GUIRegisterMsg() • _GUISetIcon() • _Icon_Clear()/_Icon_Set() • _IdleTime() • _InetGet() • _InetGetGUI() • _InetGetProgress() • _IPDetails() • _IsFileOlder() • _IsGUID() • _IsHex() • _IsPalindrome() • _IsRegKey() • _IsStringRegExp() • _IsSystemDrive() • _IsUPX() • _IsValidType() • _IsWebColor() • _Language() • _Log() • _MicrosoftInternetConnectivity() • _MSDNDataType() • _PathFull/GetRelative/Split() • _PathSplitEx() • _PrintFromArray() • _ProgressSetMarquee() • _ReDim() • _RockPaperScissors()/_RockPaperScissorsLizardSpock() • _ScrollingCredits • _SelfDelete() • _SelfRename() • _SelfUpdate() • _SendTo() • _ShellAll() • _ShellFile() • _ShellFolder() • _SingletonHWID() • _SingletonPID() • _Startup() • _StringCompact() • _StringIsValid() • _StringRegExpMetaCharacters() • _StringReplaceWholeWord() • _StringStripChars() • _Temperature() • _TrialPeriod() • _UKToUSDate()/_USToUKDate() • _WinAPI_Create_CTL_CODE() • _WinAPI_CreateGUID() • _WMIDateStringToDate()/_DateToWMIDateString() • Au3 script parsing • AutoIt Search • AutoIt3 Portable • AutoIt3WrapperToPragma • AutoItWinGetTitle()/AutoItWinSetTitle() • Coding • DirToHTML5 • FileInstallr • FileReadLastChars() • GeoIP database • GUI - Only Close Button • GUI Examples • GUICtrlDeleteImage() • GUICtrlGetBkColor() • GUICtrlGetStyle() • GUIEvents • GUIGetBkColor() • Int_Parse() & Int_TryParse() • IsISBN() • LockFile() • Mapping CtrlIDs • OOP in AutoIt • ParseHeadersToSciTE() • PasswordValid • PasteBin • Posts Per Day • PreExpand • Protect Globals • Queue() • Resource Update • ResourcesEx • SciTE Jump • Settings INI • SHELLHOOK • Shunting-Yard • Signature Creator • Stack() • Stopwatch() • StringAddLF()/StringStripLF() • StringEOLToCRLF() • VSCROLL • WM_COPYDATA • More Examples...

Updated: 22/04/2018

Link to comment
Share on other sites
gcue Universalist

gcue

Posted
  • Author
Posted

sorry i didnt read your message very carefully haha sorry about that.

the command shows encryption status for the hard drives found in the remote PC.  the script works if there's only one drive in the system.. but doesnt if there's multiple

id like to be able to build an array of results for each device if possible

thanks again!

Link to comment
Share on other sites
sahsanu Universalist

sahsanu

Posted
Posted

Hello,

Just an example to put the Volumes found into a 2D array:

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_UseX64=y   ; I added this just to allow the script run properly on my 64 bits machine
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****

#include <Array.au3>

$strComputer = "."
$iPid = Run(@ComSpec & ' /c manage-bde -status -cn ' & $strComputer, @SystemDir, @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD)

Local $sOutput = ""
While 1
    $sOutput &= StdoutRead($iPid)
    If @error Then
        ExitLoop
    EndIf
WEnd


$array = StringRegExp($sOutput, ".+", 3)
Local $arrayVolumes[17][5] ;this array allows 17 lines of information per Volume and max 5 volumes per computer
$countrow = 0
$countcolumn = 0
For $i = 0 To UBound($array) - 1
    If StringRegExp($array[$i], "(?i)Volume [a-z]:.+") Then
        $arrayVolumes[$countrow][$countcolumn] = StringStripWS($array[$i], 1)
        For $x = $i + 1 To UBound($array) - 1
            If StringRegExp($array[$x], "(?i)Volume [a-z]:.+") Then
                $countcolumn += 1
                $arrayVolumes[$countrow][$countcolumn] = StringStripWS($array[$x], 1)
                $countrow = 0
                ExitLoop
            ElseIf StringStripWS($array[$x],1) <> "" Then
                $countrow += 1
                $arrayVolumes[$countrow][$countcolumn] = StringStripWS($array[$x], 1)
            EndIf
        Next
    EndIf
Next


_ArrayDisplay($arrayVolumes)

Remove empty lines/columns in 2D array or do whatever you need with that array is your homework ;). I hope at least it could show you just one way to put the volumes into an array.

I'm sure it could be done in an easy way so maybe one of our forum buddies will improve it in just a couple of lines ;)

Cheers,

sahsanu

Link to comment
Share on other sites
guinness Universalist

guinness

Posted
Posted

I dunno what jchd thinks, but I need the expected output, e.g. what each element should contain. I asked for this back in post #2.

