GetWindowsBuildNumber.cpp

/*
 * Windows Version Detection System - Hardened Security Implementation
 * 
 * A comprehensive Windows operating system version detection utility engineered with extreme
 * security measures and multiple validation layers. It employs advanced anti-tampering
 * techniques, memory protection, and cross-validation methodologies to ensure accurate and secure
 * version information retrieval.
 * 
 * Core Capabilities:
 * - Multi-method version detection using RtlGetVersion API, registry queries, and legacy fallbacks
 * - Advanced security validation with stack canaries, memory protection, and integrity checks
 * - Real-time anti-debugging and API hook detection mechanisms
 * - Cross-validation between multiple data sources for enhanced accuracy
 * - Secure memory management with automatic sanitization and bounds checking
 * - FFI (Foreign Function Interface) export for integration with external systems
 * - Comprehensive error handling with detailed assurance level reporting
 * - Console and GUI output modes with user-friendly version information display
 * 
 * Security Features:
 * - Stack overflow protection with randomized canaries
 * - Process integrity validation and debugger detection
 * - API hook detection and NTDLL validation
 * - Secure string handling with bounds checking
 * - Memory protection against tampering attempts
 * - Atomic operations for thread-safe state management
 * 
 * The system provides version information with varying assurance levels from Unknown to Maximum,
 * allowing your software to make informed decisions based on the reliability of the detected data.
 * Output includes Windows version numbers, build information, detection method used, and
 * comprehensive security validation results.
 */

#pragma comment(lib, "advapi32.lib")
#pragma comment(lib, "psapi.lib")
#pragma comment(lib, "user32.lib")
#pragma comment(lib, "version.lib")
#pragma comment(lib, "bcrypt.lib")
#pragma comment(lib, "ntdll.lib")

#pragma warning(push)
#pragma warning(disable: 4996 4005 4127 4702 4514 4365 4710 4711 4820 4324 4668 4574)

#ifndef WIN32_LEAN_AND_MEAN
#define WIN32_LEAN_AND_MEAN
#endif
#ifndef NOMINMAX
#define NOMINMAX
#endif
#ifndef STRICT
#define STRICT
#endif
#ifndef _CRT_SECURE_NO_WARNINGS
#define _CRT_SECURE_NO_WARNINGS
#endif

#include <windows.h>
#include <winternl.h>
#include <psapi.h>
#include <bcrypt.h>
#include <ntstatus.h>
#include <intrin.h>
#include <array>
#include <algorithm>
#include <climits>
#include <cstdint>
#include <iostream>
#include <limits>
#include <mutex>
#include <string>
#include <vector>
#include <cstring>
#include <memory>
#include <atomic>
#include <chrono>
#include <random>
#include <type_traits>

// Secure memory zeroing with compiler barrier to prevent optimization
#define SECURE_ZERO_MEMORY(ptr, size) do { \
    if ((ptr) != nullptr && (size) > 0 && (size) <= 0x7FFFFFFF) { \
        volatile char* volatile_ptr = reinterpret_cast<volatile char*>(ptr); \
        const size_t safe_size = (size); \
        for (size_t i = 0; i < safe_size; ++i) { \
            volatile_ptr[i] = static_cast<char>(0); \
        } \
        _mm_mfence(); \
        _ReadWriteBarrier(); \
    } \
} while(0)

// Validate pointer safety with range checks
#define SECURE_VALIDATE_POINTER(ptr, max_size) \
    ((ptr) != nullptr && \
     !IsBadReadPtr((ptr), 1) && \
     reinterpret_cast<uintptr_t>(ptr) >= 0x10000ULL && \
     reinterpret_cast<uintptr_t>(ptr) < 0x7FFFFFFF0000ULL)

// Validate write pointer with additional safety checks
#define SECURE_VALIDATE_WRITE_POINTER(ptr, max_size) \
    ((ptr) != nullptr && \
     !IsBadWritePtr(const_cast<void*>(reinterpret_cast<const void*>(ptr)), (max_size)) && \
     reinterpret_cast<uintptr_t>(ptr) >= 0x10000ULL && \
     reinterpret_cast<uintptr_t>(ptr) < 0x7FFFFFFF0000ULL)

// API call validation guard with tamper detection
#define SECURE_API_GUARD() do { \
    if (!g_validation_state.IncrementApiCall() || g_validation_state.tamper_detected.load()) { \
        g_validation_state.MarkTampered(); \
        return InternalFullWindowsVersionResult{}; \
    } \
} while(0)
	
namespace SecurityConfig {
    static constexpr wchar_t kRegistryKey[] = L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion";
    static constexpr DWORD kMaxRegistryStringBytes = 256;
    static constexpr size_t kMaxIntegerStringLength = 8;
    static constexpr size_t kMaxFilePathLength = MAX_PATH;
    static constexpr DWORD kMinFileSize = 8192;
    static constexpr DWORD kMaxFileSize = 8 * 1024 * 1024;
    static constexpr DWORD kSecurityValidationTimeout = 3000;
    static constexpr size_t kMaxVersionStringLength = 24;
    static constexpr size_t kMaxNoteLength = 96;
    static constexpr DWORD kMaxValidationAttempts = 10;
    static constexpr uint64_t kSecurityCanary = 0xDEADBEEFCAFEBABEULL;
    static constexpr uint32_t kMaxSecurityValidations = 10000;
    static constexpr size_t kMaxDialogTextLength = 512;
    static constexpr size_t kStackCanarySize = 16;
    static constexpr DWORD kMaxRegistryKeyLength = 512;
    static constexpr DWORD kMaxApiCallAttempts = 3;
    static constexpr size_t kMinValidPointer = 0x10000;
    static constexpr uint64_t kMaxValidPointer = 0x7FFFFFFF0000ULL;
    static constexpr uint32_t kMaxCrossValidationTolerance = 100;
    static constexpr uint32_t kMinExpectedKernelBuild = 2600;
    static constexpr uint32_t kMaxExpectedKernelBuild = 50000;
    static constexpr DWORD kMaxHookDetectionAttempts = 5;
    static constexpr uint64_t kNtdllBaseValidationMask = 0xFFFF000000000000ULL;
    static constexpr size_t kMaxProcessNameLength = 260;
    
    static_assert(kMaxRegistryStringBytes >= 32, "Registry buffer too small");
    static_assert(kMaxRegistryStringBytes <= 1024, "Registry buffer too large");
    static_assert(kMaxValidationAttempts >= 1, "Must allow at least one validation");
    static_assert(kMaxValidationAttempts <= 20, "Too many validation attempts");
    static_assert(kSecurityValidationTimeout >= 1000, "Timeout too short");
    static_assert(kSecurityValidationTimeout <= 10000, "Timeout too long");
    static_assert(kStackCanarySize >= 8, "Stack canary too small");
    static_assert(kMaxApiCallAttempts >= 1, "Must allow at least one API call");
    static_assert(kMaxCrossValidationTolerance <= 1000, "Cross validation tolerance too high");
    static_assert(kMinExpectedKernelBuild >= 1000, "Minimum kernel build too low");
    static_assert(kMaxExpectedKernelBuild <= 100000, "Maximum kernel build too high");
}

#pragma pack(push, 8)
enum : uint32_t {
    WVF_MAX_METHOD = 24, WVF_MAX_NOTE = 48, WVF_MAX_INTEGRITY = 48,
    WVF_MAX_SHA256 = 65, WVF_MAX_PRODUCT_VERSION = 24, WVF_MAX_SIGNER = 48,
    WVF_MAX_SIGNERS = 2, WVF_MAGIC_HEADER = 0x57564646U,
    WVF_MAGIC_FOOTER = 0x464656FFU, WVF_STRUCT_VERSION = 3U,
    WVF_SECURITY_SIGNATURE = 0xDEADBEEFU
};

