You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
146 lines
4.7 KiB
146 lines
4.7 KiB
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <windows.h>
|
|
#include <wbemidl.h>
|
|
#include <shellapi.h>
|
|
#include <tchar.h>
|
|
#include <wmistr.h>
|
|
#include <objbase.h>
|
|
#include <initguid.h>
|
|
#include <evntrace.h>
|
|
#include <objidl.h>
|
|
|
|
#define MAXLOGFILES 16
|
|
#define MAXSTR 1024
|
|
#define MOFWSTR 1024
|
|
#define MOFSTR 2048
|
|
#define MAXTYPE 256
|
|
#define UC(x) ( (UINT)((x) & 0xFF) )
|
|
#define NTOHS(x) ( (UC(x) * 256) + UC((x) >> 8) )
|
|
// Maximum number of properties per WBEM class object: may need to be changed
|
|
#define MAXPROPS 256
|
|
|
|
#define DUMP_FILE_NAME _T("DumpFile.csv")
|
|
#define SUMMARY_FILE_NAME _T("Summary.txt")
|
|
|
|
#define DEFAULT_NAMESPACE _T("root\\wmi")
|
|
|
|
#define IsEqualGUID(rguid1, rguid2) (!memcmp(rguid1, rguid2, sizeof(GUID)))
|
|
|
|
// List mamangement macros
|
|
#define InitializeListHead(ListHead) (\
|
|
(ListHead)->Flink = (ListHead)->Blink = (ListHead))
|
|
|
|
#define InsertTailList(ListHead,Entry) {\
|
|
PLIST_ENTRY _EX_Blink;\
|
|
PLIST_ENTRY _EX_ListHead;\
|
|
_EX_ListHead = (ListHead);\
|
|
_EX_Blink = _EX_ListHead->Blink;\
|
|
(Entry)->Flink = _EX_ListHead;\
|
|
(Entry)->Blink = _EX_Blink;\
|
|
_EX_Blink->Flink = (Entry);\
|
|
_EX_ListHead->Blink = (Entry);\
|
|
}
|
|
|
|
#define RemoveEntryList(Entry) {\
|
|
PLIST_ENTRY _EX_Blink;\
|
|
PLIST_ENTRY _EX_Flink;\
|
|
_EX_Flink = (Entry)->Flink;\
|
|
_EX_Blink = (Entry)->Blink;\
|
|
_EX_Blink->Flink = _EX_Flink;\
|
|
_EX_Flink->Blink = _EX_Blink;\
|
|
}
|
|
|
|
// Default strings and values.
|
|
#define GUID_TYPE_EVENTTRACE _T("EventTrace")
|
|
#define GUID_TYPE_HEADER _T("Header")
|
|
#define GUID_TYPE_UNKNOWN _T("Unknown")
|
|
#define GUID_TYPE_DEFAULT _T("Default")
|
|
|
|
#define EVENT_TYPE_DEFAULT (-1)
|
|
#define EVENT_LEVEL_DEFAULT (-1)
|
|
#define EVENT_VERSION_DEFAULT (-1)
|
|
|
|
// Strings and enumeration for Data item types that we want to decode.
|
|
// Refer to DumpEvent() for more detail on each item.
|
|
#define STR_ItemChar _T("ItemChar")
|
|
#define STR_ItemWChar _T("ItemWChar")
|
|
#define STR_ItemUChar _T("ItemUChar")
|
|
#define STR_ItemCharShort _T("ItemCharShort")
|
|
#define STR_ItemShort _T("ItemShort")
|
|
#define STR_ItemUShort _T("ItemUShort")
|
|
#define STR_ItemLong _T("ItemLong")
|
|
#define STR_ItemULong _T("ItemULong")
|
|
#define STR_ItemULongX _T("ItemULongX")
|
|
#define STR_ItemLongLong _T("ItemLongLong")
|
|
#define STR_ItemULongLong _T("ItemULongLong")
|
|
#define STR_ItemFloat _T("ItemFloat");
|
|
#define STR_ItemDouble _T("ItemDouble");
|
|
#define STR_ItemString _T("ItemString")
|
|
#define STR_ItemWString _T("ItemWString")
|
|
#define STR_ItemPString _T("ItemPString")
|
|
#define STR_ItemPWString _T("ItemPWString")
|
|
#define STR_ItemDSString _T("ItemDSString")
|
|
#define STR_ItemDSWString _T("ItemDSWString")
|
|
#define STR_ItemMLString _T("ItemMLString")
|
|
#define STR_ItemSid _T("ItemSid")
|
|
#define STR_ItemIPAddr _T("ItemIPAddr")
|
|
#define STR_ItemPort _T("ItemPort")
|
|
#define STR_ItemNWString _T("ItemNWString")
|
|
#define STR_ItemPtr _T("ItemPtr")
|
|
#define STR_ItemGuid _T("ItemGuid")
|
|
#define STR_ItemBool _T("ItemBool")
|
|
|
|
typedef enum _ITEM_TYPE {
|
|
ItemChar,
|
|
ItemWChar,
|
|
ItemUChar,
|
|
ItemCharShort,
|
|
ItemShort,
|
|
ItemUShort,
|
|
ItemLong,
|
|
ItemULong,
|
|
ItemULongX,
|
|
ItemLongLong,
|
|
ItemULongLong,
|
|
ItemFloat,
|
|
ItemDouble,
|
|
ItemString,
|
|
ItemWString,
|
|
ItemPString,
|
|
ItemPWString,
|
|
ItemDSString,
|
|
ItemDSWString,
|
|
ItemSid,
|
|
ItemIPAddr,
|
|
ItemPort,
|
|
ItemMLString,
|
|
ItemNWString,
|
|
ItemPtr,
|
|
ItemGuid,
|
|
ItemBool,
|
|
ItemUnknown
|
|
} ITEM_TYPE;
|
|
|
|
// Construct that represents an event layout.
|
|
typedef struct _MOF_INFO {
|
|
LIST_ENTRY Entry;
|
|
LPTSTR strDescription; // Class Name
|
|
ULONG EventCount;
|
|
GUID Guid;
|
|
PLIST_ENTRY ItemHeader;
|
|
LPTSTR strType; // Type Name
|
|
SHORT TypeIndex;
|
|
SHORT Version;
|
|
CHAR Level;
|
|
} MOF_INFO, *PMOF_INFO;
|
|
|
|
// Construct that represents one data item.
|
|
typedef struct _ITEM_DESC {
|
|
LIST_ENTRY Entry;
|
|
LPTSTR strDescription;
|
|
ULONG DataSize;
|
|
ITEM_TYPE ItemType;
|
|
UINT ArraySize;
|
|
} ITEM_DESC, *PITEM_DESC;
|
|
|