UDF List:

 
_AdapterConnections() • _AlwaysRun() • _AppMon() • _AppMonEx() • _ArrayFilter/_ArrayReduce • _BinaryBin() • _CheckMsgBox() • _CmdLineRaw() • _ContextMenu() • _ConvertLHWebColor()/_ConvertSHWebColor() • _DesktopDimensions() • _DisplayPassword() • _DotNet_Load()/_DotNet_Unload() • _Fibonacci() • _FileCompare() • _FileCompareContents() • _FileNameByHandle() • _FilePrefix/SRE() • _FindInFile() • _GetBackgroundColor()/_SetBackgroundColor() • _GetConrolID() • _GetCtrlClass() • _GetDirectoryFormat() • _GetDriveMediaType() • _GetFilename()/_GetFilenameExt() • _GetHardwareID() • _GetIP() • _GetIP_Country() • _GetOSLanguage() • _GetSavedSource() • _GetStringSize() • _GetSystemPaths() • _GetURLImage() • _GIFImage() • _GoogleWeather() • _GUICtrlCreateGroup() • _GUICtrlListBox_CreateArray() • _GUICtrlListView_CreateArray() • _GUICtrlListView_SaveCSV() • _GUICtrlListView_SaveHTML() • _GUICtrlListView_SaveTxt() • _GUICtrlListView_SaveXML() • _GUICtrlMenu_Recent() • _GUICtrlMenu_SetItemImage() • _GUICtrlTreeView_CreateArray() • _GUIDisable() • _GUIImageList_SetIconFromHandle() • _GUIRegisterMsg() • _GUISetIcon() • _Icon_Clear()/_Icon_Set() • _IdleTime() • _InetGet() • _InetGetGUI() • _InetGetProgress() • _IPDetails() • _IsFileOlder() • _IsGUID() • _IsHex() • _IsPalindrome() • _IsRegKey() • _IsStringRegExp() • _IsSystemDrive() • _IsUPX() • _IsValidType() • _IsWebColor() • _Language() • _Log() • _MicrosoftInternetConnectivity() • _MSDNDataType() • _PathFull/GetRelative/Split() • _PathSplitEx() • _PrintFromArray() • _ProgressSetMarquee() • _ReDim() • _RockPaperScissors()/_RockPaperScissorsLizardSpock() • _ScrollingCredits • _SelfDelete() • _SelfRename() • _SelfUpdate() • _SendTo() • _ShellAll() • _ShellFile() • _ShellFolder() • _SingletonHWID() • _SingletonPID() • _Startup() • _StringCompact() • _StringIsValid() • _StringRegExpMetaCharacters() • _StringReplaceWholeWord() • _StringStripChars() • _Temperature() • _TrialPeriod() • _UKToUSDate()/_USToUKDate() • _WinAPI_Create_CTL_CODE() • _WinAPI_CreateGUID() • _WMIDateStringToDate()/_DateToWMIDateString() • Au3 script parsing • AutoIt Search • AutoIt3 Portable • AutoIt3WrapperToPragma • AutoItWinGetTitle()/AutoItWinSetTitle() • Coding • DirToHTML5 • FileInstallr • FileReadLastChars() • GeoIP database • GUI - Only Close Button • GUI Examples • GUICtrlDeleteImage() • GUICtrlGetBkColor() • GUICtrlGetStyle() • GUIEvents • GUIGetBkColor() • Int_Parse() & Int_TryParse() • IsISBN() • LockFile() • Mapping CtrlIDs • OOP in AutoIt • ParseHeadersToSciTE() • PasswordValid • PasteBin • Posts Per Day • PreExpand • Protect Globals • Queue() • Resource Update • ResourcesEx • SciTE Jump • Settings INI • SHELLHOOK • Shunting-Yard • Signature Creator • Stack() • Stopwatch() • StringAddLF()/StringStripLF() • StringEOLToCRLF() • VSCROLL • WM_COPYDATA • More Examples...

Updated: 22/04/2018

Link to comment
Share on other sites
jchd Universalist

jchd

Posted
Posted (edited)

That's the missing part of the "problem". Once we are given a (definitive) list of characteristics gcue is interested in for every volume, then building a regexp returning the desired array should be pretty easy (from what I see).

To make clear what I mean, picking the numeric value of Size without indication of unit seems pretty meaningless to me. For instance a partition on a volume might well be 1.08 Gb or 1.08 Tb. Grabbing 1.08 only means nothing more than 42.

Edited by jchd

This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Link to comment
Share on other sites
sahsanu Universalist

sahsanu

Posted
Posted

actually i found an easier way....

the STATUS switch allows us to specify VOLUME.  so i listed out the local disk drives and looped through them to get each result

 

And that is the reason you should specify what are the exact requirements you need to accomplish the task :P

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...