MultiOS Check relevance

Hello

I want to write a relevance to MultiOS Check.

run → msconfig → Boot
If you look below, in case of MultiOS, two OSs are displayed as shown in the attached picture.

MultiOS in case of 2 or more
If there is only one, I want to create a column that is expressed in the console expressing SingOS.

How should I write relevance?

I need help

You’d need an action to run something like ‘bcdedit.exe /enum’, output that to a file, and read the resulting file in an Analysis.

@JasonWalker

It’s more complicated than I thought

But I think it is too much work to create and read files for the current bigfixclients.

Is there another way?

Careful what you ask for! :slight_smile:

json of ("{" & concatenation ", " of (("%22" & name of it & "%22: {" & concatenation ", " of (("%22Type%22: %22" & it & "%22") of concatenation ": " of (concatenation of items 1 of items 0 of (((101, "Application: Firmware");(102,"Application: Windows Boot");(103,"Application: Legacy Loader");(104,"Application: Real-Mode");(201,"Inheritable: by any object");(202, "Inheritable: by application object");(203,"Inheritable: by device object");(300,"Device")), first 3 of (it as string) as integer) whose (item 1 of it = item 0 of item 0 of it) | "Unknown"; concatenation of items 1 of items 0 of (((1,"fwbootmgr");(2,"bootmgr");(3,"osloader");(4,"resume");(5,"memdiag");(6,"ntldr");(7,"setupldr");(8,"bootsector");(9,"startup");(10,"bootapp")), last 4 of (it as string) as integer) whose (item 1 of it = item 0 of item 0 of it) | "") whose (it != "") of (value "Type" of key "Description" of it as integer as hexadecimal); ("%22" & (concatenation of preceding texts of last "|" of following text of first "|" of item 0 of it) & "%22: " & concatenation of items 1 of items 1 of (following text of last "|" of item 0 of it, (("B", (it as integer | 0 != 0) as string as lowercase);(("I";"IL"), (if (type of it = "REG_BINARY") then (hexadecimal integer (concatenation of characters (lengths of following texts of positions of it) of concatenation of characters (lengths of following texts of positions of it) of firsts 2 of following texts of positions whose (it mod 2 = 0) of (it as string)) as string | "0") else (it as integer as string | "0") | "0"));("OL", ("[" & it & "]") of concatenation ", " of ("%22" & it as string & "%22") of substrings separated by "%00" of preceding texts of lasts "%00%00" of (it as string | ""));(("D";"S"), "%22" & (escape of (it as string) | "") & "%22")) of (item 2 of it)) whose (item 0 of it = item 0 of item 1 of it)) of ((("11000001|Application Device|D";"12000002|Application Path|S";"12000004|Description|S";"12000005|Preferred Locale|S";"14000006|Inherited Objects|OL";"15000007|Truncate Physical Memory|I";"14000008|Recovery Sequence|OL";"16000009|Auto Recovery Enabled|B";"1700000a|Bad Memory List|IL";"1600000b|Allow Bad Memory Access|B";"1500000c|First Megabyte Policy|I";"1500000D|Relocate Physical Memory|I";"1500000E|Avoid Low Physical Memory|I";"16000010|Debugger Enabled|B";"15000011|Debugger Type|I";"15000012|Serial Debugger Port Address|I";"15000013|Serial Debugger Port|I";"15000014|Serial Debugger Baud Rate|I";"15000015|1394 Debugger  Channel|I";"12000016|Usb Debugger Target Name|S";"16000017|Debugger Ignore Usermode Exceptions|B";"15000018|Debugger Start Policy|I";"12000019|Debugger Bus Parameters|S";"1500001A|Debugger Net Host IP|I";"1500001B|Debugger Net Port|I";"1600001C|Debugger Net Dhcp|B";"1200001D|Debugger Net Key|S";"16000020|Ems Enabled|B";"15000022|Ems Port|I";"15000023|Ems Baud Rate|I";"12000030|Load Options String|S";"16000040|Display Advanced Options|B";"16000041|Display Options Edit|B";"11000043|Bsd Log Device|D";"12000044|Bsd Log Path|S";"16000046|Graphics Mode Disabled|B";"15000047|Config Access Policy|I";"16000048|Disable Integrity Checks|B";"16000049|Allow Prerelease Signatures|B";"1200004A|Font Path|S";"1500004B|Si Policy|I";"1500004C|Fve Band Id|I";"16000050|Console Extended Input|B";"15000052|Graphics Resolution|I";"16000053|Restart On Failure|B";"16000054|Graphics Force Highest Mode|B";"16000060|Isolated Execution Context|B";"1600006C|Boot Ux Disable|B";"16000074|Boot Shutdown Disabled|B";"17000077|Allowed In Memory Settings|IL";"16000079|Force Fips Crypto|B"), name of it, value "Element" of it) whose (item 0 of it starts with (item 1 of it & "|"))) of keys of keys "Elements" of it) & "}") of keys of key "HKEY_LOCAL_MACHINE\BCD00000000\Objects" of native registry) & "}")

This will produce a dump (in JSON format) of the BCD database loaded into the registry upon boot.

Applying

(value of key "Description" of it) of values of keys whose (value of key "Type" of value of it as string = "Application: Windows Boot: osloader") of

to the above should give you what you want.

2 Likes