Check Secure Boot status during system checklist

* Fixes issue #60

.bin/Scripts/functions/common.py

@@ -64,12 +64,24 @@ class NotInstalledError(Exception):
 class NoProfilesError(Exception):
     pass
 
+class OSInstalledLegacyError(Exception):
+    pass
+
 class PathNotFoundError(Exception):
     pass
 
 class UnsupportedOSError(Exception):
     pass
 
+class SecureBootDisabledError(Exception):
+    pass
+
+class SecureBootNotAvailError(Exception):
+    pass
+
+class SecureBootUnknownError(Exception):
+    pass
+
 # General functions
 def abort():
     """Abort script."""

.bin/Scripts/functions/diags.py

@@ -1,5 +1,7 @@
 # Wizard Kit: Functions - Diagnostics
 
+import ctypes
+
 from functions.common import *
 
 # STATIC VARIABLES
@@ -30,13 +32,60 @@ def check_connection():
         result = try_and_print(message='Ping test...',  function=ping, cs='OK')
         if result['CS']:
             break
-        else:
         if not ask('ERROR: System appears offline, try again?'):
             if ask('Continue anyway?'):
                 break
             else:
                 abort()
 
+def check_secure_boot_status():
+    """Checks UEFI Secure Boot status via PowerShell."""
+    boot_mode = get_boot_mode()
+    cmd = ['PowerShell', '-Command', 'Confirm-SecureBootUEFI']
+    result = run_program(cmd, check=False)
+
+    # Check results
+    if result.returncode == 0:
+        out = result.stdout.decode()
+        if 'True' in out:
+            # It's on, do nothing
+            return
+        elif 'False' in out:
+            raise SecureBootDisabledError
+        else:
+            raise SecureBootUnknownError
+    else:
+        if boot_mode != 'UEFI':
+            raise OSInstalledLegacyError
+        else:
+          # Check error message
+          err = result.stderr.decode()
+          if 'Cmdlet not supported' in err:
+              raise SecureBootNotAvailError
+          else:
+              raise GenericError
+
+def get_boot_mode():
+    """Check if Windows is booted in UEFI or Legacy mode, returns str."""
+    kernel = ctypes.windll.kernel32
+    firmware_type = ctypes.c_uint()
+
+    # Get value from kernel32 API
+    try:
+        kernel.GetFirmwareType(ctypes.byref(firmware_type))
+    except:
+        # Just set to zero
+        firmware_type = ctypes.c_uint(0)
+
+    # Set return value
+    type_str = 'Unknown'
+    if firmware_type.value == 1:
+        type_str = 'Legacy'
+    elif firmware_type.value == 2:
+        type_str = 'UEFI'
+
+    return type_str
+
 def run_autoruns():
     """Run AutoRuns in the background with VirusTotal checks enabled."""
     extract_item('Autoruns', filter='autoruns*', silent=True)

.bin/Scripts/system_checklist.py

@@ -24,11 +24,17 @@ if __name__ == '__main__':
         ticket_number = get_ticket_number()
         other_results = {
             'Error': {
-                'CalledProcessError':   'Unknown Error',
                 'BIOSKeyNotFoundError':     'BIOS key not found',
+                'CalledProcessError':       'Unknown Error',
                 'FileNotFoundError':        'File not found',
+                'GenericError':             'Unknown Error',
+                'SecureBootDisabledError':  'Disabled',
             },
-            'Warning': {}}
+            'Warning': {
+                'OSInstalledLegacyError':   'OS installed Legacy',
+                'SecureBootNotAvailError':  'Not available',
+                'SecureBootUnknownError':   'Unknown',
+            }}
         if ENABLED_TICKET_NUMBERS:
             print_info('Starting System Checklist for Ticket #{}\n'.format(
                 ticket_number))
@@ -76,6 +82,8 @@ if __name__ == '__main__':
             try_and_print(message='BIOS Activation:',
                 function=activate_with_bios,
                 other_results=other_results)
+        try_and_print(message='Secure Boot Status:',
+            function=check_secure_boot_status, other_results=other_results)
         try_and_print(message='Installed RAM:',
             function=show_installed_ram, ns='Unknown', silent_function=False)
         show_free_space()