From aa65b8b2d16d618c981c7c6df2def86500fd4a1c Mon Sep 17 00:00:00 2001 From: Diego Araujo Novoa <33570700+diegoara96@users.noreply.github.com> Date: Tue, 5 May 2020 14:44:22 +0200 Subject: [PATCH 1/6] Virtualized MAC and PCI vendor detection --- .../VirtualMachineDetector.cs | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs index 26d4f964..8ee15b0c 100644 --- a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs +++ b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs @@ -15,7 +15,7 @@ namespace SafeExamBrowser.SystemComponents { private ILogger logger; private ISystemInfo systemInfo; - + private static readonly string[] pciVendorBlacklist = { "vbox", "80ee", "qemu", "1af4", "1b36" }; //Virtualbox: VBOX, 80EE RedHat: QUEMU, 1AF4, 1B36 public VirtualMachineDetector(ILogger logger, ISystemInfo systemInfo) { this.logger = logger; @@ -33,6 +33,17 @@ namespace SafeExamBrowser.SystemComponents isVirtualMachine |= manufacturer.Contains("parallels software"); isVirtualMachine |= model.Contains("virtualbox"); isVirtualMachine |= manufacturer.Contains("qemu"); + + var macAddr = (from nic in NetworkInterface.GetAllNetworkInterfaces() where nic.OperationalStatus == OperationalStatus.Up select nic.GetPhysicalAddress().ToString()).FirstOrDefault(); + isVirtualMachine |= ((byte.Parse(macAddr[1].ToString(), NumberStyles.HexNumber) & 2) == 2 || macAddr.StartsWith("080027")); + + using (var searcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT DeviceID FROM Win32_PnPEntity")) + + foreach (ManagementObject queryObj in searcher.Get()) + { + isVirtualMachine |= pciVendorBlacklist.Any(System.Convert.ToString(queryObj.Properties.Cast().First().Value).ToLower().Contains); + + } logger.Debug($"Computer '{systemInfo.Name}' appears to {(isVirtualMachine ? "" : "not ")}be a virtual machine."); From 5bd6e0091d02307a792ca4428d887decb744d1ac Mon Sep 17 00:00:00 2001 From: Diego Araujo Novoa <33570700+diegoara96@users.noreply.github.com> Date: Tue, 5 May 2020 15:09:48 +0200 Subject: [PATCH 2/6] Added a missing namespace --- SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs index 8ee15b0c..e80ac962 100644 --- a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs +++ b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs @@ -8,6 +8,10 @@ using SafeExamBrowser.Logging.Contracts; using SafeExamBrowser.SystemComponents.Contracts; +using System.Globalization; +using System.Linq; +using System.Management; +using System.Net.NetworkInformation;s; namespace SafeExamBrowser.SystemComponents { From 09282a9e959237a04552c94e48e6de0102879f98 Mon Sep 17 00:00:00 2001 From: Diego Araujo Novoa <33570700+diegoara96@users.noreply.github.com> Date: Tue, 5 May 2020 15:13:52 +0200 Subject: [PATCH 3/6] Update VirtualMachineDetector.cs --- SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs index e80ac962..52855d7b 100644 --- a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs +++ b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs @@ -11,7 +11,7 @@ using SafeExamBrowser.SystemComponents.Contracts; using System.Globalization; using System.Linq; using System.Management; -using System.Net.NetworkInformation;s; +using System.Net.NetworkInformation; namespace SafeExamBrowser.SystemComponents { From bcdfa36e0d64e742eb081c13963f00f83e54fe33 Mon Sep 17 00:00:00 2001 From: diegoara96 Date: Wed, 6 May 2020 18:44:08 +0200 Subject: [PATCH 4/6] Fixed mac detection #6 and new Property added --- .../ISystemInfo.cs | 5 ++++ .../SystemInfo.cs | 27 +++++++++++++++++++ .../VirtualMachineDetector.cs | 16 +++++------ 3 files changed, 40 insertions(+), 8 deletions(-) diff --git a/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs b/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs index 18eeb45c..9b6d9742 100644 --- a/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs +++ b/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs @@ -42,5 +42,10 @@ namespace SafeExamBrowser.SystemComponents.Contracts /// Provides detailed version information about the currently running operating system. /// string OperatingSystemInfo { get; } + + /// + /// The MAC Addres of the network addapter + /// + string MacAddress { get; } } } diff --git a/SafeExamBrowser.SystemComponents/SystemInfo.cs b/SafeExamBrowser.SystemComponents/SystemInfo.cs index e0655682..570dd6ef 100644 --- a/SafeExamBrowser.SystemComponents/SystemInfo.cs +++ b/SafeExamBrowser.SystemComponents/SystemInfo.cs @@ -23,6 +23,7 @@ namespace SafeExamBrowser.SystemComponents public string Model { get; private set; } public string Name { get; private set; } public OperatingSystem OperatingSystem { get; private set; } + public string MacAddress { get; private set; } public string OperatingSystemInfo { @@ -34,6 +35,7 @@ namespace SafeExamBrowser.SystemComponents InitializeBattery(); InitializeMachineInfo(); InitializeOperatingSystem(); + InitializeMacAddress(); } private void InitializeBattery() @@ -128,5 +130,30 @@ namespace SafeExamBrowser.SystemComponents { return Environment.Is64BitOperatingSystem ? "x64" : "x86"; } + private void InitializeMacAddress() + { + using (var searcher = new ManagementObjectSearcher("Select MACAddress from Win32_NetworkAdapterConfiguration WHERE DNSDomain IS NOT NULL")) + using (var results = searcher.Get()) + { + if (results.Count > 0) + { + using (var system = results.Cast().First()) + { + foreach (var property in system.Properties) + { + + if (property.Name.Equals("MACAddress")) + { + MacAddress = Convert.ToString(property.Value).Replace(":", "").ToUpper(); + } + } + } + } + else + { + MacAddress = "000000000000"; + } + } + } } } diff --git a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs index 52855d7b..df4b24a6 100644 --- a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs +++ b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs @@ -9,17 +9,17 @@ using SafeExamBrowser.Logging.Contracts; using SafeExamBrowser.SystemComponents.Contracts; using System.Globalization; -using System.Linq; -using System.Management; -using System.Net.NetworkInformation; + namespace SafeExamBrowser.SystemComponents { public class VirtualMachineDetector : IVirtualMachineDetector { + private static readonly string[] PCI_VENDOR_BLACKLIST = { "vbox", "80ee", "qemu", "1af4", "1b36" }; //Virtualbox: VBOX, 80EE RedHat: QUEMU, 1AF4, 1B36 + private ILogger logger; private ISystemInfo systemInfo; - private static readonly string[] pciVendorBlacklist = { "vbox", "80ee", "qemu", "1af4", "1b36" }; //Virtualbox: VBOX, 80EE RedHat: QUEMU, 1AF4, 1B36 + public VirtualMachineDetector(ILogger logger, ISystemInfo systemInfo) { this.logger = logger; @@ -31,6 +31,7 @@ namespace SafeExamBrowser.SystemComponents var isVirtualMachine = false; var manufacturer = systemInfo.Manufacturer.ToLower(); var model = systemInfo.Model.ToLower(); + var macAddress = systemInfo.MacAddress; isVirtualMachine |= manufacturer.Contains("microsoft corporation") && !model.Contains("surface"); isVirtualMachine |= manufacturer.Contains("vmware"); @@ -38,9 +39,8 @@ namespace SafeExamBrowser.SystemComponents isVirtualMachine |= model.Contains("virtualbox"); isVirtualMachine |= manufacturer.Contains("qemu"); - var macAddr = (from nic in NetworkInterface.GetAllNetworkInterfaces() where nic.OperationalStatus == OperationalStatus.Up select nic.GetPhysicalAddress().ToString()).FirstOrDefault(); - isVirtualMachine |= ((byte.Parse(macAddr[1].ToString(), NumberStyles.HexNumber) & 2) == 2 || macAddr.StartsWith("080027")); - + isVirtualMachine |= ((byte.Parse(macAddress[1].ToString(), NumberStyles.HexNumber) & 2) == 2 || macAddress.StartsWith("080027")); + /* using (var searcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT DeviceID FROM Win32_PnPEntity")) foreach (ManagementObject queryObj in searcher.Get()) @@ -48,7 +48,7 @@ namespace SafeExamBrowser.SystemComponents isVirtualMachine |= pciVendorBlacklist.Any(System.Convert.ToString(queryObj.Properties.Cast().First().Value).ToLower().Contains); } - + */ logger.Debug($"Computer '{systemInfo.Name}' appears to {(isVirtualMachine ? "" : "not ")}be a virtual machine."); return isVirtualMachine; From 1de5848edb950fba82c57c36a01c1df801d19609 Mon Sep 17 00:00:00 2001 From: diegoara96 Date: Wed, 6 May 2020 21:45:04 +0200 Subject: [PATCH 5/6] Fixed name Vendor #6 and new Property added --- .../ISystemInfo.cs | 5 ++++ .../SystemInfo.cs | 25 +++++++++++++++++++ .../VirtualMachineDetector.cs | 18 ++++++------- 3 files changed, 38 insertions(+), 10 deletions(-) diff --git a/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs b/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs index 9b6d9742..6ee34b08 100644 --- a/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs +++ b/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs @@ -47,5 +47,10 @@ namespace SafeExamBrowser.SystemComponents.Contracts /// The MAC Addres of the network addapter /// string MacAddress { get; } + + /// + /// Provides the DeviceID information of the user's Plug and Play devices + /// + string[] DeviceId { get; } } } diff --git a/SafeExamBrowser.SystemComponents/SystemInfo.cs b/SafeExamBrowser.SystemComponents/SystemInfo.cs index 570dd6ef..102d66bf 100644 --- a/SafeExamBrowser.SystemComponents/SystemInfo.cs +++ b/SafeExamBrowser.SystemComponents/SystemInfo.cs @@ -7,6 +7,7 @@ */ using System; +using System.Collections.Generic; using System.Linq; using System.Management; using System.Windows.Forms; @@ -24,6 +25,7 @@ namespace SafeExamBrowser.SystemComponents public string Name { get; private set; } public OperatingSystem OperatingSystem { get; private set; } public string MacAddress { get; private set; } + public string[] DeviceId { get; private set; } public string OperatingSystemInfo { @@ -36,6 +38,7 @@ namespace SafeExamBrowser.SystemComponents InitializeMachineInfo(); InitializeOperatingSystem(); InitializeMacAddress(); + InitializePnPDevices(); } private void InitializeBattery() @@ -155,5 +158,27 @@ namespace SafeExamBrowser.SystemComponents } } } + private void InitializePnPDevices() + { + List deviceList = new List(); + using (var searcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT DeviceID FROM Win32_PnPEntity")) + using (var results = searcher.Get()) + { + foreach (ManagementObject queryObj in results) + { + using (queryObj) + foreach (var property in queryObj.Properties) + { + if (property.Name.Equals("DeviceID")) + { + Console.WriteLine(Convert.ToString(property.Value)); + deviceList.Add(Convert.ToString(property.Value).ToLower()); + } + } + } + DeviceId = deviceList.ToArray(); + + } + } } } diff --git a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs index df4b24a6..78201332 100644 --- a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs +++ b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs @@ -9,7 +9,7 @@ using SafeExamBrowser.Logging.Contracts; using SafeExamBrowser.SystemComponents.Contracts; using System.Globalization; - +using System.Linq; namespace SafeExamBrowser.SystemComponents { @@ -32,7 +32,8 @@ namespace SafeExamBrowser.SystemComponents var manufacturer = systemInfo.Manufacturer.ToLower(); var model = systemInfo.Model.ToLower(); var macAddress = systemInfo.MacAddress; - + var deviceId = systemInfo.DeviceId; + isVirtualMachine |= manufacturer.Contains("microsoft corporation") && !model.Contains("surface"); isVirtualMachine |= manufacturer.Contains("vmware"); isVirtualMachine |= manufacturer.Contains("parallels software"); @@ -40,15 +41,12 @@ namespace SafeExamBrowser.SystemComponents isVirtualMachine |= manufacturer.Contains("qemu"); isVirtualMachine |= ((byte.Parse(macAddress[1].ToString(), NumberStyles.HexNumber) & 2) == 2 || macAddress.StartsWith("080027")); - /* - using (var searcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT DeviceID FROM Win32_PnPEntity")) + + foreach (var device in deviceId) + { + isVirtualMachine |= PCI_VENDOR_BLACKLIST.Any(device.ToLower().Contains); - foreach (ManagementObject queryObj in searcher.Get()) - { - isVirtualMachine |= pciVendorBlacklist.Any(System.Convert.ToString(queryObj.Properties.Cast().First().Value).ToLower().Contains); - - } - */ + } logger.Debug($"Computer '{systemInfo.Name}' appears to {(isVirtualMachine ? "" : "not ")}be a virtual machine."); return isVirtualMachine; From 83c82f799f5292dbd489c407c4147e5f708bfa4d Mon Sep 17 00:00:00 2001 From: diegoara96 Date: Thu, 7 May 2020 13:21:57 +0200 Subject: [PATCH 6/6] Minor fixes and Mac > 2 check --- .../ISystemInfo.cs | 4 ++-- .../SystemInfo.cs | 20 +++++++++++-------- .../VirtualMachineDetector.cs | 16 +++++++++------ 3 files changed, 24 insertions(+), 16 deletions(-) diff --git a/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs b/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs index 6ee34b08..e83e32e1 100644 --- a/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs +++ b/SafeExamBrowser.SystemComponents.Contracts/ISystemInfo.cs @@ -44,13 +44,13 @@ namespace SafeExamBrowser.SystemComponents.Contracts string OperatingSystemInfo { get; } /// - /// The MAC Addres of the network addapter + /// The MAC address of the network adapter /// string MacAddress { get; } /// /// Provides the DeviceID information of the user's Plug and Play devices /// - string[] DeviceId { get; } + string[] PlugAndPlayDeviceIds { get; } } } diff --git a/SafeExamBrowser.SystemComponents/SystemInfo.cs b/SafeExamBrowser.SystemComponents/SystemInfo.cs index 102d66bf..3eb62c72 100644 --- a/SafeExamBrowser.SystemComponents/SystemInfo.cs +++ b/SafeExamBrowser.SystemComponents/SystemInfo.cs @@ -25,7 +25,7 @@ namespace SafeExamBrowser.SystemComponents public string Name { get; private set; } public OperatingSystem OperatingSystem { get; private set; } public string MacAddress { get; private set; } - public string[] DeviceId { get; private set; } + public string[] PlugAndPlayDeviceIds { get; private set; } public string OperatingSystemInfo { @@ -133,16 +133,18 @@ namespace SafeExamBrowser.SystemComponents { return Environment.Is64BitOperatingSystem ? "x64" : "x86"; } + private void InitializeMacAddress() { using (var searcher = new ManagementObjectSearcher("Select MACAddress from Win32_NetworkAdapterConfiguration WHERE DNSDomain IS NOT NULL")) using (var results = searcher.Get()) { - if (results.Count > 0) + + if (results != null && results.Count > 0) { - using (var system = results.Cast().First()) + using (var networkAdapter = results.Cast().First()) { - foreach (var property in system.Properties) + foreach (var property in networkAdapter.Properties) { if (property.Name.Equals("MACAddress")) @@ -158,25 +160,27 @@ namespace SafeExamBrowser.SystemComponents } } } + private void InitializePnPDevices() { - List deviceList = new List(); + var deviceList = new List(); using (var searcher = new ManagementObjectSearcher("root\\CIMV2", "SELECT DeviceID FROM Win32_PnPEntity")) using (var results = searcher.Get()) { foreach (ManagementObject queryObj in results) { - using (queryObj) + using (queryObj) + { foreach (var property in queryObj.Properties) { if (property.Name.Equals("DeviceID")) { - Console.WriteLine(Convert.ToString(property.Value)); deviceList.Add(Convert.ToString(property.Value).ToLower()); } } + } } - DeviceId = deviceList.ToArray(); + PlugAndPlayDeviceIds = deviceList.ToArray(); } } diff --git a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs index 78201332..35c1319a 100644 --- a/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs +++ b/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs @@ -32,21 +32,25 @@ namespace SafeExamBrowser.SystemComponents var manufacturer = systemInfo.Manufacturer.ToLower(); var model = systemInfo.Model.ToLower(); var macAddress = systemInfo.MacAddress; - var deviceId = systemInfo.DeviceId; - + var plugAndPlayDeviceIds = systemInfo.PlugAndPlayDeviceIds; + isVirtualMachine |= manufacturer.Contains("microsoft corporation") && !model.Contains("surface"); isVirtualMachine |= manufacturer.Contains("vmware"); isVirtualMachine |= manufacturer.Contains("parallels software"); isVirtualMachine |= model.Contains("virtualbox"); isVirtualMachine |= manufacturer.Contains("qemu"); - - isVirtualMachine |= ((byte.Parse(macAddress[1].ToString(), NumberStyles.HexNumber) & 2) == 2 || macAddress.StartsWith("080027")); - - foreach (var device in deviceId) + + if (macAddress != null && macAddress.Count() > 2) + { + isVirtualMachine |= ((byte.Parse(macAddress[1].ToString(), NumberStyles.HexNumber) & 2) == 2 || macAddress.StartsWith("080027")); + } + + foreach (var device in plugAndPlayDeviceIds) { isVirtualMachine |= PCI_VENDOR_BLACKLIST.Any(device.ToLower().Contains); } + logger.Debug($"Computer '{systemInfo.Name}' appears to {(isVirtualMachine ? "" : "not ")}be a virtual machine."); return isVirtualMachine;