Open-AudIT

Hi All,

I'm gearing up for the next release but have run into an issue...
I am putting a button on the front page that when clicked, will send you audit_windows.vbs - you can run or save it.
All good so far.
If you save it, then run it via the command line (as normal), things work as intended.
If you save it and double click on it in Windows Explorer or if you try to run it instead of saving it (from the web page), and error is produced.
Line: 6365 (my line match is below)
Char: 2
Error: Type mismatch

My corresponding line is the "do" line after szPossibleChars = "BCDFGHJKMPQRTVWXY2346789".

Can anyone try running their copy of audit_windows.vbs by double clicking on it and letting me know if it works or not?

PS - for now I have wrapped it in a "on error resume next" and it works, but I'd rather not kludge it like that

EDIT - It gets worse... If I run the script directly from the download then save and run the script (both times successfully submitting the result), I get some oddities.

If I check the Windows CD key after the first submit it's "BBBBB-BBBBB-BBBBB-BBBBB-BBBBB", but after the second submit it shows the correct key. This seems to be related to the "on error resume next" fix - it doesn't error out and proceeds (getting the incorrect key as it goes when run from the web page).

Also, the directly run audit (from the web page) retrieves quite a few software packages (database drivers) that the command line run script does not - and in addition, the Parallels Tools package it listed as un-installed - weird.

So I'm getting different results depending on "how" I run the script. The CD Key is one issue, the additional software is another. It's the same damn code

EDIT #2 - I just tried running it by double clicking, then running via the command line. It seem's to work if you do that... So it's only if you run it directly from the web page that it is not matching.

Thanks in advance.

[code]function getkey(rpk,ver)
' location of key in DigitalProductID changed in Office 2010.
' http://code.google.com/p/msoffice-product-key-decoder/
if ver = "1" then
rpkOffset = 52
else
rpkOffset = 808
end if
i=28
szPossibleChars = "BCDFGHJKMPQRTVWXY2346789"
do
dwAccumulator = 0 : j = 14
do
dwAccumulator = dwAccumulator * 256
dwAccumulator = rpk(j+rpkOffset) + dwAccumulator
rpk(j+rpkOffset) = (dwAccumulator\24) and 255
dwAccumulator = dwAccumulator Mod 24
j = j - 1
loop while j>=0
i=i-1 :
szProductKey = mid(szPossibleChars,dwAccumulator+1,1) & szProductKey
if (((29-i) Mod 6)=0) and (i<>-1) then
i = i - 1 : szProductKey = "-" & szProductKey
end if
loop while i>=0
getkey = szProductKey
end function[/code]

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

I can't replicate this.

However, opening the audits directly from the download is really crappy as it runs in wscript and pops a million boxes if you have the debug level > 0. I think you should test for wscript and shell out to cscript instead. Or something.

Also, while testing I couldn't get the output file created on certain machines. I have some unicode characters in the output which cause the file output to fail. I changed my audit to [url=http://msdn.microsoft.com/en-us/library/314cz14s%28v=vs.84%29.aspx]open the text file as unicode[/url] and the file was created correctly.

Hey JPA - damn, I was hoping it wasn't "just me"... I'll try it again on another windows box.

FYI - When you click the "Audit my PC" button on the (new) logon page, the script is modified and sent to you with:
- debugging set to 0
- URL set to whatever the browser was pointing at
- Submit online set to y
- Create file set to n
All nice and clever there

I'll take a look at the URL text file output.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

What browser are you using? Most of the modern stuff I try doesn't even want to run a downloaded VBS. Maybe it's my security settings.

Using IE - not sure which version it was (still having morning coffee)....
I did try adding the OA Server too the list of "Intranet Sites" - didn't make any difference (so not required).
I might try installing FF and Chrome, but I suspect they would both not be happy with a .vbs

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

Sorry, my bad. I just realized there are multiple code paths to the win key decode. I was testing on 32bit machines but now that I've tested on a 64bit machine I see the error. I'll let you know what I find. But I do know there is practically no error checking in the key routines. So I'm sure rpk is not an array or something simple like that.

