This code is a mix of PowerShell and embedded C#...

September 4, 2025 at 09:40 PM


$source = @"
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
using System.ComponentModel;
using System.Net.NetworkInformation;

namespace Microsoft.WindowsAzure.Internal
{
    /// <summary>
    /// A simple DHCP client.
    /// </summary>
    public class DhcpClient : IDisposable
    {
        public DhcpClient()
        {
            uint version;
            int err = NativeMethods.DhcpCApiInitialize(out version);
            if (err != 0)
                throw new Win32Exception(err);
        }

        public void Dispose()
        {
            NativeMethods.DhcpCApiCleanup();
        }

        /// <summary>
        /// Gets the available interfaces that are enabled for DHCP.
        /// </summary>
        /// <remarks>
        /// The operational status of the interface is not assessed.
        /// </remarks>
        /// <returns></returns>
        public static IEnumerable<NetworkInterface> GetDhcpInterfaces()
        {
            foreach (NetworkInterface nic in NetworkInterface.GetAllNetworkInterfaces())
            {
                if (nic.NetworkInterfaceType != NetworkInterfaceType.Ethernet) continue;
                if (!nic.Supports(NetworkInterfaceComponent.IPv4)) continue;
                IPInterfaceProperties props = nic.GetIPProperties();
                if (props == null) continue;
                IPv4InterfaceProperties v4props = props.GetIPv4Properties();
                if (v4props == null) continue;
                if (!v4props.IsDhcpEnabled) continue;

                yield return nic;
            }
        }

        /// <summary>
        /// Requests DHCP parameter data.
        /// </summary>
        /// <remarks>
        /// Windows serves the data from a cache when possible.  
        /// With persistent requests, the option is obtained during boot-time DHCP negotiation.
        /// </remarks>
        /// <param name="optionId">the option to obtain.</param>
        /// <param name="isVendorSpecific">indicates whether the option is vendor-specific.</param>
        /// <param name="persistent">indicates whether the request should be persistent.</param>
        /// <returns></returns>
        public byte[] DhcpRequestParams(string adapterName, uint optionId)
        {
            uint bufferSize = 1024;
        Retry:
            IntPtr buffer = Marshal.AllocHGlobal((int)bufferSize);
            try
            {
                NativeMethods.DHCPCAPI_PARAMS_ARRAY sendParams = new NativeMethods.DHCPCAPI_PARAMS_ARRAY();
                sendParams.nParams = 0;
                sendParams.Params = IntPtr.Zero;

                NativeMethods.DHCPCAPI_PARAMS recv = new NativeMethods.DHCPCAPI_PARAMS();
                recv.Flags = 0x0;
                recv.OptionId = optionId;
                recv.IsVendor = false;
                recv.Data = IntPtr.Zero;
                recv.nBytesData = 0;

                IntPtr recdParamsPtr = Marshal.AllocHGlobal(Marshal.SizeOf(recv));
                try
                {
                    Marshal.StructureToPtr(recv, recdParamsPtr, false);

                    NativeMethods.DHCPCAPI_PARAMS_ARRAY recdParams = new NativeMethods.DHCPCAPI_PARAMS_ARRAY();
                    recdParams.nParams = 1;
                    recdParams.Params = recdParamsPtr;

                    NativeMethods.DhcpRequestFlags flags = NativeMethods.DhcpRequestFlags.DHCPCAPI_REQUEST_SYNCHRONOUS;

                    int err = NativeMethods.DhcpRequestParams(
                        flags,
                        IntPtr.Zero,
                        adapterName,
                        IntPtr.Zero,
                        sendParams,
                        recdParams,
                        buffer,
                        ref bufferSize,
                        null);

                    if (err == NativeMethods.ERROR_MORE_DATA)
                    {
                        bufferSize *= 2;
                        goto Retry;
                    }

                    if (err != 0)
                        throw new Win32Exception(err);

                    recv = (NativeMethods.DHCPCAPI_PARAMS) 
                        Marshal.PtrToStructure(recdParamsPtr, typeof(NativeMethods.DHCPCAPI_PARAMS));

                    if (recv.Data == IntPtr.Zero)
                        return null;

                    byte[] data = new byte[recv.nBytesData];
                    Marshal.Copy(recv.Data, data, 0, (int)recv.nBytesData);
                    return data;
                }
                finally
                {
                    Marshal.FreeHGlobal(recdParamsPtr);
                }
            }
            finally
            {
                Marshal.FreeHGlobal(buffer);
            }
        }

        ///// <summary>
        ///// Unregisters a persistent request.
        ///// </summary>
        //public void DhcpUndoRequestParams()
        //{
        //    int err = NativeMethods.DhcpUndoRequestParams(0, IntPtr.Zero, null, this.ApplicationID);
        //    if (err != 0)
        //        throw new Win32Exception(err);
        //}

        #region Native Methods
    }

    internal static partial class NativeMethods
    {
        public const uint ERROR_MORE_DATA = 124;

        [DllImport("dhcpcsvc.dll", EntryPoint = "DhcpRequestParams", CharSet = CharSet.Unicode, SetLastError = false)]
        public static extern int DhcpRequestParams(
            DhcpRequestFlags Flags,
            IntPtr Reserved,
            string AdapterName,
            IntPtr ClassId,
            DHCPCAPI_PARAMS_ARRAY SendParams,
            DHCPCAPI_PARAMS_ARRAY RecdParams,
            IntPtr Buffer,
            ref UInt32 pSize,
            string RequestIdStr
            );

        [DllImport("dhcpcsvc.dll", EntryPoint = "DhcpUndoRequestParams", CharSet = CharSet.Unicode, SetLastError = false)]
        public static extern int DhcpUndoRequestParams(
            uint Flags,
            IntPtr Reserved,
            string AdapterName,
            string RequestIdStr);

        [DllImport("dhcpcsvc.dll", EntryPoint = "DhcpCApiInitialize", CharSet = CharSet.Unicode, SetLastError = false)]
        public static extern int DhcpCApiInitialize(out uint Version);

        [DllImport("dhcpcsvc.dll", EntryPoint = "DhcpCApiCleanup", CharSet = CharSet.Unicode, SetLastError = false)]
        public static extern int DhcpCApiCleanup();

        [Flags]
        public enum DhcpRequestFlags : uint
        {
            DHCPCAPI_REQUEST_PERSISTENT = 0x01,
            DHCPCAPI_REQUEST_SYNCHRONOUS = 0x02,
            DHCPCAPI_REQUEST_ASYNCHRONOUS = 0x04,
            DHCPCAPI_REQUEST_CANCEL = 0x08,
            DHCPCAPI_REQUEST_MASK = 0x0F
        }

        [StructLayout(LayoutKind.Sequential)]
        public struct DHCPCAPI_PARAMS_ARRAY
        {
            public UInt32 nParams;
            public IntPtr Params;
        }

        [StructLayout(LayoutKind.Sequential)]
        public struct DHCPCAPI_PARAMS
        {
            public UInt32 Flags;
            public UInt32 OptionId;
            [MarshalAs(UnmanagedType.Bool)] 
            public bool IsVendor;
            public IntPtr Data;
            public UInt32 nBytesData;
        }
        #endregion
    }
}
"@

Add-Type -TypeDefinition $source 

Function Confirm-AzureVM {
	
	$detected = $False

	[void][System.Reflection.Assembly]::LoadWithPartialName('System.Serviceprocess')

	$vmbus = [System.ServiceProcess.ServiceController]::GetDevices() | where {$_.Name -eq 'vmbus'}

	If($vmbus.Status -eq 'Running')
	{
		$client = New-Object Microsoft.WindowsAzure.Internal.DhcpClient
		try {
			[Microsoft.WindowsAzure.Internal.DhcpClient]::GetDhcpInterfaces() | % { 
				$val = $client.DhcpRequestParams($_.Id, 245)
				if($val -And $val.Length -eq 4) {
					$detected = $True
				}
			}
		} finally {
			$client.Dispose()
		}	
	}
	Write-Output $detected
}

This code is a mix of PowerShell and embedded C# code (dynamic type definition) and primarily defines a utility to detect Azure virtual machines (VMs) using certain system characteristics, specifically DHCP settings.

Here’s a breakdown of what the code does:

1. Embedding a C# Class in PowerShell

The $source variable contains a large C# class DhcpClient that interacts with the DHCP service on Windows via native API calls (dhcpcsvc.dll).
It uses P/Invoke (DllImport) techniques to call functions in dhcpcsvc.dll, such as:
- DhcpCApiInitialize and DhcpCApiCleanup for initialization and cleanup.
- DhcpRequestParams to request specific DHCP options for a network interface.
The class:
- Filters and retrieves network interfaces with DHCP enabled.
- Requests specific DHCP options for given network interfaces (e.g., to retrieve custom vendor-specific DHCP settings).
It wraps the unmanaged resources needed for these interactions, ensuring proper cleanup (e.g., via Dispose).

2. Confirm-AzureVM Function

This PowerShell function Confirm-AzureVM utilizes the DhcpClient class defined in the embedded C# code to check whether the current machine is an Azure VM. Here's how it works:
1. Detect the vmbus Service:
  - It checks if a service named vmbus (associated with Hyper-V integration services) is running. This could suggest the system is a virtual machine.
2. Check for DHCP Option 245:
  - If vmbus is running, it creates an instance of the DhcpClient class to interact with DHCP settings.
  - It retrieves a list of all network interfaces that have DHCP enabled using the GetDhcpInterfaces method in the embedded C# code.
  - For each DHCP-enabled network interface, it requests the value of DHCP option 245 using the DhcpRequestParams method.
  - If the DHCP option 245 contains a valid 4-byte value, it considers the machine as likely being an Azure VM.
  - The result ($detected) is set to $True if any network interface meets the criteria, otherwise $False.
Finally, the result ($detected) is output with Write-Output.

3. Purpose of the Code

This code is designed to determine whether the script is being executed in an Azure Virtual Machine context.
It does so by leveraging the vmbus service and DHCP option 245, which are often associated with virtualized environments like Azure.
DHCP option 245 is known to carry metadata specific to Azure for identifying network configurations tied to the platform.

Key Functionalities:

C# Code:
- Initializes and interacts with Windows DHCP APIs.
- Retrieves and iterates over network interfaces with DHCP enabled to query specific DHCP options.
PowerShell Code:
- Directs the detection process.
- Checks for Hyper-V services and retrieves DHCP data to identify Azure VMs.

Example Workflow:

The Azure VM detection script is executed.
The Confirm-AzureVM function:
- Confirms the presence of the vmbus Hyper-V virtual adapter.
- Queries all DHCP-enabled interfaces for Azure-specific data using the DhcpClient class.
A boolean result (True or False) is returned, indicating whether the script is running in an Azure VM.

Generate your own explanations

Download our vscode extension

Read other generated explanations

Built by @thebuilderjr