📄 wmistr.h
字号:
/*++
Copyright (c) Microsoft Corporation. All rights reserved.
Module Name:
Wmistr.h
Abstract:
WMI structure definitions
--*/
#ifndef _WMISTR_
#define _WMISTR_
#pragma warning(disable: 4200) // nonstandard extension used : zero-sized array in struct/union
#pragma warning(disable: 4201) // nonstandard extension used : nameless struct/union
//
// WNODE definition
typedef struct _WNODE_HEADER
{
ULONG BufferSize; // Size of entire buffer inclusive of this ULONG
ULONG ProviderId; // Provider Id of driver returning this buffer
union
{
ULONG64 HistoricalContext; // Logger use
struct
{
ULONG Version; // Reserved
ULONG Linkage; // Linkage field reserved for WMI
};
};
union
{
ULONG CountLost; // Reserved
HANDLE KernelHandle; // Kernel handle for data block
LARGE_INTEGER TimeStamp; // Timestamp as returned in units of 100ns
// since 1/1/1601
};
GUID Guid; // Guid for data block returned with results
ULONG ClientContext;
ULONG Flags; // Flags, see below
} WNODE_HEADER, *PWNODE_HEADER;
//
// WNODE_HEADER flags are defined as follows
#define WNODE_FLAG_ALL_DATA 0x00000001 // set for WNODE_ALL_DATA
#define WNODE_FLAG_SINGLE_INSTANCE 0x00000002 // set for WNODE_SINGLE_INSTANCE
#define WNODE_FLAG_SINGLE_ITEM 0x00000004 // set for WNODE_SINGLE_ITEM
#define WNODE_FLAG_EVENT_ITEM 0x00000008 // set for WNODE_EVENT_ITEM
// Set if data block size is
// identical for all instances
// (used with WNODE_ALL_DATA
// only)
#define WNODE_FLAG_FIXED_INSTANCE_SIZE 0x00000010
#define WNODE_FLAG_TOO_SMALL 0x00000020 // set for WNODE_TOO_SMALL
// Set when a data provider returns a
// WNODE_ALL_DATA in which the number of
// instances and their names returned
// are identical to those returned from the
// previous WNODE_ALL_DATA query. Only data
// blocks registered with dynamic instance
// names should use this flag.
#define WNODE_FLAG_INSTANCES_SAME 0x00000040
// Instance names are not specified in
// WNODE_ALL_DATA; values specified at
// registration are used instead. Always
// set for guids registered with static
// instance names
#define WNODE_FLAG_STATIC_INSTANCE_NAMES 0x00000080
#define WNODE_FLAG_INTERNAL 0x00000100 // Used internally by WMI
// timestamp should not be modified by
// a historical logger
#define WNODE_FLAG_USE_TIMESTAMP 0x00000200
#define WNODE_FLAG_PERSIST_EVENT 0x00000400
#define WNODE_FLAG_EVENT_REFERENCE 0x00002000
// Set if Instance names are ansi. Only set when returning from
// WMIQuerySingleInstanceA and WMIQueryAllDataA
#define WNODE_FLAG_ANSI_INSTANCENAMES 0x00004000
// Set if WNODE is a method call
#define WNODE_FLAG_METHOD_ITEM 0x00008000
// Set if instance names originated from a PDO
#define WNODE_FLAG_PDO_INSTANCE_NAMES 0x00010000
// The second byte, except the first bit is used exclusively for tracing
#define WNODE_FLAG_TRACED_GUID 0x00020000 // denotes a trace
#define WNODE_FLAG_LOG_WNODE 0x00040000 // request to log Wnode
#define WNODE_FLAG_USE_GUID_PTR 0x00080000 // Guid is actually a pointer
#define WNODE_FLAG_USE_MOF_PTR 0x00100000 // MOF data are dereferenced
#define WNODE_FLAG_NO_HEADER 0x00200000 // Trace without header
// Set for events that are WNODE_EVENT_REFERENCE
// Mask for event severity level. Level 0xff is the most severe type of event
#define WNODE_FLAG_SEVERITY_MASK 0xff000000
//
// This structure is used within the WNODE_ALL_DATA when the data blocks
// for the different instances are different lengths. If the data blocks
// for the different instances are identical lengths then
// WNODE_FLAG_FIXED_INSTANCE_SIZE should be set and FixedInstanceSize
// set to the common data block size.