When auto running from IE on a 64bit machine you're running the script in c:\windows\syswow64\wscript.exe which gives the error. Then you start a command prompt and run the very same code in c:\windows\system32\wscript.exe and don't get the error. As you said - same code, different outcome.

We don't test if we've successfully retrieved the DigitalProductID in the "MS CD Keys for Windows 2000 onwards" section before trying to decode the value. We don't succeed when under SysWOW64.

I don't see a simple one-line type fix. The logic of decoding Win 64bit CD keys needs work.

[quote]When auto running from IE on a 64bit machine you're running the script in c:\windows\syswow64\wscript.exe which gives the error. Then you start a command prompt and run the very same code in c:\windows\system32\wscript.exe and don't get the error.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

If you look over the rest of the code that's not enough. You skip the thing causing the error but then you go and decode the DigitalProductID which on the newer Windows gets you a bunch of BBB's and then you skip decoding DigitalProductID4. Probably just a few logic changes but something more than a Not IsNull test.

Yep - it took a little bit more than that, but I've at least fixed the keys when running "from the webpage"...
Now I am looking at why the database drivers are different.

EDIT - I can see why it's doing this. When you run audit_windows.vbs via the command line, it only retrieves SQL Server ODBC (on my laptop). This matches the registry when opened via regedit on the command line. When you run audit_windows via WOW64 (as when running it from the web page), you get all the other default drivers (Microsoft ODBC for Oracle, Microsoft Access Driver, etc, etc). Now to work out how to fix it...

EDIT - OK, fixed the ODBC issue.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

Also ODBC is just a straight registry read so you're only getting the 32 or 64 bit stuff depending on your script environment. I wonder if there are other similar problems in the script?

Last one now... A couple of items appear in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall but not in HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

Effectively this means they are all being seen when run from the command line, but the first section is not being seen (and hence the installed programs not found) when run from the web page. My examples are "WinRAR 4.20 (64-bit)" and "Synaptics Pointing Device Driver".

Any pointers on how to make HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall be seen when running from c:\windows\syswow64\wscript.exe (IE - run from a web page on 64bit Windows) would be appreciated.

EDIT - the problem would seem to be that when running via a web page, c:\windows\SysWow64\regedit.exe is being used - which is the 32 bit version which shows (this is weird) the HKLM\SOFTWARE\Wow6434Node\... stuff as HKLM\SOFTWARE\Microsoft\... Hence, we don't see the original HKLM\SOFTWARE\Microsoft\... items as when editing via 64bit regedit. Not sure if those keys are somewhere else when using that version of regedit. Looking now.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

You already do this in several places. You just need to indicate which registry you want - 32 or 64 bit.

[code] Set objCtx = CreateObject("WbemScripting.SWbemNamedValueSet")
objCtx.Add "__ProviderArchitecture", 64
objCtx.Add "__RequiredArchitecture", TRUE
Set objLocator = CreateObject("Wbemscripting.SWbemLocator")

if strUser <> "" then
' Username & Password provided - assume not a domain local PC.
Set objServices = objLocator.ConnectServer(strComputer, "root\default", strUser, strPass, "", "", wbemConnectFlagUseMaxWait, objCtx)
else
Set objServices = objLocator.ConnectServer(strComputer, "root\default", "", "", "", "", wbemConnectFlagUseMaxWait, objCtx)
end if
Set o64reg = objServices.Get("StdRegProv") [/code]
You should just define a few registry read functions that take a parameter for the ProviderArchitecture. You'd need a ReadRegString and ReadRegBinary.

Thanks JPA. All done now (phew). Took some work, but it now returns the same result, regardless of how it is run. Naturally this makes it take slightly longer, but that's just how it is.

FYI - In the next version, on the logon page, if you are running Windows you will see a button titled "Audit my PC". Click it, click YES twice (in Internet Explorer) and it will run and audit your machine and send the result back. Sweet.

At the moment there is no feedback (debugging is set to 0). Do you think I should have a pop up saying "starting audit" then "finished audit"? It would mean the pop ups would HAVE to be clicked (at least the first one) for the audit to run.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.