diff --git a/scripts/base/files/pe/consts.bro b/scripts/base/files/pe/consts.bro index 22f246a3e9..c2a17f562c 100644 --- a/scripts/base/files/pe/consts.bro +++ b/scripts/base/files/pe/consts.bro @@ -127,15 +127,31 @@ export { } &default=function(i: count):string { return fmt("unknown-%d", i); }; const os_versions: table[count, count] of string = { - [6,2] = "Windows 8", - [6,1] = "Windows 7", - [6,0] = "Windows Vista", - [5,2] = "Windows XP 64-Bit Edition", + [10,0] = "Windows 10", + [6,4] = "Windows 10 Technical Preview", + [6,3] = "Windows 8.1 or Server 2012 R2", + [6,2] = "Windows 8 or Server 2012", + [6,1] = "Windows 7 or Server 2008 R2", + [6,0] = "Windows Vista or Server 2008", + [5,2] = "Windows XP x64 or Server 2003", [5,1] = "Windows XP", [5,0] = "Windows 2000", [4,90] = "Windows Me", - [4,1] = "Windows 98", - [4,0] = "Windows NT 4.0", + [4,10] = "Windows 98", + [4,0] = "Windows 95 or NT 4.0", + [3,51] = "Windows NT 3.51", + [3,50] = "Windows NT 3.5", + [3,2] = "Windows 3.2", + [3,11] = "Windows for Workgroups 3.11", + [3,10] = "Windows 3.1 or NT 3.1", + [3,0] = "Windows 3.0", + [2,11] = "Windows 2.11", + [2,10] = "Windows 2.10", + [2,0] = "Windows 2.0", + [1,4] = "Windows 1.04", + [1,3] = "Windows 1.03", + [1,1] = "Windows 1.01", + [1,0] = "Windows 1.0", } &default=function(i: count, j: count):string { return fmt("unknown-%d.%d", i, j); }; const section_descs: table[string] of string = { diff --git a/testing/btest/Baseline/scripts.base.files.pe.basic/pe.log b/testing/btest/Baseline/scripts.base.files.pe.basic/pe.log index 5659276fee..f4335adc1d 100644 --- a/testing/btest/Baseline/scripts.base.files.pe.basic/pe.log +++ b/testing/btest/Baseline/scripts.base.files.pe.basic/pe.log @@ -3,11 +3,11 @@ #empty_field (empty) #unset_field - #path pe -#open 2015-04-20-00-26-40 +#open 2015-04-20-16-48-55 #fields ts id machine compile_ts os subsystem is_exe is_64bit uses_aslr uses_dep uses_code_integrity uses_seh has_import_table has_export_table has_cert_table has_debug_data section_names #types time string string time string string bool bool bool bool bool bool bool bool bool bool vector[string] 1429466342.201366 Fz2N9x4SAxQiSnI6mk unknown-475 0.000000 - - F T F F F T - - - - - -1429466342.278998 F5fc4q3zhJHmYSvm8a I386 1402852568.000000 Windows NT 4.0 WINDOWS_GUI T F F F F T T T F F .text,.Ddata,.data,.rsrc -1429466342.225653 Fzysjj1zfjAcgWgm22 I386 1171692517.000000 Windows XP 64-Bit Edition WINDOWS_GUI T F F F F T T F F T .text,.data,.rsrc -1429466342.250474 FOuWFKf04xcHH4ck I386 1210911433.000000 Windows NT 4.0 WINDOWS_CUI T F F F F T T F T T .text,.rdata,.data,.rsrc -#close 2015-04-20-00-26-41 +1429466342.278998 F5fc4q3zhJHmYSvm8a I386 1402852568.000000 Windows 95 or NT 4.0 WINDOWS_GUI T F F F F T T T F F .text,.Ddata,.data,.rsrc +1429466342.225653 Fzysjj1zfjAcgWgm22 I386 1171692517.000000 Windows XP x64 or Server 2003 WINDOWS_GUI T F F F F T T F F T .text,.data,.rsrc +1429466342.250474 FOuWFKf04xcHH4ck I386 1210911433.000000 Windows 95 or NT 4.0 WINDOWS_CUI T F F F F T T F T T .text,.rdata,.data,.rsrc +#close 2015-04-20-16-48-55