Example: Receiving Event Notifications Through WMI

淩亂°似流年 2022-08-24 04:25 176阅读 0赞

You can use the procedure and code example in this topic to complete WMI client application that performs COM initialization, connects to WMI on the local computer, receives an event notification, and then cleans up. The example notifies the user of an event when a new process is created. The events are received asynchronously.

The following procedure is used to execute the WMI application. Steps 1 through 5 contain all of the steps required to set up and connect to WMI, and step 6 is where the event notifications are received.

![Aa390425.wedge(en-us,VS.85).gif][Aa390425.wedge_en-us_VS.85_.gif]**To receive a event notification through WMI**

1.  Initialize COM parameters with a call to [**CoInitializeEx**][CoInitializeEx].
    
    Fore more information, see [Initializing COM for a WMI Application][].
2.  Initialize COM process security by calling [**CoInitializeSecurity**][CoInitializeSecurity].
    
    > **Windows 2000:** Specify the default authentication credentials for a user by using a **SOLE\_AUTHENTICATION\_LIST** structure in the pAuthList parameter of **CoInitializeSecurity**.
    
    For more information, see [Setting the Default Process Security Level Using C++][Setting the Default Process Security Level Using C].
3.  Obtain the initial locator to WMI by calling [**CoCreateInstance**][CoCreateInstance].
    
    For more information, see [Creating a Connection to a WMI Namespace][].
4.  Obtain a pointer to [**IWbemServices**][IWbemServices] for the root/cimv2 namespace on the local computer by calling [**IWbemLocator::ConnectServer**][IWbemLocator_ConnectServer]. To connect to a remote computer, see [Example: Getting WMI Data from a Remote Computer][Example_ Getting WMI Data from a Remote Computer].
    
    For more information, see [Creating a Connection to a WMI Namespace][].
5.  Set **IWbemServices** proxy security so the WMI service can impersonate the client by calling [**CoSetProxyBlanket**][CoSetProxyBlanket].
    
    For more information, see [Setting the Security Levels on a WMI Connection][].
6.  Use the **IWbemServices** pointer to make requests to WMI. This example uses the [**IWbemServices::ExecNotificationQueryAsync**][IWbemServices_ExecNotificationQueryAsync] method to receive asynchronous events. When you receive asynchronous events, you must provide an implementation of [**IWbemObjectSink**][IWbemObjectSink]. This example provides the implementation in the EventSink class. The implementation code and header file code for this class are provided below the main example. The **IWbemServices::ExecNotificationQueryAsync** method calls the **EventSink::Indicate** method whenever an event is received. For this example the **EventSink::Indicate** method is called whenever a process is created. To test this example, run the code and start a process such as Notepad.exe. This triggers an event notification.
    
    For more information about making requests of WMI, see [Manipulating Class and Instance Information][] and [Calling a Method][].

The following example code receives event notifications through WMI.

#include "eventsink.h"
    
    int main(int iArgCnt, char ** argv)
    {
        HRESULT hres;
    
        // Step 1: --------------------------------------------------
        // Initialize COM. ------------------------------------------
    
        hres =  CoInitializeEx(0, COINIT_MULTITHREADED); 
        if (FAILED(hres))
        {
            cout << "Failed to initialize COM library. Error code = 0x" 
                 << hex << hres << endl;
            return 1;                  // Program has failed.
        }
    
        // Step 2: --------------------------------------------------
        // Set general COM security levels --------------------------
        // Note: If you are using Windows 2000, you need to specify -
        // the default authentication credentials for a user by using
        // a SOLE_AUTHENTICATION_LIST structure in the pAuthList ----
        // parameter of CoInitializeSecurity ------------------------
    
        hres =  CoInitializeSecurity(
            NULL, 
            -1,                          // COM negotiates service
            NULL,                        // Authentication services
            NULL,                        // Reserved
            RPC_C_AUTHN_LEVEL_DEFAULT,   // Default authentication 
            RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation  
            NULL,                        // Authentication info
            EOAC_NONE,                   // Additional capabilities 
            NULL                         // Reserved
            );
    
                          
        if (FAILED(hres))
        {
            cout << "Failed to initialize security. Error code = 0x" 
                 << hex << hres << endl;
            CoUninitialize();
            return 1;                      // Program has failed.
        }
        
        // Step 3: ---------------------------------------------------
        // Obtain the initial locator to WMI -------------------------
    
        IWbemLocator *pLoc = NULL;
    
        hres = CoCreateInstance(
            CLSID_WbemLocator,             
            0, 
            CLSCTX_INPROC_SERVER, 
            IID_IWbemLocator, (LPVOID *) &pLoc);
     
        if (FAILED(hres))
        {
            cout << "Failed to create IWbemLocator object. "
                 << "Err code = 0x"
                 << hex << hres << endl;
            CoUninitialize();
            return 1;                 // Program has failed.
        }
    
        // Step 4: ---------------------------------------------------
        // Connect to WMI through the IWbemLocator::ConnectServer method
    
        IWbemServices *pSvc = NULL;
    	
        // Connect to the local root/cimv2 namespace
        // and obtain pointer pSvc to make IWbemServices calls.
        hres = pLoc->ConnectServer(
            _bstr_t(L"ROOT//CIMV2"), 
            NULL,
            NULL, 
            0, 
            NULL, 
            0, 
            0, 
            &pSvc
        );
    	    
        if (FAILED(hres))
        {
            cout << "Could not connect. Error code = 0x" 
                 << hex << hres << endl;
            pLoc->Release();     
            CoUninitialize();
            return 1;                // Program has failed.
        }
    
        cout << "Connected to ROOT//CIMV2 WMI namespace" << endl;
    
    
        // Step 5: --------------------------------------------------
        // Set security levels on the proxy -------------------------
    
        hres = CoSetProxyBlanket(
            pSvc,                        // Indicates the proxy to set
            RPC_C_AUTHN_WINNT,           // RPC_C_AUTHN_xxx 
            RPC_C_AUTHZ_NONE,            // RPC_C_AUTHZ_xxx 
            NULL,                        // Server principal name 
            RPC_C_AUTHN_LEVEL_CALL,      // RPC_C_AUTHN_LEVEL_xxx 
            RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx
            NULL,                        // client identity
            EOAC_NONE                    // proxy capabilities 
        );
    
        if (FAILED(hres))
        {
            cout << "Could not set proxy blanket. Error code = 0x" 
                 << hex << hres << endl;
            pSvc->Release();
            pLoc->Release();     
            CoUninitialize();
            return 1;               // Program has failed.
        }
    
        // Step 6: -------------------------------------------------
        // Receive event notifications -----------------------------
    
        // Use an unsecured apartment for security
        IUnsecuredApartment* pUnsecApp = NULL;
    
        hres = CoCreateInstance(CLSID_UnsecuredApartment, NULL, 
            CLSCTX_LOCAL_SERVER, IID_IUnsecuredApartment, 
            (void**)&pUnsecApp);
     
        EventSink* pSink = new EventSink;
        pSink->AddRef();
    
        IUnknown* pStubUnk = NULL; 
        pUnsecApp->CreateObjectStub(pSink, &pStubUnk);
    
        IWbemObjectSink* pStubSink = NULL;
        pStubUnk->QueryInterface(IID_IWbemObjectSink,
            (void **) &pStubSink);
    
        // The ExecNotificationQueryAsync method will call
        // The EventQuery::Indicate method when an event occurs
        hres = pSvc->ExecNotificationQueryAsync(
            _bstr_t("WQL"), 
            _bstr_t("SELECT * " 
                "FROM __InstanceCreationEvent WITHIN 1 "
                "WHERE TargetInstance ISA 'Win32_Process'"), 
            WBEM_FLAG_SEND_STATUS, 
            NULL, 
            pStubSink);
    
        // Check for errors.
        if (FAILED(hres))
        {
            printf("ExecNotificationQueryAsync failed "
                "with = 0x%X/n", hres);
            pSvc->Release();
            pLoc->Release();
            pUnsecApp->Release();
            pStubUnk->Release();
            pSink->Release();
            pStubSink->Release();
            CoUninitialize();    
            return 1;
        }
    
        // Wait for the event
        Sleep(10000);
             
        hres = pSvc->CancelAsyncCall(pStubSink);
    
        // Cleanup
        // ========
    
        pSvc->Release();
        pLoc->Release();
        pUnsecApp->Release();
        pStubUnk->Release();
        pSink->Release();
        pStubSink->Release();
        CoUninitialize();
    
        return 0;   // Program successfully completed.
    	
    }

The following header file is used for the class EventSink. The EventSink class is used in the previous code example.

// EventSink.h
    #ifndef EVENTSINK_H
    #define EVENTSINK_H
    
    #define _WIN32_DCOM
    #include <iostream>
    using namespace std;
    #include <comdef.h>
    #include <Wbemidl.h>
    
    # pragma comment(lib, "wbemuuid.lib")
    
    class EventSink : public IWbemObjectSink
    {
        LONG m_lRef;
        bool bDone;
    
    public:
        EventSink() { m_lRef = 0; }
       ~EventSink() { bDone = true; }
    
        virtual ULONG STDMETHODCALLTYPE AddRef();
        virtual ULONG STDMETHODCALLTYPE Release();        
        virtual HRESULT 
            STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppv);
    
        virtual HRESULT STDMETHODCALLTYPE Indicate( 
                LONG lObjectCount,
                IWbemClassObject __RPC_FAR *__RPC_FAR *apObjArray
                );
            
        virtual HRESULT STDMETHODCALLTYPE SetStatus( 
                /* [in] */ LONG lFlags,
                /* [in] */ HRESULT hResult,
                /* [in] */ BSTR strParam,
                /* [in] */ IWbemClassObject __RPC_FAR *pObjParam
                );
    };
    
    #endif    // end of EventSink.h

The following example code is an implementation of the EventSink class.

// EventSink.cpp
    #include "eventsink.h"
    
    ULONG EventSink::AddRef()
    {
        return InterlockedIncrement(&m_lRef);
    }
    
    ULONG EventSink::Release()
    {
        LONG lRef = InterlockedDecrement(&m_lRef);
        if(lRef == 0)
            delete this;
        return lRef;
    }
    
    HRESULT EventSink::QueryInterface(REFIID riid, void** ppv)
    {
        if (riid == IID_IUnknown || riid == IID_IWbemObjectSink)
        {
            *ppv = (IWbemObjectSink *) this;
            AddRef();
            return WBEM_S_NO_ERROR;
        }
        else return E_NOINTERFACE;
    }
    
    
    HRESULT EventSink::Indicate(long lObjectCount,
        IWbemClassObject **apObjArray)
    {
    	HRESULT hres = S_OK;
    
        for (int i = 0; i < lObjectCount; i++)
        {
            printf("Event occurred/n");
        }
    
        return WBEM_S_NO_ERROR;
    }
    
    HRESULT EventSink::SetStatus(
                /* [in] */ LONG lFlags,
                /* [in] */ HRESULT hResult,
                /* [in] */ BSTR strParam,
                /* [in] */ IWbemClassObject __RPC_FAR *pObjParam
            )
    {
        if(lFlags == WBEM_STATUS_COMPLETE)
        {
            printf("Call complete. hResult = 0x%X/n", hResult);
        }
        else if(lFlags == WBEM_STATUS_PROGRESS)
        {
            printf("Call in progress./n");
        }
    
        return WBEM_S_NO_ERROR;
    }    // end of EventSink.cpp

[Aa390425.wedge_en-us_VS.85_.gif]: http://i.msdn.microsoft.com/Aa390425.wedge%28en-us,VS.85%29.gif
[CoInitializeEx]: http://msdn.microsoft.com/en-us/library/ms695279%28VS.85%29.aspx
[Initializing COM for a WMI Application]: http://msdn.microsoft.com/en-us/library/aa390885%28VS.85%29.aspx
[CoInitializeSecurity]: http://msdn.microsoft.com/en-us/library/ms693736%28VS.85%29.aspx
[Setting the Default Process Security Level Using C]: http://msdn.microsoft.com/en-us/library/aa393617%28VS.85%29.aspx
[CoCreateInstance]: http://msdn.microsoft.com/en-us/library/ms686615%28VS.85%29.aspx
[Creating a Connection to a WMI Namespace]: http://msdn.microsoft.com/en-us/library/aa389749%28VS.85%29.aspx
[IWbemServices]: http://msdn.microsoft.com/en-us/library/aa392093%28VS.85%29.aspx
[IWbemLocator_ConnectServer]: http://msdn.microsoft.com/en-us/library/aa391769%28VS.85%29.aspx
[Example_ Getting WMI Data from a Remote Computer]: http://msdn.microsoft.com/en-us/library/aa390422%28VS.85%29.aspx
[CoSetProxyBlanket]: http://msdn.microsoft.com/en-us/library/ms692692%28VS.85%29.aspx
[Setting the Security Levels on a WMI Connection]: http://msdn.microsoft.com/en-us/library/aa393619%28VS.85%29.aspx
[IWbemServices_ExecNotificationQueryAsync]: http://msdn.microsoft.com/en-us/library/aa392106%28VS.85%29.aspx
[IWbemObjectSink]: http://msdn.microsoft.com/en-us/library/aa391787%28VS.85%29.aspx
[Manipulating Class and Instance Information]: http://msdn.microsoft.com/en-us/library/aa392315%28VS.85%29.aspx
[Calling a Method]: http://msdn.microsoft.com/en-us/library/aa384832%28VS.85%29.aspx