typedef struct
{
ULONG OffsetInstanceData; // Offset from beginning of WNODE_ALL_DATA
// to Data block for instance
ULONG LengthInstanceData; // Length of data block for instance
} OFFSETINSTANCEDATAANDLENGTH, *POFFSETINSTANCEDATAANDLENGTH;
typedef struct tagWNODE_ALL_DATA
{
struct _WNODE_HEADER WnodeHeader;
ULONG DataBlockOffset;// Offset from begin of WNODE to first data block
ULONG InstanceCount; // Count of instances whose data follows.
// Offset to an array of offsets to the instance names
ULONG OffsetInstanceNameOffsets;
// If WNODE_FLAG_FIXED_INSTANCE_SIZE is set in Flags then
// FixedInstanceSize specifies the size of each data block. In this case
// there is one ULONG followed by the data blocks.
// If WNODE_FLAG_FIXED_INSTANCE_SIZE is not set
// then OffsetInstanceDataAndLength
// is an array of OFFSETINSTANCEDATAANDLENGTH that specifies the
// offsets and lengths of the data blocks for each instance.
union
{
ULONG FixedInstanceSize;
OFFSETINSTANCEDATAANDLENGTH OffsetInstanceDataAndLength[];
/* [InstanceCount] */
};
// padding so that first data block begins on a 8 byte boundry
// data blocks and instance names for all instances
} WNODE_ALL_DATA, *PWNODE_ALL_DATA;
typedef struct tagWNODE_SINGLE_INSTANCE
{
struct _WNODE_HEADER WnodeHeader;
// Offset from beginning of WNODE_SINGLE_INSTANCE
// to instance name. Use when
// WNODE_FLAG_STATIC_INSTANCE_NAMES is reset
// (Dynamic instance names)
ULONG OffsetInstanceName;
// Instance index when
// WNODE_FLAG_STATIC_INSTANCE_NAME is set
ULONG InstanceIndex; // (Static Instance Names)
ULONG DataBlockOffset; // offset from beginning of WNODE to data block
ULONG SizeDataBlock; // Size of data block for instance
UCHAR VariableData[];
// instance names and padding so data block begins on 8 byte boundry
// data block
} WNODE_SINGLE_INSTANCE, *PWNODE_SINGLE_INSTANCE;
typedef struct tagWNODE_SINGLE_ITEM
{
struct _WNODE_HEADER WnodeHeader;
// Offset from beginning of WNODE_SINGLE_INSTANCE
// to instance name. Examine when
// WNODE_FLAG_STATIC_INSTANCE_NAME is reset
// (Dynamic instance names)
ULONG OffsetInstanceName;
// Instance index when
// WNODE_FLAG_STATIC_INSTANCE_NAME
ULONG InstanceIndex; // set (Static Instance Names)
ULONG ItemId; // Item Id for data item being set
ULONG DataBlockOffset; // offset from WNODE begin to data item value
ULONG SizeDataItem; // Size of data item
UCHAR VariableData[];
// instance names and padding so data value begins on 8 byte boundry
// data item value
} WNODE_SINGLE_ITEM, *PWNODE_SINGLE_ITEM;
typedef struct tagWNODE_METHOD_ITEM
{
struct _WNODE_HEADER WnodeHeader;
// Offset from beginning of WNODE_METHOD_ITEM
// to instance name. Examine when
// WNODE_FLAG_STATIC_INSTANCE_NAME is reset
// (Dynamic instance names)
ULONG OffsetInstanceName;
// Instance index when
// WNODE_FLAG_STATIC_INSTANCE_NAME
ULONG InstanceIndex; // set (Static Instance Names)
ULONG MethodId; // Method id of method being called
ULONG DataBlockOffset; // On Entry: offset from WNODE to input data
// On Return: offset from WNODE to input and
// output data blocks
ULONG SizeDataBlock; // On Entry: Size of input data, 0 if no input
// data
// On Return: Size of output data, 0 if no output
// data
UCHAR VariableData[];
// instance names and padding so data value begins on 8 byte boundry
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -