WMI 永久外部事件注册成功但从未触发消费者

Question

这让我把头发拔了两天。

我试图让自己熟悉 WMI 事件，因此我编写了一些代码来创建永久性外部事件。 运行此代码后，过滤器、消费者和绑定都已在 Wbemtest 中注册，但消费者永远不会触发。

外部事件是为提供者RegValueChangeEvent注册的，所以我们的事件使用者（在本例中，它在 system32 中启动calc.exe ）应该在注册表项更改时被触发。

最小工作示例（很长，所以详细信息在示例下方）：

#include <Windows.h>
#include <winternl.h>
#include <iostream>
#include <WbemCli.h>
#include <WbemIdl.h>
#include <comdef.h>

GUID CSLSID_WbemLocator = { 0x4590f811, 0x1d3a, 0x11d0, 0x89, 0x1f, 0x00, 0xaa, 0x00, 0x4b, 0x2e, 0x24 };
GUID SIID_IClassFactory = { 0x00000001, 0x0000, 0x0000, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 };
GUID SIID_IUnknown = { 0x00000000, 0x0000, 0x0000, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 };
GUID SIID_IWbemLocator = { 0xdc12a687, 0x737f, 0x11cf, 0x88, 0x4d, 0x00, 0xaa, 0x00, 0x4b, 0x2e, 0x24 };

int main()
{
    // Initialize 
    HRESULT hres = CoInitializeEx(0, COINIT_MULTITHREADED);
    IWbemLocator* pLoc;
    IWbemServices* pSvc;

    std::wstring sFilterPath = L"__EventFilter.Name=\"TestFilter\"";
    std::wstring sConsumerPath = L"CommandLineEventConsumer.Name=\"TestConsumer\"";
    
    if (FAILED(hres))
    {
        printf("Failed to initialize COM library. Error code = 0x%llx", (unsigned long long)hres);
        return FALSE;                  // Program has failed.
    }

    // Get the class factory for the WbemLocator object
    IClassFactory* pClassFactory = NULL;

    hres = CoGetClassObject(CSLSID_WbemLocator, CLSCTX_INPROC_SERVER, NULL, SIID_IClassFactory, (void**)&pClassFactory);

    if (FAILED(hres)) {
        printf("Failed to get class factory. Error code = 0x%llx", (unsigned long long)hres);
        CoUninitialize();
        return FALSE;               // Program has failed.
    }

    // Create an instance of the WbemLocator object
    IUnknown* pUnk = NULL;
    hres = pClassFactory->CreateInstance(NULL, SIID_IUnknown, (void**)&pUnk);
    if (FAILED(hres)) {
        printf("Failed to create instance of WbemLocator. Error code = 0x%llx", (unsigned long long)hres);
        pClassFactory->Release();
        CoUninitialize();
        return FALSE;                 // Program has failed.
    }

    hres = pUnk->QueryInterface(SIID_IWbemLocator, (void**)&pLoc);
    if (FAILED(hres)) {
        printf("Failed to get IWbemLocator interface. Error code = 0x%llx", (unsigned long long)hres);
        pUnk->Release();
        pClassFactory->Release();
        CoUninitialize();
        return FALSE;    // Program has failed.
    }

    if (pLoc == nullptr)
    {
        printf("Failed to get IWbemLocator interface. Error code = 0x%llx", (unsigned long long)hres);
        pUnk->Release();
        pClassFactory->Release();
        CoUninitialize();
        return FALSE;     // Program has failed.
    }

    pUnk->Release();
    pClassFactory->Release();
    
    // Set general COM security levels 
    hres = CoInitializeSecurity(
        NULL,
        -1,                          // COM authentication
        NULL,                        // Authentication services
        NULL,                        // Reserved
        RPC_C_AUTHN_LEVEL_DEFAULT,   // Default authentication 
        RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation  
        NULL,                        // Authentication info
        EOAC_NONE,                   // Additional capabilities 
        NULL                         // Reserved
    );
    hres = pLoc->ConnectServer(
        _bstr_t(L"ROOT\\subscription"), // Object path of WMI namespace
        NULL,                    // User name. NULL = current user
        NULL,                    // User password. NULL = current
        0,                       // Locale. NULL indicates current
        NULL,                    // Security flags.
        0,                       // Authority (for example, Kerberos)
        0,                       // Context object 
        &pSvc                    // pointer to IWbemServices proxy
    );
    if (FAILED(hres))
    {
        printf("Could not connect. Error code = 0x%llx", (unsigned long long)hres);
        return FALSE;                // Program has failed.
    }

