using System;

using System.Collections.Generic;

using System.Linq;

using System.Runtime.InteropServices;

public class Program

{

    public static void Main()

    {

        // https://gallery.technet.microsoft.com/scriptcenter/Get-the-status-of-4b748f25

        // https://jdhitsolutions.com/blog/powershell/5187/get-antivirus-product-status-with-powershell/

        // https://docs.microsoft.com/en-us/windows/win32/api/iwscapi/ne-iwscapi-wsc_security_product_state?redirectedfrom=MSDN

        // https://mspscripts.com/get-installed-antivirus-information-2/

        // https://social.msdn.microsoft.com/Forums/pt-BR/6501b87e-dda4-4838-93c3-244daa355d7c/wmisecuritycenter2-productstate?forum=vblanguage

        // https://stackoverflow.com/questions/4700897/wmi-security-center-productstate-clarification/4711211

        // https://blogs.msdn.microsoft.com/alejacma/2008/05/12/how-to-get-antivirus-information-with-wmi-vbscript/#comment-442

        // https://www.magnumdb.com/search?q=parent:WSC_SECURITY_PRODUCT_STATE

        // Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct

        // Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct

        // My laptop; Windows defender Off = 401664, On = 397568

        // Work laptop; Windows defender = 393472 Off, Bit defender = 266240 On

        //List<int> statii = new List<int> {401664, 397568, 393472, 266240};

        List<int> statii = new List<int> {401664, 397568, 393472, 266240, 262144, 262160, 266256, 393216, 393232, 393488, 397312, 397328, 397584};

        foreach (var status in statii)

        {

            Decode(status);

        }

    }

    private static void Decode(int value)

    {

        string hex = Hex(value);

        string bin = Binary(value);

        string reversed = Reverse(bin);

        bool enabled = GetBit(reversed, 18);

        bool scanning = GetBit(reversed, 12);

        bool outdated = GetBit(reversed, 4);

        Console.WriteLine("Status: " + value.ToString() + " [" + hex + " . " + bin + "] "

                          + " Enabled: " + enabled.ToString().PadRight(5, ' ')

                          + "; Scanning: " + scanning.ToString().PadRight(5, ' ')

                          + "; Outdated: " + outdated.ToString().PadRight(5, ' ') + "");

    }

// 19th bit = not so sure but, Av is turned on (I wouldn't be sure it's enabled)

// 13th bit = On Access Scanning (Memory Resident Scanning) is on, this tells you that the product is scanning every file that you open as opposed to just scanning at regular intervals.

// 5th Bit = if this is true (==1) the virus scanner is out of date

​

    private static string Binary(int value)

    {

        return Convert.ToString(value, 2).PadLeft(24, '0');

    }

    private static string Hex(int value)

    {

        return Convert.ToString(value, 16).PadLeft(6, '0');

    }

    private static string GetByte(string value, int index)

    {

        return value.Substring(index*2, 2);

    }

    private static bool GetBit(string value, int index)

    {

        return value.Substring(index, 1).Equals("1");

    }

    private static string Reverse(string value)

    {

        return new string(value.Reverse().ToArray());

    }

//These are bit fields, you don't check to see if it equals a particular number

//(from the right) 19th bit == Anti Virus is on

//(from the right) 13th bit == On Access Scanning

//397312 for example

//00000000 00000[1]10 000[1]0000 000[0]0000

//19th bit (yes) = Av on

//13th bit (yes) = On Access Scanning

//I'm not entirely sure what that other bit means.

//In vbscript

//if (262,144 = (productState and 262,144)) then

//wscript.echo "Av is On"

//else

//wscript.echo "Av Is Off"

//end if

//if (4096 = (productScan and 4096)) then

//wscript.echo "On Access Scanning enabled"

//else

//wscript.echo "On Access Scanning Disabled"

//end if

​

// 00000110 00100001 00000000

// https://stackoverflow.com/questions/4700897/wmi-security-center-productstate-clarification/4711211

// ( Decimal, Hex, Bit Set )

// 262144, 40000, 1000000000000000000

// 262160, 40010, 1000000000000010000

// 266240, 41000, 1000001000000000000

// 270336, 42000, 1000010000000000000

// 327680, 50000, 1010000000000000000

// 327696, 50010, 1010000000000010000

// 331776, 51000, 1010001000000000000

// 344064, 54000, 1010100000000000000

// 393216, 60000, 1100000000000000000

// 393232, 60010, 1100000000000010000

// 393472, 60100, 1100000000100000000

// 393488, 60110, 1100000000100010000

// 397312, 61000, 1100001000000000000

// 397328, 61010, 1100001000000010000

// 397568, 61100, 1100001000100000000

// 397584, 61110, 1100001000100010000

// 458752, 70000, 1110000000000000000

// 458768, 70010, 1110000000000010000

// 462848, 71000, 1110001000000000000

// 462864, 71010, 1110001000000010000

​

// https://www.magnumdb.com/search?q=parent:WSC_SECURITY_PROVIDER

// Enum of WSC_SECURITY_PROVIDER

// WSC_SECURITY_PROVIDER_FIREWALL 1

// WSC_SECURITY_PROVIDER_AUTOUPDATE_SETTINGS 2

// WSC_SECURITY_PROVIDER_ANTIVIRUS 4

// WSC_SECURITY_PROVIDER_ANTISPYWARE 8

// WSC_SECURITY_PROVIDER_INTERNET_SETTINGS 16

// WSC_SECURITY_PROVIDER_USER_ACCOUNT_CONTROL 32

// WSC_SECURITY_PROVIDER_SERVICE 64

// WSC_SECURITY_PROVIDER_NONE 0

// WSC_SECURITY_PROVIDER_ALL 127

​

// https://www.magnumdb.com/search?q=parent:WSC_SECURITY_PRODUCT_STATE

// Enum of WSC_SECURITY_PRODUCT_STATE

// WSC_SECURITY_PRODUCT_STATE_ON      = 0

// WSC_SECURITY_PRODUCT_STATE_OFF     = 1

// WSC_SECURITY_PRODUCT_STATE_SNOOZED = 2

// WSC_SECURITY_PRODUCT_STATE_EXPIRED = 3

// https://www.magnumdb.com/search?q=parent:WSC_SECURITY_SIGNATURE_STATUS

// Enum of WSC_SECURITY_SIGNATURE_STATUS

// WSC_SECURITY_PRODUCT_OUT_OF_DATE = 0

// WSC_SECURITY_PRODUCT_UP_TO_DATE  = 1

    // Byte 0

    [Flags]

    public enum SignatureStatusFlags : byte {

        UpToDate = 0,

        OutOfDate = 16

    }

​

    // Byte 1

    [Flags]

    public enum AVStatusFlags : byte {

        Unknown = 1,

        Enabled = 16

    }

​

    // Byte 2

    [Flags]

    public enum ProviderFlags : byte {

        FIREWALL = 1,

        AUTOUPDATE_SETTINGS = 2,

        ANTIVIRUS = 4,

        ANTISPYWARE = 8,

        INTERNET_SETTINGS = 16,

        USER_ACCOUNT_CONTROL = 32,

        SERVICE = 64,

        NONE = 0,

    }

​

    [StructLayout(LayoutKind.Sequential)]

    public struct ProviderStatus {

        public SignatureStatusFlags SignatureStatus;

        public AVStatusFlags AVStatus;

        public ProviderFlags SecurityProvider;

        public byte unused;

    }

}

​