Purpose
One may notice that the Ivanti Antivirus client may show its UI in various languages, namely German (de), English (en), Spanish (es), French (fr), Italian (it), Japanese (ja), Korean (kr), Portuguese - Brazil (pt- BR), Russian (ru), Chinese simplified (zh-Hans), Chinese traditional (zh-Hant). This article aims at explaining how the Ivanti Antivirus client decides on which language to display its UI in.
Checking Registry
It’s checking the registry:
32-bit machines:
HKLM\Software\Intel\CurrentLanguage
64-bit machines:
HKLM\Software\WOW6432Node\Intel\CurrentLanguage
If it doesn’t exist, the client would check the value for DefaultLanguages
NOTE: If it’s ESN, convert it to ESP.
Call Windows API
If we can’t find the info above, it calls Windows API GetUserDefaultUILanguage.
And then change the ID to lang code in string.
switch (PRIMARYLANGID(langid))
{
case LANG_SWEDISH:
return _T("SVE"); // localization OK
break;
case LANG_CHINESE:
switch(SUBLANGID(langid))
{
case 1:
default:
return _T("CHT");
case 2:
return _T("CHS"); //localization OK
}
break;
case LANG_FRENCH:
return _T("FRA"); //localization OK
break;
case LANG_GERMAN:
return _T("DEU"); //localization OK
break;
case LANG_ITALIAN:
return _T("ITA"); //localization OK
break;
case LANG_JAPANESE:
return _T("JPN"); //localization OK
break;
case LANG_PORTUGUESE:
switch (SUBLANGID(langid))
{
case SUBLANG_PORTUGUESE_BRAZILIAN:
default:
return _T("PTB");
case SUBLANG_PORTUGUESE:
return _T("PTG");
}
break;
case LANG_SPANISH:
return _T("ESP"); //localization OK
break;
case LANG_DUTCH:
return _T("NLD");
break;
case LANG_NORWEGIAN:
return _T("NOR");
break;
case LANG_DANISH:
return _T("DAN");
break;
case LANG_FINNISH:
return _T("FIN");
break;
case LANG_POLISH:
return _T("PLK");
case LANG_CZECH:
return _T("CSY");
case LANG_KOREAN:
return _T("KOR");
case LANG_RUSSIAN:
return _T("RUS");
case LANG_HUNGARIAN:
return _T("HUN");
default:
return _T("ENU"); //localization OK
break;
}
NOTE: The process for security scan - vulscan.exe uses the same logic to determine language.