    // Set security levels on the proxy 
    hres = CoSetProxyBlanket(
        pSvc,                        // Indicates the proxy to set
        RPC_C_AUTHN_WINNT,           // RPC_C_AUTHN_xxx
        RPC_C_AUTHZ_NONE,            // RPC_C_AUTHZ_xxx
        NULL,                        // Server principal name 
        RPC_C_AUTHN_LEVEL_CALL,      // RPC_C_AUTHN_LEVEL_xxx 
        RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx
        NULL,                        // client identity
        EOAC_NONE                    // proxy capabilities 
    );

    IWbemClassObject* pFilterClass = NULL;
    IWbemClassObject* pConsumerClass = NULL;
    IWbemClassObject* pBindingClass = NULL;
    IWbemClassObject* pConsumer = NULL;
    IWbemClassObject* pFilter = NULL;
    IWbemClassObject* pBinding = NULL;

    // Get the filter class
    hres = pSvc->GetObject(_bstr_t(L"__EventFilter"), 0, NULL, &pFilterClass, NULL);

    // Set Language = WQL
    VARIANT vtProp7;
    VariantInit(&vtProp7);
    vtProp7.vt = VT_BSTR;
    vtProp7.bstrVal = SysAllocString(L"WQL");
    hres = pFilter->Put(_bstr_t(L"QueryLanguage"), 0, &vtProp7, 0);
    if (FAILED(hres))
    {
        printf("Failed to set QueryLanguage property. Error code = 0x%lx\n", hres);
    }

    // Set namespace = ROOT\DEFAULT
    VARIANT vtProp11;
    VariantInit(&vtProp11);
    vtProp11.vt = VT_BSTR;
    vtProp11.bstrVal = SysAllocString(L"ROOT\\DEFAULT");
    hres = pFilter->Put(_bstr_t(L"EventNamespace"), 0, &vtProp11, 0);
    if (FAILED(hres))
    {
        printf("Failed to set Namespace property. Error code = 0x%lx\n", hres);
    }

    // Get the consumer class
    hres = pSvc->GetObject(_bstr_t(L"CommandLineEventConsumer"), 0, NULL, &pConsumerClass, NULL);
    if (FAILED(hres))
    {
        printf("Failed to get CommandLineEventConsumer class object. Error code = 0x%lx\n", hres);
        return 0;
    }

    hres = pConsumerClass->SpawnInstance(0, &pConsumer);
    if (FAILED(hres))
    {
        printf("Failed to spawn CommandLineEventConsumer instance. Error code = 0x%lx\n", hres);
        return 0;
    }

    // Put name and commandline template to consumer
    VARIANT vtProp3;
    VariantInit(&vtProp3);
    vtProp3.vt = VT_BSTR;
    vtProp3.bstrVal = SysAllocString(sConsumerPath.c_str());
    hres = pConsumer->Put(_bstr_t(L"Name"), 0, &vtProp3, 0);
    if (FAILED(hres))
    {
        printf("Failed to set Name property on Consumer. Error code = 0x%lx\n", hres);
        return 0;
    }
    VariantClear(&vtProp3);

    VARIANT vtProp4;
    VariantInit(&vtProp4);
    vtProp4.vt = VT_BSTR;
    vtProp4.bstrVal = SysAllocString(L"calc.exe");
    hres = pConsumer->Put(_bstr_t(L"CommandLineTemplate"), 0, &vtProp4, 0);
    if (FAILED(hres))
    {
        printf("Failed to set CommandLineTemplate property on Consumer. Error code = 0x%lx\n", hres);
        return 0;
    }

    // Set interactive to true
    VARIANT vtPropInteractive;
    VariantInit(&vtPropInteractive);
    vtPropInteractive.vt = VT_BOOL;
    vtPropInteractive.boolVal = VARIANT_TRUE;
    hres = pConsumer->Put(_bstr_t(L"RunInteractively"), 0, &vtPropInteractive, 0);
    if (FAILED(hres))
    {
        printf("Failed to set Interactive property on Consumer. Error code = 0x%lx\n", hres);
        return 0;
    }

    // Get the binding class
    hres = pSvc->GetObject(_bstr_t(L"__FilterToConsumerBinding"), 0, NULL, &pBindingClass, NULL);
    if (FAILED(hres))
    {
        printf("Failed to get __FilterToConsumerBinding class object. Error code = 0x%lx\n", hres);
        return 0;
    }

    // Create the binding instance
    hres = pBindingClass->SpawnInstance(0, &pBinding);
    if (FAILED(hres))
    {
        printf("Failed to spawn __FilterToConsumerBinding instance. Error code = 0x%lx\n", hres);
        return 0;
    }

