Module win-volumes: fix bitlocker loop & check (#7827)
- DriveLetter could be null, extra check - Now use regexp to find the id & recoverypassword, language independent
PTR committed
May 25, 2026 at 17:43 UTC
874f6dfc1de08e66bb53b553b4af0addd7ce2a34
1 file changed
+12
-23
agents/modules_meshcore/win-volumes.js
+12
-23
@@ -61,6 +61,7 @@ function windows_volumes()
61
var values = require('win-wmi').query('ROOT\\CIMV2', 'SELECT * FROM Win32_LogicalDisk', ['DeviceID', 'VolumeName', 'FileSystem', 'Size', 'FreeSpace', 'DriveType']);
62
if(values[0]){
63
for (var i = 0; i < values.length; ++i) {
64
+ if (!values[i]['DeviceID']) { continue; } //always check for null to be sure
65
var drive = values[i]['DeviceID'].slice(0,-1);
66
ret[drive] = {
67
name: (values[i]['VolumeName'] ? values[i]['VolumeName'] : ""),
@@ -75,7 +76,12 @@ function windows_volumes()
76
try {
77
values = require('win-wmi').query('ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption', 'SELECT * FROM Win32_EncryptableVolume', ['DriveLetter','ConversionStatus','ProtectionStatus']);
78
if(values[0]){
79
+ // RegExps for the specific patterns in the manage-bde output, case-insensitive multiline
80
+ var reID = new RegExp("{[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}}", "mi");
81
+ var rePass = new RegExp("[0-9]{6}-[0-9]{6}-[0-9]{6}-[0-9]{6}-[0-9]{6}-[0-9]{6}-[0-9]{6}-[0-9]{6}", "mi");
82
+ var id, rp;
83
for (var i = 0; i < values.length; ++i) {
84
+ if (!values[i]['DriveLetter']) { continue; } //There can be volumes withouth a DriveLetter(=null), which errors the slice. Skip for now, fix later
85
var drive = values[i]['DriveLetter'].slice(0,-1);
86
var statuses = {
87
0: 'FullyDecrypted',
@@ -88,32 +94,15 @@ function windows_volumes()
94
ret[drive].volumeStatus = statuses.hasOwnProperty(values[i].ConversionStatus) ? statuses[values[i].ConversionStatus] : 'FullyDecrypted';
95
ret[drive].protectionStatus = (values[i].ProtectionStatus == 0 ? 'Off' : (values[i].ProtectionStatus == 1 ? 'On' : 'Unknown'));
96
try {
91
- var foundIDMarkedLine = false, foundMarkedLine = false, identifier = '', password = '';
97
var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'manage-bde -protectors -get ' + drive + ': -Type recoverypassword'], {});
98
keychild.stdout.str = ''; keychild.stdout.on('data', function (c) { this.str += c.toString(); });
99
keychild.waitExit();
95
- var lines = keychild.stdout.str.trim().split('\r\n');
96
- for (var x = 0; x < lines.length; x++) { // Loop each line
97
- var abc = lines[x].trim();
98
- var englishidpass = (abc !== '' && abc.includes('Numerical Password:')); // English ID
99
- var germanidpass = (abc !== '' && abc.includes('Numerisches Kennwort:')); // German ID
100
- var frenchidpass = (abc !== '' && abc.includes('Mot de passe num')); // French ID
101
- var englishpass = (abc !== '' && abc.includes('Password:') && !abc.includes('Numerical Password:')); // English Password
102
- var germanpass = (abc !== '' && abc.includes('Kennwort:') && !abc.includes('Numerisches Kennwort:')); // German Password
103
- var frenchpass = (abc !== '' && abc.includes('Mot de passe :') && !abc.includes('Mot de passe num')); // French Password
104
- if (englishidpass || germanidpass || frenchidpass|| englishpass || germanpass || frenchpass) {
105
- var nextline = lines[x + 1].trim();
106
- if (x + 1 < lines.length && (nextline !== '' && (nextline.startsWith('ID:') || nextline.startsWith('ID :')) )) {
107
- identifier = nextline.replace('ID:','').replace('ID :', '').trim();
108
- foundIDMarkedLine = true;
109
- }else if (x + 1 < lines.length && nextline !== '') {
110
- password = nextline;
111
- foundMarkedLine = true;
112
- }
113
- }
114
- }
115
- ret[drive].identifier = (foundIDMarkedLine ? identifier : ''); // Set Bitlocker Identifier
116
- ret[drive].recoveryPassword = (foundMarkedLine ? password : ''); // Set Bitlocker Password
100
+ // find position of pattern, or null if not found
101
+ id = keychild.stdout.str.match(reID);
102
+ rp = keychild.stdout.str.match(rePass);
103
+ // recoveryPW can be empty if volume is locked
104
+ if (id) { ret[drive].identifier = id[0]; }
105
+ if (rp) { ret[drive].recoveryPassword = rp[0]; }
106
} catch(ex) { } // just carry on as we cant get bitlocker key
107
}
108
}