// FFI structure for external integration with version information
typedef struct WindowsFullVersionFFI {
    uint32_t magic_header;           // Structure validation header
    uint32_t struct_version;         // Version of this structure format
    uint32_t security_signature;     // Security validation signature
    uint32_t major, minor, build, ubr; // Windows version components
    uint8_t is_consistent, assurance; // Data consistency and confidence level
    uint8_t reserved[14];            // Reserved for future use
    char method[WVF_MAX_METHOD];     // Detection method used
    char note[WVF_MAX_NOTE];         // Additional notes or warnings
    char integrity_summary[WVF_MAX_INTEGRITY]; // Security validation summary
    char file_sha256[WVF_MAX_SHA256]; // File hash for verification
    char file_product_version[WVF_MAX_PRODUCT_VERSION]; // Product version string
    uint32_t winverify_trust_result; // Trust verification result
    uint32_t signer_count;           // Number of digital signers
    char signer_subjects[WVF_MAX_SIGNERS][WVF_MAX_SIGNER]; // Signer information
    uint32_t magic_footer;           // Structure validation footer
    uint32_t checksum;               // Data integrity checksum
    uint64_t final_canary;           // Final security canary
} WindowsFullVersionFFI;
#pragma pack(pop)

static_assert(sizeof(WindowsFullVersionFFI) <= 512, "FFI structure exceeds security limit");
static_assert(WVF_MAX_SHA256 >= 65, "SHA256 buffer insufficient");
static_assert(alignof(WindowsFullVersionFFI) >= 8, "Insufficient alignment");

extern "C" __declspec(dllexport) int GetWindowsFullVersionFFI(WindowsFullVersionFFI* outStruct, size_t outSize) noexcept;

// Confidence levels for version detection results
enum class InternalAssurance : uint8_t { 
    Unknown = 0,   // Unable to determine or validate
    Low = 1,       // Basic detection with limited validation
    Reduced = 2,   // Registry-based with some validation
    Full = 3,      // Kernel-level detection with validation
    Maximum = 4    // Multiple sources validated and cross-checked
};

// Convert assurance enum to human-readable string
static const wchar_t* AssuranceToString(InternalAssurance assurance) noexcept {
    switch (assurance) {
        case InternalAssurance::Maximum: return L"Maximum";
        case InternalAssurance::Full: return L"Full";
        case InternalAssurance::Reduced: return L"Reduced";
        case InternalAssurance::Low: return L"Low";
        case InternalAssurance::Unknown: 
        default: return L"Unknown";
    }
}

// Stack overflow protection with randomized canaries
class StackCanary {
private:
    alignas(16) uint64_t canary_start_[2];  // Start boundary canaries
    alignas(16) uint64_t canary_end_[2];    // End boundary canaries
    alignas(16) uint64_t integrity_check_;  // Integrity validation value
    
    // Generate cryptographically secure random canary value
    static uint64_t GenerateRandomCanary() noexcept {
        try {
            uint64_t canary = 0;
            // Use Windows crypto API for secure random generation
            if (BCryptGenRandom(nullptr, reinterpret_cast<PUCHAR>(&canary), sizeof(canary), BCRYPT_USE_SYSTEM_PREFERRED_RNG) == STATUS_SUCCESS) {
                return canary ^ SecurityConfig::kSecurityCanary;
            }
        } catch (...) {}
        
        // Fallback to time-based entropy if crypto API fails
        auto now = std::chrono::high_resolution_clock::now().time_since_epoch().count();
        return static_cast<uint64_t>(now) ^ SecurityConfig::kSecurityCanary ^ 0xABCDEF0123456789ULL;
    }
    
public:
    // Initialize canary values with cryptographic randomness
    StackCanary() noexcept {
        uint64_t base_canary = GenerateRandomCanary();
        canary_start_[0] = base_canary;
        canary_start_[1] = ~base_canary;
        canary_end_[0] = base_canary ^ 0x5555555555555555ULL;
        canary_end_[1] = ~(base_canary ^ 0x5555555555555555ULL);
        integrity_check_ = base_canary ^ 0xAAAAAAAAAAAAAAAAULL;
        _mm_mfence(); // Memory fence to prevent reordering
    }
    
    // Secure destruction with memory clearing
    ~StackCanary() noexcept {
        if (IsValid()) {
            SECURE_ZERO_MEMORY(canary_start_, sizeof(canary_start_));
            SECURE_ZERO_MEMORY(canary_end_, sizeof(canary_end_));
            SECURE_ZERO_MEMORY(&integrity_check_, sizeof(integrity_check_));
        }
    }
    
    // Copy constructor with validation
    StackCanary(const StackCanary& other) noexcept {
        if (other.IsValid()) {
            canary_start_[0] = other.canary_start_[0];
            canary_start_[1] = other.canary_start_[1];
            canary_end_[0] = other.canary_end_[0];
            canary_end_[1] = other.canary_end_[1];
            integrity_check_ = other.integrity_check_;
        } else {
            // Generate new canaries if source is invalid
            uint64_t base_canary = GenerateRandomCanary();
            canary_start_[0] = base_canary;
            canary_start_[1] = ~base_canary;
            canary_end_[0] = base_canary ^ 0x5555555555555555ULL;
            canary_end_[1] = ~(base_canary ^ 0x5555555555555555ULL);
            integrity_check_ = base_canary ^ 0xAAAAAAAAAAAAAAAAULL;
        }
        _mm_mfence();
    }
    
    // Assignment operator with validation
    StackCanary& operator=(const StackCanary& other) noexcept {
        if (this != &other) {
            if (other.IsValid()) {
                canary_start_[0] = other.canary_start_[0];
                canary_start_[1] = other.canary_start_[1];
                canary_end_[0] = other.canary_end_[0];
                canary_end_[1] = other.canary_end_[1];
                integrity_check_ = other.integrity_check_;
            } else {
                uint64_t base_canary = GenerateRandomCanary();
                canary_start_[0] = base_canary;
                canary_start_[1] = ~base_canary;
                canary_end_[0] = base_canary ^ 0x5555555555555555ULL;
                canary_end_[1] = ~(base_canary ^ 0x5555555555555555ULL);
                integrity_check_ = base_canary ^ 0xAAAAAAAAAAAAAAAAULL;
            }
            _mm_mfence();
        }
        return *this;
    }
    
    // Move constructor with secure transfer
    StackCanary(StackCanary&& other) noexcept {
        canary_start_[0] = other.canary_start_[0];
        canary_start_[1] = other.canary_start_[1];
        canary_end_[0] = other.canary_end_[0];
        canary_end_[1] = other.canary_end_[1];
        integrity_check_ = other.integrity_check_;
        
        // Clear source object
        other.canary_start_[0] = 0;
        other.canary_start_[1] = 0;
        other.canary_end_[0] = 0;
        other.canary_end_[1] = 0;
        other.integrity_check_ = 0;
        _mm_mfence();
    }
    
    // Move assignment with secure transfer
    StackCanary& operator=(StackCanary&& other) noexcept {
        if (this != &other) {
            canary_start_[0] = other.canary_start_[0];
            canary_start_[1] = other.canary_start_[1];
            canary_end_[0] = other.canary_end_[0];
            canary_end_[1] = other.canary_end_[1];
            integrity_check_ = other.integrity_check_;
            
            other.canary_start_[0] = 0;
            other.canary_start_[1] = 0;
            other.canary_end_[0] = 0;
            other.canary_end_[1] = 0;
            other.integrity_check_ = 0;
            _mm_mfence();
        }
        return *this;
    }
    
    // Validate canary integrity to detect stack corruption
    bool IsValid() const noexcept {
        return (canary_start_[0] != 0) && 
               (canary_start_[1] == ~canary_start_[0]) &&
               (canary_end_[0] == (canary_start_[0] ^ 0x5555555555555555ULL)) &&
               (canary_end_[1] == ~canary_end_[0]) &&
               (integrity_check_ == (canary_start_[0] ^ 0xAAAAAAAAAAAAAAAAULL));
    }
};

// Global security state management with atomic operations
struct SecureValidationState {
    std::atomic<uint64_t> canary{SecurityConfig::kSecurityCanary};
    std::atomic<bool> ntdll_validated{false};
    std::atomic<bool> system_dir_validated{false}; 
    std::atomic<bool> tamper_detected{false};
    std::atomic<bool> initialization_complete{false};
    std::atomic<DWORD> last_validation_time{0};
    std::atomic<uint32_t> validation_attempts{0};
    std::atomic<uint32_t> api_call_count{0};
    std::atomic<bool> critical_section_active{false};
    std::atomic<bool> hook_detected{false};
    std::atomic<bool> debugger_detected{false};
    std::atomic<uint32_t> cross_validation_failures{0};
    std::atomic<uintptr_t> ntdll_base_address{0};
    alignas(16) std::atomic<uint64_t> integrity_hash{0};
    
    // Validate overall security state integrity
    bool IsValid() const noexcept {
        try {
            uint64_t current_canary = canary.load(std::memory_order_acquire);
            bool tampered = tamper_detected.load(std::memory_order_acquire);
            bool hooks = hook_detected.load(std::memory_order_acquire);
            bool debugger = debugger_detected.load(std::memory_order_acquire);
            uint32_t attempts = validation_attempts.load(std::memory_order_acquire);
            bool initialized = initialization_complete.load(std::memory_order_acquire);
            uint32_t api_calls = api_call_count.load(std::memory_order_acquire);
            uint32_t cross_failures = cross_validation_failures.load(std::memory_order_acquire);
            
            return current_canary == SecurityConfig::kSecurityCanary && 
                   !tampered && 
                   !hooks &&
                   !debugger &&
                   attempts < SecurityConfig::kMaxValidationAttempts && 
                   initialized &&
                   api_calls < SecurityConfig::kMaxSecurityValidations &&
                   cross_failures < SecurityConfig::kMaxValidationAttempts;
        } catch (...) {
            return false;
        }
    }
    
    // Mark state as tampered and invalidate security
    void MarkTampered() noexcept {
        tamper_detected.store(true, std::memory_order_release);
        canary.store(0, std::memory_order_release);
        integrity_hash.store(0, std::memory_order_release);
    }
    
    // Mark API hook detection and trigger tamper response
    void MarkHookDetected() noexcept {
        hook_detected.store(true, std::memory_order_release);
        MarkTampered();
    }
    
    // Mark debugger detection and trigger tamper response
    void MarkDebuggerDetected() noexcept {
        debugger_detected.store(true, std::memory_order_release);
        MarkTampered();
    }
    
    // Increment cross-validation failure counter
    void IncrementCrossValidationFailure() noexcept {
        uint32_t failures = cross_validation_failures.fetch_add(1, std::memory_order_acq_rel);
        if (failures >= SecurityConfig::kMaxValidationAttempts) {
            MarkTampered();
        }
    }
    
    // Reset validation state for retry attempts
    void Reset() noexcept {
        ntdll_validated.store(false, std::memory_order_release);
        system_dir_validated.store(false, std::memory_order_release);
        last_validation_time.store(0, std::memory_order_release);
        
        uint32_t new_attempts = validation_attempts.fetch_add(1, std::memory_order_acq_rel);
        if (new_attempts >= SecurityConfig::kMaxValidationAttempts) {
            MarkTampered();
        }
    }
    
    // Initialize security state with integrity hash
    void Initialize() noexcept {
        try {
            uint64_t hash = std::hash<std::string>{}("SecureValidationState") ^ 
                           SecurityConfig::kSecurityCanary;
            integrity_hash.store(hash, std::memory_order_release);
            initialization_complete.store(true, std::memory_order_release);
        } catch (...) {
            initialization_complete.store(true, std::memory_order_release);
        }
    }
    
    // Track API call count for rate limiting
    bool IncrementApiCall() noexcept {
        uint32_t current = api_call_count.fetch_add(1, std::memory_order_acq_rel);
        if (current >= SecurityConfig::kMaxSecurityValidations) {
            return false;
        }
        return true;
    }
};

static SecureValidationState g_validation_state;           // Global security state tracker
static std::atomic<bool> g_security_initialized{false};    // Initialization flag
static std::atomic<uint32_t> g_security_validation_count{0}; // Validation counter
static std::mutex g_security_mutex;                        // Thread synchronization
static std::once_flag g_security_init_flag;               // One-time initialization

// Internal structure for version detection results
struct InternalFullWindowsVersionResult {
    uint32_t major, minor, build, ubr;     // Version components
    bool is_consistent;                    // Data consistency flag
    InternalAssurance assurance;           // Confidence level
    std::wstring method, note, file_product_version, integrity_summary; // Descriptive strings
    DWORD winverify_trust_result;          // Trust verification status
    std::vector<std::wstring> signer_subjects; // Digital signature information
    std::string file_sha256_hex;           // File hash
    StackCanary stack_guard;               // Stack protection
    uint64_t validation_hash;              // Data validation hash
    
    // Default constructor with secure initialization
    InternalFullWindowsVersionResult() noexcept 
        : major(0), minor(0), build(0), ubr(0), is_consistent(true), 
          assurance(InternalAssurance::Unknown), winverify_trust_result(static_cast<DWORD>(-1)),
          validation_hash(0) {
        try {
            method.clear(); 
            note.clear(); 
            file_product_version.clear();
            integrity_summary.clear(); 
            file_sha256_hex.clear(); 
            signer_subjects.clear();
        } catch (...) {
            is_consistent = false; 
            assurance = InternalAssurance::Unknown;
        }
    }
    
    // Copy constructor with exception safety
    InternalFullWindowsVersionResult(const InternalFullWindowsVersionResult& other) noexcept
        : major(other.major), minor(other.minor), build(other.build), ubr(other.ubr),
          is_consistent(other.is_consistent), assurance(other.assurance),
          winverify_trust_result(other.winverify_trust_result),
          stack_guard(other.stack_guard), validation_hash(other.validation_hash) {
        try {
            method = other.method;
            note = other.note;
            file_product_version = other.file_product_version;
            integrity_summary = other.integrity_summary;
            file_sha256_hex = other.file_sha256_hex;
            signer_subjects = other.signer_subjects;
        } catch (...) {
            is_consistent = false;
            assurance = InternalAssurance::Unknown;
        }
    }
    
    // Assignment operator with exception safety
    InternalFullWindowsVersionResult& operator=(const InternalFullWindowsVersionResult& other) noexcept {
        if (this != &other) {
            major = other.major;
            minor = other.minor;
            build = other.build;
            ubr = other.ubr;
            is_consistent = other.is_consistent;
            assurance = other.assurance;
            winverify_trust_result = other.winverify_trust_result;
            stack_guard = other.stack_guard;
            validation_hash = other.validation_hash;
            
            try {
                method = other.method;
                note = other.note;
                file_product_version = other.file_product_version;
                integrity_summary = other.integrity_summary;
                file_sha256_hex = other.file_sha256_hex;
                signer_subjects = other.signer_subjects;
            } catch (...) {
                is_consistent = false;
                assurance = InternalAssurance::Unknown;
            }
        }
        return *this;
    }
    
    // Move constructor with resource transfer
    InternalFullWindowsVersionResult(InternalFullWindowsVersionResult&& other) noexcept
        : major(other.major), minor(other.minor), build(other.build), ubr(other.ubr),
          is_consistent(other.is_consistent), assurance(other.assurance),
          winverify_trust_result(other.winverify_trust_result),
          stack_guard(std::move(other.stack_guard)), validation_hash(other.validation_hash) {
        try {
            method = std::move(other.method);
            note = std::move(other.note);
            file_product_version = std::move(other.file_product_version);
            integrity_summary = std::move(other.integrity_summary);
            file_sha256_hex = std::move(other.file_sha256_hex);
            signer_subjects = std::move(other.signer_subjects);
        } catch (...) {
            is_consistent = false;
            assurance = InternalAssurance::Unknown;
        }
    }
    
    // Move assignment operator with resource transfer
    InternalFullWindowsVersionResult& operator=(InternalFullWindowsVersionResult&& other) noexcept {
        if (this != &other) {
            major = other.major;
            minor = other.minor;
            build = other.build;
            ubr = other.ubr;
            is_consistent = other.is_consistent;
            assurance = other.assurance;
            winverify_trust_result = other.winverify_trust_result;
            stack_guard = std::move(other.stack_guard);
            validation_hash = other.validation_hash;
            
            try {
                method = std::move(other.method);
                note = std::move(other.note);
                file_product_version = std::move(other.file_product_version);
                integrity_summary = std::move(other.integrity_summary);
                file_sha256_hex = std::move(other.file_sha256_hex);
                signer_subjects = std::move(other.signer_subjects);
            } catch (...) {
                is_consistent = false;
                assurance = InternalAssurance::Unknown;
            }
        }
        return *this;
    }
    
    // Validate data integrity and security constraints
    bool IsSecure() const noexcept {
        try {
            bool basic_validation = major <= 50 && minor <= 50 && 
                                   build >= 100 && build <= SecurityConfig::kMaxExpectedKernelBuild && 
                                   ubr <= 32767;
            
            bool string_validation = method.length() <= SecurityConfig::kMaxVersionStringLength &&
                                    note.length() <= SecurityConfig::kMaxNoteLength &&
                                    file_product_version.length() <= SecurityConfig::kMaxVersionStringLength &&
                                    integrity_summary.length() <= SecurityConfig::kMaxNoteLength &&
                                    file_sha256_hex.length() <= 128;
            
            bool container_validation = signer_subjects.size() <= WVF_MAX_SIGNERS;
            
            for (const auto& subject : signer_subjects) {
                if (subject.length() > WVF_MAX_SIGNER) return false;
            }
            
            bool stack_validation = stack_guard.IsValid();
            
            return basic_validation && string_validation && container_validation && stack_validation;
        } catch (...) {
            return false;
        }
    }
    