    // Set the filter and consumer on the binding
    hres = pBinding->SpawnInstance(0, &pBinding);
    if (FAILED(hres))
    {
        printf("Failed to spawn __FilterToConsumerBinding instance. Error code = 0x%lx", hres);
        return 0;
    }

    VARIANT vtProp5;
    VariantInit(&vtProp5);
    vtProp5.vt = VT_BSTR;
    vtProp5.bstrVal = SysAllocString(L"TestFilter");
    hres = pBinding->Put(_bstr_t(L"Filter"), 0, &vtProp5, 0);
    if (FAILED(hres))
    {
        printf("Failed to set Filter property. Error code = 0x%lx\n", hres);
        return 0;
    }

    VARIANT vtProp6;
    VariantInit(&vtProp6);
    vtProp6.vt = VT_BSTR;
    vtProp6.bstrVal = SysAllocString(L"TestConsumer");
    hres = pBinding->Put(_bstr_t(L"Consumer"), 0, &vtProp6, 0);
    if (FAILED(hres))
    {
        printf("Failed to set Consumer property. Error code = 0x%lx\n", hres);
        return 0;
    }

    // Set the filter, consumer, and filter to consumer binding in WMI
    hres = pSvc->PutInstance(pFilter, WBEM_FLAG_CREATE_OR_UPDATE, NULL, NULL);
    if (FAILED(hres))
    {
        printf("Failed to put filter instance. Error code = 0x%lx\n", hres);
        return 0;
    }

    hres = pSvc->PutInstance(pConsumer, WBEM_FLAG_CREATE_OR_UPDATE, NULL, NULL);
    if (FAILED(hres))
    {
        printf("Failed to put consumer instance. Error code = 0x%lx\n", hres);
        return 0;
    }

    hres = pSvc->PutInstance(pBinding, WBEM_FLAG_CREATE_OR_UPDATE, NULL, NULL);
    if (FAILED(hres))
    {
        printf("Failed to put binding instance. Error code = 0x%lx\n", hres);
        return 0;
    }

    printf("Successfully created filter, consumer, and binding.\n");

    return hres;
}

这是 __EventFilter 的 MOF __EventFilter ：

instance of __EventFilter
{
    CreatorSID = { [ Removed ] };
    EventNamespace = "ROOT\\DEFAULT";
    Name = "TestFilter";
    Query = "SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_USERS' AND KeyPath='.DEFAULT\\\\SOFTWARE\\\\MyKey' AND ValueName = 'Test'";
    QueryLanguage = "WQL";
};

运行此代码后，我们的 class 个消费者、过滤器和绑定实例都出现在Wbemtest中。 所以我们至少知道Put注册正在正常进行。

如果我们创建一个注册表项HKEY_USERS\.DEFAULT\MyTest ，并用名为Test的测试值填充它，我们可以将 fitler 查询作为通知查询复制/粘贴到 Wbemtest 中，如果我们更改该值，我们将得到正确的 output。 所以我们实际的 WQL 查询是正确的。

这是我们的事件消费者 MOF：

instance of CommandLineEventConsumer
{
    CommandLineTemplate = "calc.exe";
    CreatorSID = { [ Removed ] };
    Name = "TestConsumer";
};

现在我们从 Microsoft WMI 文档中得知， CommandLineEventConsumer消费者只是在内部执行CreateProcess ，而CommandLineTemplate参数等同于CreateProcess的commandLine参数。 在没有指定可执行路径的情况下，行为应该是相同的。

我已经尝试了这两个领域，但都没有用。

ProcMon 告诉我它甚至没有尝试启动calc.exe ，所以问题可能在于我们如何注册事件、消费者和绑定。 我们知道它们已被注册，所以我们要么格式化不正确，缺少参数，要么我们完全注册了错误的 class。

最后，我们的消费者绑定过滤器，如 Wbemtest 中所示：

instance of __FilterToConsumerBinding
{
    Consumer = "CommandLineEventConsumer.Name=\"TestConsumer\"";
    CreatorSID = { [ Removed ] };
    Filter = "__EventFilter.Name=\"TestFilter\"";
};

我不知道这怎么可能是错的。

这是我能够追踪到的问题。 我已经坚持了两天，所以感谢任何帮助或建议，不完整或其他。

Answer 1

问题出在__EventFilter class 实例中。

与所有其他 WMI 参数不同， EventNamespace需要正斜杠而不是转义反斜杠。 将命名空间从ROOT\\DEFAULT更改为ROOT/DEFAULT解决了这个问题。