Unexpected string value from smbios structure

Content Authoring
1

I would like to use the smbios structure to get the UUID of all system types and not have to create a new property for each platform. But when I return a BinaryString value, I don’t see a way to display the expected string value.

Example This test was done on a windows system using the fixlet debugger v.9.0.835.0
Relevance:
if
exists smbios whose (exists structures whose ((name of it as lowercase is “system_information” as lowercase) and (exists values “uuid” of it)) of it)
then
values “uuid” of structures “system_information” of smbios
else
nothing

Result: %80v%ade]%13%e3%11%afD%88Q%fbkP%84

Expected result: 65AD7680-135D-11E3-AF44-8851FB6B5084

Thank you

2

Try it in the console in an analysis.

See this example: http://bigfix.me/analysis/details/2994751

3

I have tried that with the same result.

4

In the debugger:

File -> Preferences -> Uncheck “Percent encode results”

See if that helps.

5

Because that is just a 16 byte binary value it won’t represent well as a string…

If you have to get the UUID then you can use this (I hate suggesting WMI but…)

string values of selects "UUID from Win32_ComputerSystemProduct" of wmi

We do have a type that holds SIDs but not GUID/UUID’s

http://support.bigfix.com/inspectors/Authorization%20Objects_Any.html#security%20identifier

It is probably something we should think about adding at least in a string format. Strangely it IS available on Solaris clients (only)

6

That isn’t it at all, this is something with a binarysring type.

Here is an example of it without the percent encoding.
€v­e]ã¯DˆQûkP„

1 Like
7

yeah the wmi works great for windows, but then I need to do another for mac, linux, aix…

I like the one shot deal if possible.

8

Well SMBIOS is not everywhere… there’s no BIOS on the Mac per se

You really should file an RFE for a UUID inspector so we can do the work for you under the hood.

1 Like
9

If you consider that a UUID is 128 bits (typically represented as 32 hex characters, but is represented as a 16 character string in your result), there is a way to parse the result in Windows to get what you want out of it. Taking the value you received and casting it to hexadecimal you will get all the hex characters of the UUID, just not in the same order you’re expecting.

The SMBIOS reference specification has information on how the bytes are stored under “System - UUID” (section 7.2.1). See: http://dmtf.org/sites/default/files/standards/documents/DSP0134_2.8.0.pdf

In short - the first four bytes, the following 2 bytes, and the 2 bytes after that are all represented in little-endian byte encoding. If you flip each group around and add a couple of hyphens the end result will be the value you’re expecting:

Q: (first 2 of following text of position 6 of it & first 2 of following text of position 4 of it & first 2 of following text of position 2 of it & first 2 of following text of position 0 of it & “-” & first 2 of following text of position 10 of it & first 2 of following text of position 8 of it & “-” & first 2 of following text of position 14 of it & first 2 of following text of position 12 of it & “-” & first 4 of following text of position 16 of it & “-” & following text of position 20 of it) of concatenation “” of (it as hexadecimal) of “%80v%ade]%13%e3%11%afD%88Q%fbkP%84” as uppercase = “65AD7680-135D-11E3-AF44-8851FB6B5084”
A: True

Sourcing the UUID in Windows without WMI:

(first 2 of following text of position 6 of it & first 2 of following text of position 4 of it & first 2 of following text of position 2 of it & first 2 of following text of position 0 of it & “-” & first 2 of following text of position 10 of it & first 2 of following text of position 8 of it & “-” & first 2 of following text of position 14 of it & first 2 of following text of position 12 of it & “-” & first 4 of following text of position 16 of it & “-” & following text of position 20 of it) of concatenation “” of (it as hexadecimal) of characters of (value “uuid” of structures “system_information” of smbios as string) as uppercase

To get the UUID for a Mac you would use:

string “IOPlatformUUID” of dictionary of devicetree plane of iokit registry

I haven’t taken a look at this on the various *nix distributions yet, but if the smbios inspector doesn’t exist or doesn’t have the UUID I would think something exists under /dev on each platform that can be inspected… in the end you would simply have to take each platform’s relevance, wrap them in a collection of if-then-else statements and store it in one property.

10

Thank you!
That did the trick for all windows systems. I will have to manually check *nix systems tomorrow. The inspector doesn’t work for the AIX or Sun, do you have an idea on how I can retrieve the UUID from an AIX system through a property?

The local command would be something like this…
lsattr -El sys0 -a os_uuid -F value

Thanks for all the details this was a good addition to the RFC4122.

Thanks
Chris

11

Most likely on AIX you will have to do that in an action to get it and store it in a file.

For Solaris we actually have a uuid inspector: http://support.bigfix.com/inspectors/System%20Objects_Any.html#uuid