    // Calculate data integrity checksum
    uint32_t CalculateChecksum() const noexcept {
        try {
            uint32_t checksum = major ^ (minor << 8) ^ (build << 16) ^ ubr;
            checksum ^= static_cast<uint32_t>(assurance) << 24;
            checksum ^= is_consistent ? 0x12345678U : 0x87654321U;
            checksum ^= static_cast<uint32_t>(method.length());
            checksum ^= static_cast<uint32_t>(note.length()) << 4;
            checksum ^= WVF_SECURITY_SIGNATURE;
            checksum ^= static_cast<uint32_t>(validation_hash);
            
            // Include method string in checksum calculation
            for (size_t i = 0; i < std::min(method.length(), static_cast<size_t>(8)); ++i) {
                checksum ^= static_cast<uint32_t>(method[i]) << (i % 4);
            }
            
            return checksum;
        } catch (...) {
            return 0;
        }
    }
    
    // Generate validation hash for integrity verification
    void GenerateValidationHash() noexcept {
        try {
            std::hash<std::string> hasher;
            std::string validation_data = std::to_string(major) + std::to_string(minor) + 
                                         std::to_string(build) + std::to_string(ubr);
            validation_hash = hasher(validation_data) ^ SecurityConfig::kSecurityCanary;
        } catch (...) {
            validation_hash = SecurityConfig::kSecurityCanary;
        }
    }
};

// Detect active debugger presence using multiple methods
static bool DetectDebuggerPresence() noexcept {
    try {
        // Check for local debugger
        if (IsDebuggerPresent()) return true;
        
        // Check for remote debugger
        BOOL remoteDebugger = FALSE;
        if (CheckRemoteDebuggerPresent(GetCurrentProcess(), &remoteDebugger) && remoteDebugger) {
            return true;
        }
        
        return false;
    } catch (...) {
        return false;
    }
}

// Detect API hooks by validating NTDLL function addresses
static bool DetectAPIHooks() noexcept {
    try {
        HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
        if (!ntdll) return false;
        
        uintptr_t ntdll_base = reinterpret_cast<uintptr_t>(ntdll);
        g_validation_state.ntdll_base_address.store(ntdll_base, std::memory_order_release);
        
        // Check if RtlGetVersion function is within NTDLL bounds
        FARPROC rtlGetVersion = GetProcAddress(ntdll, "RtlGetVersion");
        if (!rtlGetVersion) return false;
        
        uintptr_t func_addr = reinterpret_cast<uintptr_t>(rtlGetVersion);
        if (func_addr < ntdll_base || func_addr > (ntdll_base + 0x1000000)) {
            return true; // Function address outside expected range - potential hook
        }
        
        return false;
    } catch (...) {
        return false;
    }
}

// Validate current process integrity and path
static bool ValidateProcessIntegrity() noexcept {
    try {
        wchar_t processPath[SecurityConfig::kMaxProcessNameLength] = {};
        DWORD pathSize = GetModuleFileNameW(nullptr, processPath, SecurityConfig::kMaxProcessNameLength);
        if (pathSize == 0 || pathSize >= SecurityConfig::kMaxProcessNameLength) return false;
        
        // Check for path traversal attempts
        if (wcsstr(processPath, L"..") != nullptr) return false;
        
        return true;
    } catch (...) {
        return false;
    }
}

// Cross-validate version data between multiple sources
static bool PerformCrossValidation(const InternalFullWindowsVersionResult& primary, 
                                 const InternalFullWindowsVersionResult& secondary) noexcept {
    try {
        if (!primary.IsSecure() || !secondary.IsSecure()) return false;
        
        // Validate major and minor versions match exactly
        bool major_valid = (primary.major == secondary.major);
        bool minor_valid = (primary.minor == secondary.minor);
        
        // Allow small differences in build numbers due to update variations
        uint32_t build_diff = (primary.build > secondary.build) ? 
                             (primary.build - secondary.build) : 
                             (secondary.build - primary.build);
        bool build_valid = (build_diff <= SecurityConfig::kMaxCrossValidationTolerance);
        
        // Allow reasonable differences in UBR (Update Build Revision)
        uint32_t ubr_diff = (primary.ubr > secondary.ubr) ? 
                           (primary.ubr - secondary.ubr) : 
                           (secondary.ubr - primary.ubr);
        bool ubr_valid = (ubr_diff <= SecurityConfig::kMaxCrossValidationTolerance);
        
        return major_valid && minor_valid && build_valid && ubr_valid;
    } catch (...) {
        return false;
    }
}

// Validate Windows system directory integrity
static bool ValidateSystemDirectoryIntegrity() noexcept {
    try {
        wchar_t systemDir[MAX_PATH] = {};
        UINT result = GetSystemDirectoryW(systemDir, MAX_PATH);
        if (result == 0 || result >= MAX_PATH) return false;
        
        size_t systemDirLen = wcsnlen_s(systemDir, MAX_PATH);
        if (systemDirLen < 10 || systemDirLen >= MAX_PATH) return false;
        
        // Verify system directory contains expected Windows paths
        if (wcsstr(systemDir, L"Windows\\System32") == nullptr && 
            wcsstr(systemDir, L"Windows\\SysWOW64") == nullptr) {
            return false;
        }
        
        return true;
    } catch (...) {
        return false;
    }
}

// Secure integer conversion with bounds checking
template<typename T, typename U>
static bool SecureIntegerConvert(U value, T& result) noexcept {
    static_assert(std::is_integral_v<T> && std::is_integral_v<U>, "Integer types required");
    
    try {
        // Check for signed to unsigned conversion issues
        if constexpr (std::is_signed_v<U> && !std::is_signed_v<T>) {
            if (value < 0) return false;
        }
        
        // Check for overflow in narrowing conversions
        if constexpr (sizeof(U) > sizeof(T)) {
            if (value > static_cast<U>(std::numeric_limits<T>::max())) return false;
            if constexpr (std::is_signed_v<T>) {
                if (value < static_cast<U>(std::numeric_limits<T>::min())) return false;
            }
        }
        
        // Additional validation for version numbers
        if constexpr (std::is_same_v<T, uint32_t> || std::is_same_v<T, DWORD>) {
            if (value > 100000ULL) return false;
        }
        
        result = static_cast<T>(value);
        return true;
    } catch (...) {
        return false;
    }
}

// Secure string to unsigned long conversion with validation
static bool SecureStringToULong(const std::wstring& str, DWORD& out) noexcept {    
    if (str.empty() || str.length() > SecurityConfig::kMaxIntegerStringLength) {
        return false;
    }
    
    try {
        // Validate character content and encoding
        for (wchar_t c : str) {
            if (c < L'0' || c > L'9') {
                if (c != L' ' && c != L'\t') return false;
            }
            if (c == 0 || c > 127) return false;
        }
        
        bool valid = true;
        size_t digit_count = 0;
        
        // Count digits and validate whitespace positioning
        for (size_t i = 0; i < str.length(); ++i) {
            wchar_t c = str[i];
            bool is_digit = (c >= L'0' && c <= L'9');
            bool is_whitespace = (c == L' ' || c == L'\t') && (i == 0 || i == str.length() - 1);
            
            if (is_digit) {
                digit_count++;
            } else if (!is_whitespace) {
                valid = false;
            }
        }
        
        if (!valid || digit_count == 0 || digit_count > 5) return false;
        
        // Trim whitespace from string
        std::wstring trimmed = str;
        size_t start = trimmed.find_first_not_of(L" \t");
        if (start != std::wstring::npos) {
            size_t end = trimmed.find_last_not_of(L" \t");
            trimmed = trimmed.substr(start, (end - start + 1));
        }
        
        // Reject strings with leading zeros (except single zero)
        if (trimmed.length() > 1 && trimmed[0] == L'0') return false;
        
        // Perform actual string conversion
        errno = 0;
        wchar_t* end = nullptr;
        unsigned long long val = std::wcstoull(trimmed.c_str(), &end, 10);
        
        if (errno == ERANGE || errno == EINVAL || end == trimmed.c_str()) return false;
        if (end != nullptr && *end != L'\0') return false;
        if (val > 65535ULL) return false;
        
        return SecureIntegerConvert(val, out);
    } catch (...) {
        return false;
    }
}

typedef NTSTATUS (NTAPI *RtlGetVersionFunc)(PRTL_OSVERSIONINFOW);

// Get secure reference to RtlGetVersion function with validation
static RtlGetVersionFunc GetSecureRtlGetVersion() noexcept {
    static std::once_flag once;
    static RtlGetVersionFunc rtlGetVersion = nullptr;
    
    std::call_once(once, [&]() noexcept {        
        try {
            // Perform comprehensive security validation
            bool debugging = DetectDebuggerPresence();
            bool hooks = DetectAPIHooks();
            bool process_ok = ValidateProcessIntegrity();
            bool system_ok = ValidateSystemDirectoryIntegrity();
            
            // Update global security state based on validation results
            if (debugging) {
                g_validation_state.MarkDebuggerDetected();
            }
            if (hooks) {
                g_validation_state.MarkHookDetected();
            }
            if (!process_ok || !system_ok) {
                g_validation_state.MarkTampered();
            }
            
            // Get NTDLL module handle
            HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
            if (!ntdll) return;
            
            // Get RtlGetVersion function address
            FARPROC proc = GetProcAddress(ntdll, "RtlGetVersion");
            if (!proc) return;
            
            rtlGetVersion = reinterpret_cast<RtlGetVersionFunc>(proc);
            
            // Test function with sample call to validate functionality
            RTL_OSVERSIONINFOW testOsvi = {};
            testOsvi.dwOSVersionInfoSize = sizeof(testOsvi);
            
            NTSTATUS status = rtlGetVersion(&testOsvi);
            if (!NT_SUCCESS(status) || testOsvi.dwMajorVersion == 0) {
                rtlGetVersion = nullptr;
                return;
            }
            
            // Validate returned values are within reasonable ranges
            if (testOsvi.dwMajorVersion > 20 || testOsvi.dwMinorVersion > 20 ||
                testOsvi.dwBuildNumber < 100 || testOsvi.dwBuildNumber > 50000) {
                rtlGetVersion = nullptr;
                return;
            }
            
            g_validation_state.ntdll_validated.store(true, std::memory_order_release);
            
        } catch (...) {
            rtlGetVersion = nullptr;
        }
    });
    
    return rtlGetVersion;
}

// Primary version detection using kernel-level RtlGetVersion API
static InternalFullWindowsVersionResult TryGetVersionFromRtlGetVersion() noexcept {
    InternalFullWindowsVersionResult result;
    
    try {
        result.method = L"RtlGetVersion (Primary)";
        result.assurance = InternalAssurance::Maximum;
        
        // Get validated function pointer
        RtlGetVersionFunc rtlGetVersion = GetSecureRtlGetVersion();
        if (!rtlGetVersion) {
            result.note = L"RtlGetVersion not available";
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        // Call kernel function to get version information
        RTL_OSVERSIONINFOW osvi = {};
        osvi.dwOSVersionInfoSize = sizeof(osvi);
        
        NTSTATUS status = rtlGetVersion(&osvi);
        if (!NT_SUCCESS(status)) {
            result.note = L"RtlGetVersion failed with NTSTATUS: 0x" + 
                         std::to_wstring(static_cast<uint32_t>(status));
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        // Validate returned version data
        if (osvi.dwMajorVersion == 0 || osvi.dwMajorVersion > 20 || 
            osvi.dwMinorVersion > 20 || osvi.dwBuildNumber < 100 || 
            osvi.dwBuildNumber > 50000) {
            result.note = L"RtlGetVersion returned invalid values";
            result.is_consistent = false;
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        // Convert to internal format with bounds checking
        if (!SecureIntegerConvert(osvi.dwMajorVersion, result.major) ||
            !SecureIntegerConvert(osvi.dwMinorVersion, result.minor) ||
            !SecureIntegerConvert(osvi.dwBuildNumber, result.build)) {
            result.note = L"Integer conversion failed";
            result.is_consistent = false;
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        result.ubr = 0; // UBR not available from RtlGetVersion
        result.note = L"RtlGetVersion kernel-level detection succeeded";
        result.is_consistent = true;
        result.GenerateValidationHash();
        
        return result;
    } catch (...) {
        result.note = L"Exception in RtlGetVersion processing";
        result.is_consistent = false;
        result.assurance = InternalAssurance::Unknown;
        return result;
    }
}

// Secure registry access with validation and safety checks
static bool SecureRegistryAccess(HKEY root, const wchar_t* subKey, REGSAM access, HKEY* outKey) noexcept {
    if (!subKey || !outKey) return false;
    
    try {
        // Validate key path length and content
        size_t keyLen = wcsnlen_s(subKey, SecurityConfig::kMaxRegistryKeyLength);
        if (keyLen == 0 || keyLen >= SecurityConfig::kMaxRegistryKeyLength) return false;
        
        // Validate characters in registry key path
        for (size_t i = 0; i < keyLen; ++i) {
            wchar_t c = subKey[i];
            if (c < 32 || c > 126) {
                if (c != L'\\' && c != L' ') return false;
            }
            // Reject dangerous characters that could indicate injection
            if (c == L';' || c == L'|' || c == L'&' || c == L'<' || c == L'>') return false;
        }
        
        // Check for path traversal attempts
        if (wcsstr(subKey, L"..") != nullptr || wcsstr(subKey, L"//") != nullptr) return false;
        
        // Attempt registry access with 64-bit preference
        LONG result = RegOpenKeyExW(root, subKey, 0, access | KEY_WOW64_64KEY, outKey);
        if (result != ERROR_SUCCESS && !(access & KEY_WOW64_64KEY)) {
            result = RegOpenKeyExW(root, subKey, 0, access, outKey);
        }
        
        return result == ERROR_SUCCESS && *outKey != nullptr;
    } catch (...) {
        return false;
    }
}

// Secure registry string value query with validation
static bool SecureRegistryQueryString(HKEY key, const wchar_t* valueName, std::wstring& outValue) noexcept {
    if (!key || !valueName) return false;
    
    try {
        // Validate value name length and content
        size_t nameLen = wcsnlen_s(valueName, 256);
        if (nameLen == 0 || nameLen >= 256) return false;
        
        // Validate value name characters
        for (size_t i = 0; i < nameLen; ++i) {
            wchar_t c = valueName[i];
            if (c < 32 || c > 126) {
                if (c != L'_' && c != L' ') return false;
            }
        }
        
        // Query value size and type
        DWORD type = 0, size = 0;
        LONG result = RegQueryValueExW(key, valueName, nullptr, &type, nullptr, &size);
        if (result != ERROR_SUCCESS && result != ERROR_MORE_DATA) return false;
        if (type != REG_SZ && type != REG_EXPAND_SZ) return false;
        if (size == 0 || size > SecurityConfig::kMaxRegistryStringBytes) return false;
        
        // Allocate buffer with extra space for null terminator
        std::vector<BYTE> buffer(size + sizeof(wchar_t), 0);
        DWORD actualSize = static_cast<DWORD>(buffer.size() - sizeof(wchar_t));
        
        // Read actual registry value
        result = RegQueryValueExW(key, valueName, nullptr, nullptr, buffer.data(), &actualSize);
        if (result != ERROR_SUCCESS) return false;
        
        // Validate and convert to wide string
        if (actualSize > 0 && (actualSize % sizeof(wchar_t)) == 0) {
            wchar_t* wstr_data = reinterpret_cast<wchar_t*>(buffer.data());
            size_t wchar_count = actualSize / sizeof(wchar_t);
            
            // Validate character content
            for (size_t i = 0; i < wchar_count; ++i) {
                if (wstr_data[i] < 32 && wstr_data[i] != L'\0' && 
                    wstr_data[i] != L'\t' && wstr_data[i] != L'\r' && wstr_data[i] != L'\n') {
                    return false;
                }
            }
            
            // Ensure null termination
            if (wchar_count > 0) {
                wstr_data[wchar_count - 1] = L'\0';
                outValue.assign(wstr_data);
            }
        } else {
            return false;
        }
        
        // Final validation of string length
        if (outValue.empty() || outValue.length() >= SecurityConfig::kMaxRegistryStringBytes / sizeof(wchar_t)) {
            return false;
        }
        
        // Remove any embedded null characters or invalid control characters
        outValue.erase(std::remove_if(outValue.begin(), outValue.end(), 
            [](wchar_t c) { return c == L'\0' || (c > 0 && c < 32 && c != L'\t' && c != L'\r' && c != L'\n'); }), 
            outValue.end());
        
        return !outValue.empty();
    } catch (...) {
        return false;
    }
}

// Secure registry DWORD value query with validation
static bool SecureRegistryQueryDWORD(HKEY key, const wchar_t* valueName, DWORD& outValue) noexcept {
    if (!key || !valueName) return false;
    
    try {
        DWORD type = 0, size = sizeof(DWORD);
        DWORD tempValue = 0;
        
        // Query DWORD registry value
        LONG result = RegQueryValueExW(key, valueName, nullptr, &type, 
                                      reinterpret_cast<LPBYTE>(&tempValue), &size);
        
        if (result != ERROR_SUCCESS || type != REG_DWORD || size != sizeof(DWORD)) {
            return false;
        }
        
        // Validate DWORD value is within reasonable range
        if (tempValue > 32767) return false;
        
        outValue = tempValue;
        return true;
    } catch (...) {
        return false;
    }
}

// Fallback version detection using Windows registry
static InternalFullWindowsVersionResult TryGetVersionFromRegistry() noexcept {
    InternalFullWindowsVersionResult result;
    
    try {
        result.method = L"Registry (Fallback)";
        result.assurance = InternalAssurance::Reduced;
        
        // Open registry key with secure access
        HKEY key = nullptr;
        if (!SecureRegistryAccess(HKEY_LOCAL_MACHINE, SecurityConfig::kRegistryKey, KEY_READ, &key)) {
            result.note = L"Registry access failed";
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        // RAII guard for automatic registry key cleanup
        class RegistryGuard {
            HKEY key_;
        public:
            explicit RegistryGuard(HKEY k) : key_(k) {}
            ~RegistryGuard() { if (key_) RegCloseKey(key_); }
            RegistryGuard(const RegistryGuard&) = delete;
            RegistryGuard& operator=(const RegistryGuard&) = delete;
        } reg_guard(key);
        
        DWORD major = 0, minor = 0, build = 0, ubr = 0;
        bool gotVersion = false;
        
        // Parse CurrentVersion string (format: "major.minor")
        std::wstring currentVersion;
        if (SecureRegistryQueryString(key, L"CurrentVersion", currentVersion)) {
            size_t dotPos = currentVersion.find(L'.');
            if (dotPos != std::wstring::npos && dotPos > 0 && dotPos < currentVersion.length() - 1) {
                std::wstring majorStr = currentVersion.substr(0, dotPos);
                std::wstring minorStr = currentVersion.substr(dotPos + 1);
                
                if (SecureStringToULong(majorStr, major) && SecureStringToULong(minorStr, minor)) {
                    gotVersion = true;
                }
            }
        }
        
        // Get build number from CurrentBuild string
        std::wstring currentBuild;
        if (SecureRegistryQueryString(key, L"CurrentBuild", currentBuild)) {
            if (!SecureStringToULong(currentBuild, build)) {
                build = 0;
            }
        }
        
        // Get UBR (Update Build Revision) if available
        if (!SecureRegistryQueryDWORD(key, L"UBR", ubr)) {
            ubr = 0;
        }
        
        // Validate we have minimum required version information
        if (!gotVersion || build == 0) {
            result.note = L"Registry version data incomplete";
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        // Apply compatibility layer corrections for accurate Windows version detection
        if (major == 6 && minor == 3 && build >= 22000 && build <= 30000) {
            major = 10; minor = 0;
            result.note = L"Windows 11 detected (corrected from compatibility layer 6.3)";
        } else if (major == 6 && minor == 3 && build >= 10240 && build <= 21999) {
            major = 10; minor = 0;
            result.note = L"Windows 10 detected (corrected from compatibility layer 6.3)";
        } else if (major == 6 && minor == 2 && build >= 9600 && build <= 10239) {
            major = 6; minor = 3;
            result.note = L"Windows 8.1 detected (corrected from compatibility layer 6.2)";
        } else {
            result.note = L"Registry values obtained";
        }
        
        // Validate final version numbers are within expected ranges
        if (major > 20 || minor > 20 || build < 100 || build > 50000 || ubr > 32767) {
            result.note = L"Registry values out of valid range";
            result.is_consistent = false;
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        // Convert to internal format with bounds checking
        if (!SecureIntegerConvert(major, result.major) ||
            !SecureIntegerConvert(minor, result.minor) ||
            !SecureIntegerConvert(build, result.build) ||
            !SecureIntegerConvert(ubr, result.ubr)) {
            result.note = L"Integer conversion failed";
            result.is_consistent = false;
            result.assurance = InternalAssurance::Unknown;
            return result;
        }
        
        result.is_consistent = true;
        result.GenerateValidationHash();
        
        return result;
    } catch (...) {
        result.note = L"Exception in registry processing";
        result.is_consistent = false;
        result.assurance = InternalAssurance::Unknown;
        return result;
    }
}

// Convert Windows version numbers to human-readable OS name
static std::wstring GetWindowsVersionName(DWORD major, DWORD minor, DWORD build) noexcept {
    try {
        // Validate input parameters
        if (major > 50 || minor > 50 || build > 100000 || build < 100) {
            return L"Windows (Invalid Version)";
        }
        
        // Determine Windows version based on version numbers
        if (major == 10 && minor == 0) {
            if (build >= 22000) return L"Windows 11";
            if (build >= 10240) return L"Windows 10";
        } else if (major == 6) {
            if (minor == 3) return L"Windows 8.1";
            if (minor == 2) return L"Windows 8";
            if (minor == 1) return L"Windows 7";
            if (minor == 0) return L"Windows Vista";
        } else if (major == 5) {
            if (minor == 2) return L"Windows Server 2003";
            if (minor == 1) return L"Windows XP";
            if (minor == 0) return L"Windows 2000";
        }
        return L"Windows (Unknown Version)";
    } catch (...) {
        return L"Windows (Error)";
    }
}

// Initialize global security state with thread safety
static void InitializeSecurityState() noexcept {
    std::call_once(g_security_init_flag, []() noexcept {
        try {
            // Prevent recursive initialization
            if (g_validation_state.critical_section_active.exchange(true)) {
                return;
            }
            
            // Initialize security validation state
            g_validation_state.system_dir_validated.store(true, std::memory_order_release);
            g_validation_state.Initialize();
            g_security_initialized.store(true, std::memory_order_release);
            
            g_validation_state.critical_section_active.store(false);
        } catch (...) {
            g_validation_state.critical_section_active.store(false);
        }
    });
}

// Main secure version detection function with multiple fallback methods
static InternalFullWindowsVersionResult GetWindowsVersionSecure() noexcept {
    InternalFullWindowsVersionResult bestResult;
    
    try {
        InitializeSecurityState();
        
        // Try primary method: RtlGetVersion (kernel-level, most reliable)
        auto rtlResult = TryGetVersionFromRtlGetVersion();
        if (rtlResult.assurance == InternalAssurance::Maximum && rtlResult.major > 0 && 
            rtlResult.build > 0 && rtlResult.is_consistent && rtlResult.IsSecure()) {
            
            bestResult = std::move(rtlResult);
            
            // Supplement with UBR from registry if available
            try {
                HKEY key = nullptr;
                if (SecureRegistryAccess(HKEY_LOCAL_MACHINE, SecurityConfig::kRegistryKey, KEY_READ, &key)) {
                    DWORD ubr = 0;
                    if (SecureRegistryQueryDWORD(key, L"UBR", ubr) && ubr < 32768) {
                        bestResult.ubr = ubr;
                        if (bestResult.note.length() + 40 <= SecurityConfig::kMaxNoteLength) {
                            bestResult.note += L" (UBR supplemented from registry)";
                        }
                    }
                    RegCloseKey(key);
                }
            } catch (...) {
                // Ignore UBR supplementation failures
            }
            
            return bestResult;
        }
        
        // Try secondary method: Registry-based detection
        auto registryResult = TryGetVersionFromRegistry();
        if (registryResult.assurance == InternalAssurance::Reduced && registryResult.major > 0 && 
            registryResult.build > 0 && registryResult.is_consistent && registryResult.IsSecure()) {
            
            // Cross-validate with RtlGetVersion results if available
            if (rtlResult.major > 0 && rtlResult.build > 0) {
                if (!PerformCrossValidation(rtlResult, registryResult)) {
                    g_validation_state.IncrementCrossValidationFailure();
                    registryResult.note += L" (Cross-validation warning)";
                    registryResult.assurance = InternalAssurance::Low;
                }
            }
            
            return registryResult;
        }
        
        // Last resort: Legacy GetVersionEx (deprecated but sometimes necessary)
        try {
            OSVERSIONINFOW osvi = {};
            osvi.dwOSVersionInfoSize = sizeof(osvi);
            
