WMI programming to find job id - windows

Question

I am trying to find out the job id's by passing command line argument using WMI.
int main(int argc, char **argv)
{
HRESULT hres;
// Initialize COM.
hres = CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hres))
{
cout << "Failed to initialize COM library. "
<< "Error code = 0x"
<< hex << hres << endl;
return 1; // Program has failed.
}
// Initialize
hres = CoInitializeSecurity(
NULL,
-1, // COM negotiates service
NULL, // Authentication services
NULL, // Reserved
RPC_C_AUTHN_LEVEL_DEFAULT, // authentication
RPC_C_IMP_LEVEL_IMPERSONATE, // Impersonation
NULL, // Authentication info
EOAC_NONE, // Additional capabilities
NULL // Reserved
);
if (FAILED(hres))
{
cout << "Failed to initialize security. "
<< "Error code = 0x"
<< hex << hres << endl;
CoUninitialize();
return 1; // Program has failed.
}
// Obtain the initial locator to Windows Management
// on a particular host computer.
IWbemLocator *pLoc = 0;
hres = CoCreateInstance(
CLSID_WbemLocator,
0,
CLSCTX_INPROC_SERVER,
IID_IWbemLocator, (LPVOID *) &pLoc);
if (FAILED(hres))
{
cout << "Failed to create IWbemLocator object. "
<< "Error code = 0x"
<< hex << hres << endl;
CoUninitialize();
return 1; // Program has failed.
}
IWbemServices *pSvc = 0;
// Connect to the root\cimv2 namespace with the
// current user and obtain pointer pSvc
// to make IWbemServices calls.
hres = pLoc->ConnectServer(
_bstr_t(L"ROOT\\CIMV2"), // WMI namespace
NULL, // User name
NULL, // User password
0, // Locale
NULL, // Security flags
0, // Authority
0, // Context object
&pSvc // IWbemServices proxy
);
if (FAILED(hres))
{
cout << "Could not connect. Error code = 0x"
<< hex << hres << endl;
pLoc->Release();
CoUninitialize();
return 1; // Program has failed.
}
cout << "Connected to ROOT\\CIMV2 WMI namespace" << endl;
// Set the IWbemServices proxy so that impersonation
// of the user (client) occurs.
hres = CoSetProxyBlanket(
pSvc, // the proxy to set
RPC_C_AUTHN_WINNT, // authentication service
RPC_C_AUTHZ_NONE, // authorization service
NULL, // Server principal name
RPC_C_AUTHN_LEVEL_CALL, // authentication level
RPC_C_IMP_LEVEL_IMPERSONATE, // impersonation level
NULL, // client identity
EOAC_NONE // proxy capabilities
);
if (FAILED(hres))
{
cout << "Could not set proxy blanket. Error code = 0x"
<< hex << hres << endl;
pSvc->Release();
pLoc->Release();
CoUninitialize();
return 1; // Program has failed.
}
// Use the IWbemServices pointer to make requests of WMI.
// Make requests here:
// For example, query for all the running processes
IEnumWbemClassObject* pEnumerator = NULL;
hres = pSvc->ExecQuery(
bstr_t("WQL"),
bstr_t("SELECT * FROM Win32_Process where CommandLine like 'commandLineString'"),
WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
NULL,
&pEnumerator);
cout << " After execquery"<< endl ;
if (FAILED(hres))
{
cout << "Query for processes failed. "
<< "Error code = 0x"
<< hex << hres << endl;
pSvc->Release();
pLoc->Release();
CoUninitialize();
return 1; // Program has failed.
}
else
{
IWbemClassObject *pclsObj;
ULONG uReturn = 0;
while (pEnumerator)
{
hres = pEnumerator->Next(WBEM_INFINITE, 1,
&pclsObj, &uReturn);
if(0 == uReturn)
{
break;
}
VARIANT vtProp;
// Get the value of the Name property
hres = pclsObj->Get(L"ProcessId", 0, &vtProp, 0, 0);
int processId = (int)vtProp.intVal;
cout << "Process ID : " << processId << endl;
DWORD dwProcessId = (DWORD) processId;
DWORD dwDesiredAccess = PROCESS_TERMINATE;
BOOL bInheritHandle = FALSE;
HANDLE hProcess = OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
if (hProcess == NULL)
{
cout << "hProcess is null " << endl;
}else {
BOOL result = TerminateProcess(hProcess, 1);
CloseHandle(hProcess);
cout << "Process is terminated " << result <<endl;
}
} // while
} // else
// Cleanup
// ========
pLoc->Release();
pSvc->Release();
CoUninitialize();
getchar();
return 0; // Program successfully completed.
}
Above is the C++ code and my question is how do I access structure in nsis.
like the below lines in above code
1. hres = pLoc->ConnectServer(
2. hres = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn);
3. hres = pclsObj->Get
Please help me on this...

Answer 1

Have you looked at the WmiInspector plugin? Alternatively use your existing C++ code to create a custom plugin.
To call the Windows API or a COM interface in NSIS you have to use the system plugin:
!include LogicLib.nsh
!define CLSCTX_INPROC_SERVER 0x1
!define CLSID_ApplicationAssociationRegistrationUI {1968106d-f3b5-44cf-890e-116fcb9ecef1}
!define IID_IApplicationAssociationRegistrationUI {1f76a169-f994-40ac-8fc8-0959e8874710} ;[Vista+]
section
;NSIS has called CoInitialize
System::Call 'OLE32::CoCreateInstance(g "${CLSID_ApplicationAssociationRegistrationUI}",i 0,i ${CLSCTX_INPROC_SERVER},g "${IID_IApplicationAssociationRegistrationUI}",*i.r1)i.r0' ;ptr is now in $1 and hr in $0
${If} $1 <> 0
System::Call '$1->3(w "Internet Explorer")i.r0' ;IApplicationAssociationRegistrationUI::LaunchAdvancedAssociationUI
System::Call '$1->2()' ;IUnknown::Release
${EndIf}
sectionend
You have to manually look up IIDs and the vtable offset for methods so using a lot of COM is not going to be fun...