📄 wmistr.h
字号:
// data
// On Return: Size of output data, 0 if no output
// data
UCHAR VariableData[];
// instance names and padding so data value begins on 8 byte boundry
// data item value
} WNODE_METHOD_ITEM, *PWNODE_METHOD_ITEM;
typedef struct tagWNODE_EVENT_ITEM
{
struct _WNODE_HEADER WnodeHeader;
// Different data could be here depending upon the flags set in the
// WNODE_HEADER above. If the WNODE_FLAG_ALL_DATA flag is set then the
// contents of a WNODE_ALL_DATA (excluding WNODE_HEADER) is here. If the
// WNODE_FLAG_SINGLE_INSTANCE flag is set then a WNODE_SINGLE_INSTANCE
// (excluding WNODE_HEADER) is here. Lastly if the WNODE_FLAG_SINGLE_ITEM
// flag is set then a WNODE_SINGLE_ITEM (excluding WNODE_HEADER) is here.
} WNODE_EVENT_ITEM, *PWNODE_EVENT_ITEM;
//
// If a KM data provider needs to fire an event that is larger than the
// maximum size that WMI allows then it should fire a WNODE_EVENT_REFERENCE
// that specifies which guid and instance name to query for the actual data
// that should be part of the event.
typedef struct tagWNODE_EVENT_REFERENCE
{
struct _WNODE_HEADER WnodeHeader;
GUID TargetGuid;
ULONG TargetDataBlockSize;
union
{
ULONG TargetInstanceIndex;
WCHAR TargetInstanceName[];
};
} WNODE_EVENT_REFERENCE, *PWNODE_EVENT_REFERENCE;
typedef struct tagWNODE_TOO_SMALL
{
struct _WNODE_HEADER WnodeHeader;
ULONG SizeNeeded; // Size needed to build WNODE result
} WNODE_TOO_SMALL, *PWNODE_TOO_SMALL;
typedef struct
{
GUID Guid; // Guid of data block being registered or updated
ULONG Flags; // Flags
ULONG InstanceCount; // Count of static instances names for the guid
union
{
// If WMIREG_FLAG_INSTANCE_LIST then this has the offset
// to a list of InstanceCount counted UNICODE
// strings placed end to end.
ULONG InstanceNameList;
// If WMIREG_FLAG_INSTANCE_BASENAME then this has the
// offset to a single counted UNICODE string that
// has the basename for the instance names.
ULONG BaseNameOffset;
// If WMIREG_FLAG_INSTANCE_PDO is set then InstanceInfo
// has the PDO whose device instance path will
// become the instance name
ULONG_PTR Pdo;
// If WMIREG_FLAG_INSTANCE_REFERENCE then this points to
// a WMIREGINSTANCEREF structure.
ULONG_PTR InstanceInfo;// Offset from beginning of the WMIREGINFO structure to
};
} WMIREGGUIDW, *PWMIREGGUIDW;
typedef WMIREGGUIDW WMIREGGUID;
typedef PWMIREGGUIDW PWMIREGGUID;
// Set if collection must be enabled for the guid before the data provider
// can be queried for data.
#define WMIREG_FLAG_EXPENSIVE 0x00000001
// Set if instance names for this guid are specified in a static list within
// the WMIREGINFO
#define WMIREG_FLAG_INSTANCE_LIST 0x00000004
// Set if instance names are to be static and generated by WMI using a
// base name in the WMIREGINFO and an index
#define WMIREG_FLAG_INSTANCE_BASENAME 0x00000008
// Set if WMI should do automatic mapping of a PDO to device instance name
// as the instance name for the guid. This flag should only be used by
// kernel mode data providers.
#define WMIREG_FLAG_INSTANCE_PDO 0x00000020
// Note the flags WMIREG_FLAG_INSTANCE_LIST, WMIREG_FLAG_INSTANCE_BASENAME,
// WMIREG_FLAG_INSTANCE_REFERENCE and WMIREG_FLAG_INSTANCE_PDO are mutually
// exclusive.
//
// These flags are only valid in a response to WMI_GUID_REGUPDATE
#define WMIREG_FLAG_REMOVE_GUID 0x00010000 // Remove support for guid
#define WMIREG_FLAG_RESERVED1 0x00020000 // Reserved by WMI
#define WMIREG_FLAG_RESERVED2 0x00040000 // Reserved by WMI
// Set if guid is one that is written to trace log.