            #pragma warning(push)
            #pragma warning(disable: 4996)
            BOOL versionResult = GetVersionExW(&osvi);
            #pragma warning(pop)
            
            if (versionResult && osvi.dwMajorVersion > 0 && osvi.dwBuildNumber > 0) {
                DWORD major = osvi.dwMajorVersion, minor = osvi.dwMinorVersion, build = osvi.dwBuildNumber;
                
                // Validate returned values are reasonable
                if (major > 20 || minor > 20 || build > 50000 || build < 100) {
                    bestResult.method = L"GetVersionEx (Invalid)";
                    bestResult.note = L"GetVersionEx returned invalid values";
                    bestResult.is_consistent = false;
                    bestResult.assurance = InternalAssurance::Unknown;
                    return bestResult;
                }
                
                // Apply compatibility layer corrections for legacy API
                if (major == 6 && minor == 2 && build >= 22000 && build <= 30000) {
                    major = 10; minor = 0;
                    bestResult.note = L"Windows 11 detected (corrected from GetVersionEx compatibility layer)";
                } else if (major == 6 && minor == 2 && build >= 10240 && build <= 21999) {
                    major = 10; minor = 0;
                    bestResult.note = L"Windows 10 detected (corrected from GetVersionEx compatibility layer)";
                } else {
                    bestResult.note = L"Legacy GetVersionEx method";
                }
                
                // Convert values with bounds checking
                if (!SecureIntegerConvert(major, bestResult.major) ||
                    !SecureIntegerConvert(minor, bestResult.minor) ||
                    !SecureIntegerConvert(build, bestResult.build)) {
                    bestResult.method = L"GetVersionEx (Convert Error)";
                    bestResult.note = L"Integer conversion failed";
                    bestResult.is_consistent = false;
                    bestResult.assurance = InternalAssurance::Unknown;
                    return bestResult;
                }
                
                bestResult.ubr = 0;
                bestResult.method = L"GetVersionEx (Legacy)";
                bestResult.assurance = InternalAssurance::Low;
                bestResult.is_consistent = true;
                bestResult.GenerateValidationHash();
                return bestResult;
            }
        } catch (...) {
            // Legacy method failed, continue to error case
        }
        
        // All methods failed
        bestResult.method = L"Failed";
        bestResult.note = L"All version detection methods failed";
        bestResult.is_consistent = false;
        bestResult.assurance = InternalAssurance::Unknown;
        
        return bestResult;
    } catch (...) {
        bestResult.method = L"Unknown Exception";
        bestResult.note = L"Unknown critical exception in version detection";
        bestResult.is_consistent = false;
        bestResult.assurance = InternalAssurance::Unknown;
        return bestResult;
    }
}

// Secure copy from std::string to fixed-size buffer with validation
template<size_t N>
static bool SecureCopyToFixedBuffer(const std::string& src, char (&dest)[N]) noexcept {
    static_assert(N > 0, "Buffer size must be positive");
    
    try {
        if (src.size() >= N) return false;
        
        SECURE_ZERO_MEMORY(dest, N);
        
        if (src.empty()) {
            dest[0] = '\0';
            return true;
        }
        
        // Validate character content for ASCII safety
        for (char c : src) {
            if (c < 32 && c != '\0' && c != '\t' && c != '\r' && c != '\n') return false;
            if (static_cast<unsigned char>(c) > 127) return false;
        }
        
        // Perform secure string copy
        errno_t err = strcpy_s(dest, N, src.c_str());
        if (err != 0) {
            SECURE_ZERO_MEMORY(dest, N);
            return false;
        }
        
        dest[N-1] = '\0';
        return true;
    } catch (...) {
        SECURE_ZERO_MEMORY(dest, N);
        return false;
    }
}

// Secure copy from std::wstring to fixed-size buffer with UTF-8 conversion
template<size_t N>
static bool SecureCopyWideToFixedBuffer(const std::wstring& src, char (&dest)[N]) noexcept {
    static_assert(N > 0, "Buffer size must be positive");
    
    try {
        SECURE_ZERO_MEMORY(dest, N);
        
        if (src.empty()) {
            dest[0] = '\0';
            return true;
        }
        
        // Validate input size and character content
        if (src.length() > 16383 || src.length() * 4 >= N) return false;
        
        for (wchar_t c : src) {
            if (c < 32 && c != L'\0' && c != L'\t' && c != L'\r' && c != L'\n') return false;
            if (c > 0xFFFF) return false;
        }
        
        // Calculate required buffer size for UTF-8 conversion
        int needed = WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS | WC_NO_BEST_FIT_CHARS, 
                                        src.c_str(), -1, nullptr, 0, nullptr, nullptr);
        if (needed <= 0 || static_cast<size_t>(needed) > N) return false;
        
        // Perform actual conversion
        int result = WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS | WC_NO_BEST_FIT_CHARS, 
                                        src.c_str(), -1, dest, static_cast<int>(N), nullptr, nullptr);
        if (result <= 0) {
            SECURE_ZERO_MEMORY(dest, N);
            return false;
        }
        
        dest[N-1] = '\0';
        return true;
    } catch (...) {
        SECURE_ZERO_MEMORY(dest, N);
        return false;
    }
}

// Detect if application is running from a console environment
static bool IsRunningFromConsole() noexcept {
    try {
        HWND consoleWindow = GetConsoleWindow();
        if (!consoleWindow) return false;
        
        // Get console window process ID
        DWORD processId = 0;
        DWORD threadId = GetWindowThreadProcessId(consoleWindow, &processId);
        if (threadId == 0 || processId == 0) return false;
        if (processId == GetCurrentProcessId()) return false;
        
        // Validate standard handles
        HANDLE hInput = GetStdHandle(STD_INPUT_HANDLE);
        HANDLE hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
        HANDLE hError = GetStdHandle(STD_ERROR_HANDLE);
        
        if (hInput == INVALID_HANDLE_VALUE || hOutput == INVALID_HANDLE_VALUE || 
            hError == INVALID_HANDLE_VALUE) return false;
        
        // Check console mode capabilities
        DWORD inputMode, outputMode;
        bool inputConsole = GetConsoleMode(hInput, &inputMode);
        bool outputConsole = GetConsoleMode(hOutput, &outputMode);
        
        if (!inputConsole || !outputConsole) return false;
        
        // Verify console screen buffer is valid
        CONSOLE_SCREEN_BUFFER_INFO csbi = {};
        if (!GetConsoleScreenBufferInfo(hOutput, &csbi)) return false;
        
        return csbi.dwSize.X > 0 && csbi.dwSize.Y > 0;
    } catch (...) {
        return false;
    }
}

// Display version information in GUI dialog with security validation
static void ShowVersionDialog(const InternalFullWindowsVersionResult& result) noexcept {
    if (!result.IsSecure()) return;
    
    try {
        constexpr size_t MAX_DIALOG_TEXT = 1024;
        wchar_t dialogText[MAX_DIALOG_TEXT] = {};
        
        // Prepare safe strings for dialog display
        std::wstring versionName = GetWindowsVersionName(result.major, result.minor, result.build);
        if (versionName.length() > 64) {
            versionName = versionName.substr(0, 64);
        }
        
        std::wstring safeMethod = result.method;
        if (safeMethod.length() > 32) {
            safeMethod = safeMethod.substr(0, 32);
        }
        
        std::wstring safeNote = result.note;
        if (safeNote.length() > 64) {
            safeNote = safeNote.substr(0, 64);
        }
        
        const wchar_t* assuranceStr = AssuranceToString(result.assurance);
        
        // Format dialog text with version information
        int written = swprintf_s(
            dialogText, MAX_DIALOG_TEXT,
            L"Windows Version Detection Results\n\n"
            L"OS Name: %.*s\n"
            L"Version: %u.%u.%u%s%u\n"
            L"Method: %.*s\n"
            L"Assurance: %s\n"
            L"Consistent: %s\n\n"
            L"Technical Details:\n%.*s",
            static_cast<int>(versionName.length()), versionName.c_str(),
            result.major, result.minor, result.build,
            result.ubr > 0 ? L"." : L"", result.ubr > 0 ? result.ubr : 0,
            static_cast<int>(safeMethod.length()), safeMethod.c_str(),
            assuranceStr,
            result.is_consistent ? L"Yes" : L"No",
            static_cast<int>(safeNote.length()), safeNote.c_str()
        );
        
        // Display dialog if formatting succeeded
        if (written > 0 && written < static_cast<int>(MAX_DIALOG_TEXT)) {
            MessageBoxW(nullptr, dialogText, L"Windows Build Number Detection",
                       MB_OK | MB_ICONINFORMATION | MB_TOPMOST | MB_SETFOREGROUND);
        } else {
            MessageBoxW(nullptr, L"Windows version detection completed, but dialog formatting failed.",
                       L"Windows Build Number Detection", MB_OK | MB_ICONWARNING | MB_TOPMOST | MB_SETFOREGROUND);
        }
    } catch (...) {
        MessageBoxW(nullptr, L"Critical error during dialog display.",
                   L"Windows Build Number Detection", MB_OK | MB_ICONERROR | MB_TOPMOST | MB_SETFOREGROUND);
    }
}

// FFI export function for external integration with comprehensive validation
extern "C" __declspec(dllexport) int GetWindowsFullVersionFFI(WindowsFullVersionFFI* outStruct, size_t outSize) noexcept {
    if (!outStruct) return -1;
    if (outSize < sizeof(WindowsFullVersionFFI)) return -2;
    if (!SECURE_VALIDATE_WRITE_POINTER(outStruct, sizeof(WindowsFullVersionFFI))) return -3;
    if (reinterpret_cast<uintptr_t>(outStruct) % alignof(WindowsFullVersionFFI) != 0) return -4;
    
    try {
        // Initialize structure with security headers
        SECURE_ZERO_MEMORY(outStruct, sizeof(WindowsFullVersionFFI));
        
        outStruct->magic_header = WVF_MAGIC_HEADER;
        outStruct->struct_version = WVF_STRUCT_VERSION;
        outStruct->security_signature = WVF_SECURITY_SIGNATURE;
        outStruct->magic_footer = WVF_MAGIC_FOOTER;
        outStruct->final_canary = SecurityConfig::kSecurityCanary;
        
        // Check rate limiting to prevent abuse
        uint32_t validation_count = g_security_validation_count.fetch_add(1, std::memory_order_acq_rel);
        if (validation_count > SecurityConfig::kMaxSecurityValidations) return -20;
        
        // Get version information using secure detection
        auto result = GetWindowsVersionSecure();
        if (!result.IsSecure()) return -22;
        
        // Convert version numbers with bounds checking
        if (!SecureIntegerConvert(result.major, outStruct->major) ||
            !SecureIntegerConvert(result.minor, outStruct->minor) ||
            !SecureIntegerConvert(result.build, outStruct->build) ||
            !SecureIntegerConvert(result.ubr, outStruct->ubr)) return -24;
        
        // Set consistency and assurance flags
        outStruct->is_consistent = result.is_consistent ? 1U : 0U;
        outStruct->assurance = static_cast<uint8_t>(result.assurance);
        outStruct->winverify_trust_result = result.winverify_trust_result;
        
        // Copy string data with secure conversion
        if (!SecureCopyWideToFixedBuffer(result.method, outStruct->method)) {
            if (strcpy_s(outStruct->method, sizeof(outStruct->method), "Unknown") != 0) return -25;
        }
        
        if (!SecureCopyWideToFixedBuffer(result.note, outStruct->note)) {
            if (strcpy_s(outStruct->note, sizeof(outStruct->note), "Note unavailable") != 0) return -26;
        }
        
        if (!SecureCopyWideToFixedBuffer(result.integrity_summary, outStruct->integrity_summary)) {
            if (strcpy_s(outStruct->integrity_summary, sizeof(outStruct->integrity_summary), "Summary unavailable") != 0) return -27;
        }
        
        if (!SecureCopyWideToFixedBuffer(result.file_product_version, outStruct->file_product_version)) {
            if (strcpy_s(outStruct->file_product_version, sizeof(outStruct->file_product_version), "Unknown") != 0) return -28;
        }
        
        // Copy hash data if available
        if (!result.file_sha256_hex.empty()) {
            if (!SecureCopyToFixedBuffer(result.file_sha256_hex, outStruct->file_sha256)) {
                if (strcpy_s(outStruct->file_sha256, sizeof(outStruct->file_sha256), "Hash_Error") != 0) return -29;
            }
        } else {
            if (strcpy_s(outStruct->file_sha256, sizeof(outStruct->file_sha256), "No_Hash") != 0) return -30;
        }
        
        // Copy signer information with bounds checking
        size_t signer_count = std::min(result.signer_subjects.size(), static_cast<size_t>(WVF_MAX_SIGNERS));
        if (!SecureIntegerConvert(signer_count, outStruct->signer_count)) return -31;
        
        for (uint32_t i = 0; i < outStruct->signer_count; ++i) {
            if (i < result.signer_subjects.size()) {
                if (!SecureCopyWideToFixedBuffer(result.signer_subjects[i], outStruct->signer_subjects[i])) {
                    if (strcpy_s(outStruct->signer_subjects[i], sizeof(outStruct->signer_subjects[i]), "Signer_Error") != 0) return -32;
                }
            }
        }
        
        // Calculate and set integrity checksum
        outStruct->checksum = result.CalculateChecksum();
        
        // Final validation of structure integrity
        if (outStruct->magic_header != WVF_MAGIC_HEADER || 
            outStruct->magic_footer != WVF_MAGIC_FOOTER ||
            outStruct->struct_version != WVF_STRUCT_VERSION ||
            outStruct->security_signature != WVF_SECURITY_SIGNATURE ||
            outStruct->final_canary != SecurityConfig::kSecurityCanary) {
            SECURE_ZERO_MEMORY(outStruct, sizeof(WindowsFullVersionFFI));
            return -33;
        }
        
        return 0;
        
    } catch (...) {
        if (outStruct && SECURE_VALIDATE_WRITE_POINTER(outStruct, sizeof(WindowsFullVersionFFI))) {
            SECURE_ZERO_MEMORY(outStruct, sizeof(WindowsFullVersionFFI));
        }
        return -41;
    }
}

// Main application entry point with comprehensive error handling
int main() noexcept {
    try {
        // Initialize security subsystem
        InitializeSecurityState();
        g_security_initialized.store(true, std::memory_order_release);
        
        // Perform secure version detection
        auto result = GetWindowsVersionSecure();
        
        // Validate detection results
        if (result.major == 0 || result.build == 0 || !result.IsSecure()) {
            if (IsRunningFromConsole()) {
                std::wcerr << L"Error: Unable to determine Windows version securely." << std::endl;
            } else {
                MessageBoxW(nullptr, L"Error: Unable to determine Windows version securely.",
                           L"Windows Version Detection - Error", MB_OK | MB_ICONERROR | MB_TOPMOST);
            }
            return 1;
        }
        
        // Display results based on execution environment
        if (IsRunningFromConsole()) {
            try {
                // Console output with detailed version information
                std::wstring versionName = GetWindowsVersionName(result.major, result.minor, result.build);
                std::wcout << versionName << std::endl;
                std::wcout << L"Version: " << result.major << L"." << result.minor << L"." << result.build;
                
                if (result.ubr > 0) {
                    std::wcout << L"." << result.ubr;
                }
                
                std::wcout << L"\nMethod: " << result.method;
                std::wcout << L"\nAssurance: " << AssuranceToString(result.assurance);
                std::wcout << L"\nConsistent: " << (result.is_consistent ? L"Yes" : L"No");
                
                if (!result.note.empty()) {
                    std::wcout << L"\nNotes: " << result.note;
                }
                
                std::wcout << std::endl;
            } catch (...) {
                std::wcerr << L"Error: Console output failed." << std::endl;
                return 2;
            }
        } else {
            // GUI dialog display for windowed execution
            ShowVersionDialog(result);
        }
        
        // Return success or warning based on consistency
        return result.is_consistent ? 0 : 1;
        
    } catch (...) {
        try {
            // Handle critical exceptions with appropriate user notification
            if (IsRunningFromConsole()) {
                std::wcerr << L"Critical security error occurred." << std::endl;
            } else {
                MessageBoxW(nullptr, L"Critical security error occurred.",
                           L"Windows Version Detection - Critical Error", MB_OK | MB_ICONERROR | MB_TOPMOST);
            }
        } catch (...) {
            // Silent failure if even error reporting fails
        }
        return 3;
    }
}

#pragma warning(pop)