// This guid cannot be queried directly via WMI, but must be read using
// logger apis.
#define WMIREG_FLAG_TRACED_GUID 0x00080000
//
// Only those Trace Guids that have this bit set can receive
// Enable/Disable Notifications.
//
#define WMIREG_FLAG_TRACE_CONTROL_GUID 0x00001000
//
// Set if the guid is only used for firing events. Guids that can be queried
// and that fire events should not have this bit set.
#define WMIREG_FLAG_EVENT_ONLY_GUID 0x00000040
typedef struct
{
// Size of entire WMIREGINFO structure including this ULONG
// and any static instance names that follow
ULONG BufferSize;
ULONG NextWmiRegInfo; // Offset to next WMIREGINFO structure
ULONG RegistryPath; // Offset from beginning of WMIREGINFO structure to a
// counted Unicode string containing
// the driver registry path (under HKLM\CCS\Services)
// This must be filled only by kernel mode data
// providers
// Offset from beginning of WMIREGINFO structure to a
// counted Unicode string containing
// the name of resource in driver file containing MOF info
ULONG MofResourceName;
// Count of WMIREGGUID structures immediately following
ULONG GuidCount;
WMIREGGUIDW WmiRegGuid[]; // array of GuidCount WMIREGGUID structures
// Variable length data including :
// Instance Names
} WMIREGINFOW, *PWMIREGINFOW;
typedef WMIREGINFOW WMIREGINFO;
typedef PWMIREGINFOW PWMIREGINFO;
//
// WMI request codes
typedef enum
{
#ifndef _WMIKM_
WMI_GET_ALL_DATA = 0,
WMI_GET_SINGLE_INSTANCE = 1,
WMI_SET_SINGLE_INSTANCE = 2,
WMI_SET_SINGLE_ITEM = 3,
WMI_ENABLE_EVENTS = 4,
WMI_DISABLE_EVENTS = 5,
WMI_ENABLE_COLLECTION = 6,
WMI_DISABLE_COLLECTION = 7,
WMI_REGINFO = 8,
WMI_EXECUTE_METHOD = 9
#endif
} WMIDPREQUESTCODE;
#if defined(_WINNT_) || defined(WINNT)
//
// WMI guid objects have the following rights
// WMIGUID_QUERY
// WMIGUID_SET
// WMIGUID_NOTIFICATION
// WMIGUID_READ_DESCRIPTION
// WMIGUID_EXECUTE
// TRACELOG_CREATE_REALTIME
// TRACELOG_CREATE_ONDISK
// TRACELOG_GUID_ENABLE
// TRACELOG_ACCESS_KERNEL_LOGGER
// TRACELOG_CREATE_INPROC
// TRACELOG_ACCESS_REALTIME
//
// GuidTypes
//
#ifndef _WMIKM_
#define WMI_GUIDTYPE_TRACECONTROL 0
#define WMI_GUIDTYPE_TRACE 1
#define WMI_GUIDTYPE_DATA 2
#define WMI_GUIDTYPE_EVENT 3
#endif
#define WMIGUID_QUERY 0x0001
#define WMIGUID_SET 0x0002
#define WMIGUID_NOTIFICATION 0x0004
#define WMIGUID_READ_DESCRIPTION 0x0008
#define WMIGUID_EXECUTE 0x0010
#define TRACELOG_CREATE_REALTIME 0x0020
#define TRACELOG_CREATE_ONDISK 0x0040
#define TRACELOG_GUID_ENABLE 0x0080
#define TRACELOG_ACCESS_KERNEL_LOGGER 0x0100
#define TRACELOG_CREATE_INPROC 0x0200
#define TRACELOG_ACCESS_REALTIME 0x0400
#define WMIGUID_ALL_ACCESS (STANDARD_RIGHTS_READ | \
WMIGUID_QUERY | \
WMIGUID_SET | \
WMIGUID_NOTIFICATION | \
WMIGUID_READ_DESCRIPTION | \
WMIGUID_EXECUTE | \
TRACELOG_CREATE_REALTIME | \
TRACELOG_CREATE_ONDISK | \
TRACELOG_GUID_ENABLE | \
TRACELOG_ACCESS_KERNEL_LOGGER |\
TRACELOG_CREATE_INPROC | \
TRACELOG_ACCESS_REALTIME)
#define WMI_GLOBAL_LOGGER_ID 0x0001
#endif
#pragma option pop /*P_O_Pop*/
#endif
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -