コード例 #1
0
void ConsumerParserClass::Print(const wchar_t* outlog, const wchar_t* path, const wchar_t* szNamespace, const wchar_t* szType, const wchar_t* szInstance) {
  FILE* out = CreateLogFile(outlog, L"at, ccs=UNICODE");
  std::vector<DWORD> *allocMap = Map.GetDataAllocMap();
  if (allocMap) {
    MyPrintFunc(out, L"==== %s\\%s\\%s====\n", szNamespace, szType, szInstance);
    std::vector<InstanceStruct>::iterator it = Consumers.begin();
    for (; it != Consumers.end(); ++it) {
      MyPrintFunc(out, L"[%S]:\nConsumer:(%.8X.%.8X.%.8X)\n", it->InstanceID, it->Location.LogicalID, it->Location.RecordID, it->Location.Size);
      EventConsumer* p = EventConsumer::Create(m_ObjFile, *allocMap, *it, szType, m_bXP);
      if (p) {
        p->Print(m_ObjFile, out);
        delete p;
        if (szType && szInstance) {
          std::vector<InstanceStruct> bindings;
          if (GetConsumerBinding(path, szNamespace, szType, *allocMap, *it, bindings)) {
            std::vector<InstanceStruct>::iterator bindit = bindings.begin();
            for (; bindit != bindings.end(); ++bindit) {
              MyPrintFunc(out, L"[%S]:\nBinding:(%.8X.%.8X.%.8X)\n", bindit->InstanceID, bindit->Location.LogicalID, bindit->Location.RecordID, bindit->Location.Size);
              FilterToConsumerBindingClass*b = FilterToConsumerBindingClass::Create(m_ObjFile, *allocMap, *bindit, m_bXP);
              if (b) {
                b->Print(m_ObjFile, out);
                delete b;
              }
            }
          }
        }
      }
    }
    MyPrintFunc(out, L"=============================================================================\n");
    if (out)
      ::fclose(out);
  }
}
コード例 #2
0
void ConsumerParserClass::Print(const wchar_t* outlog, const wchar_t* szNamespace, const wchar_t* szType) {
  FILE* out = CreateLogFile(outlog, L"at, ccs=UNICODE");
  std::vector<DWORD> *allocMap = Map.GetDataAllocMap();
  if (allocMap) {
    if (szType)
      MyPrintFunc(out, L"==== %s in namespace %s ====\n", szType, szNamespace);
    else
      MyPrintFunc(out, L"==== Consumers in namespace %s ====\n", szNamespace);
    std::vector<InstanceStruct>::iterator it = Consumers.begin();
    for (; it != Consumers.end(); ++it) {
      MyPrintFunc(out, L"[%S]:\nConsumer:(%.8X.%.8X.%.8X)\n", it->InstanceID, it->Location.LogicalID, it->Location.RecordID, it->Location.Size);
      EventConsumer* p = EventConsumer::Create(m_ObjFile, *allocMap, *it, szType, m_bXP);
      if (p) {
        p->Print(m_ObjFile, out);
        delete p;
      }
    }
    MyPrintFunc(out, L"=============================================================================\n");
    if (out)
      ::fclose(out);
  }
}
コード例 #3
0
ファイル: WMIParser.cpp プロジェクト: fireeye/flare-wmi
void ParseWMIDBFile(const wchar_t* path) {
  _TCHAR wszObjFile[MAX_PATH];
  bool bXP = false;
  if (_snwprintf_s(wszObjFile, MAX_PATH, _TRUNCATE, L"%s\\mapping.ver", path)) {
    HANDLE hVerFile = ::CreateFile(wszObjFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (INVALID_HANDLE_VALUE != hVerFile) {
      ::CloseHandle(hVerFile);
      bXP = true;
    }
  }

  if (_snwprintf_s(wszObjFile, MAX_PATH, _TRUNCATE, L"%s\\objects.data", path)) {
    HANDLE hFile = ::CreateFile(wszObjFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (INVALID_HANDLE_VALUE == hFile)
      return;
    LARGE_INTEGER fileSize;
    if (GetFileSizeEx(hFile, &fileSize) && fileSize.QuadPart) {
      LARGE_INTEGER currentoffset;
      byte         buffer[PAGE_SIZE + 1];
      uint32       toread = 0,
        page = 0;
      currentoffset.QuadPart = 0;
      buffer[PAGE_SIZE] = 0;
      while (currentoffset.QuadPart < fileSize.QuadPart) {
        int64  reminder = fileSize.QuadPart - currentoffset.QuadPart;
        DWORD  toread = reminder > PAGE_SIZE ? PAGE_SIZE : static_cast<DWORD>(reminder & ALL_BITS_32);
        DWORD  justread = 0;
        if (INVALID_SET_FILE_POINTER == SetFilePointer(hFile, currentoffset.LowPart, &currentoffset.HighPart, FILE_BEGIN))
          break;
        if (toread && ::ReadFile(hFile, buffer, toread, &justread, NULL) && toread == justread) {
          const Toc *toc = reinterpret_cast<const Toc*>(buffer);
          if (toc->IsValid(toread)) {
            const Toc	*lasttoc = reinterpret_cast<const Toc*>(&buffer[toc->Offset]),
              *prevToLas = lasttoc - 1;
            if (prevToLas->IsZero()) {
              //if (buffer[PAGE_SIZE - 1]) // interpret only the first page of multi-page record ... more research needed.
              //	buffer[PAGE_SIZE - 1] = 0;
              while (toc < prevToLas) {
                if (toc->IsValid(toread)) {
                  const unsigned char *bytes = reinterpret_cast<const unsigned char*>(toc);
                  std::vector<ExtentClass> extents;
                  ExtentClass e;
                  e.Set(currentoffset.QuadPart + toc->Offset, toc->Size);
                  extents.push_back(e);
                  EventConsumer* p = EventConsumer::Create(&buffer[toc->Offset], extents, toc->Size, bXP);
                  if (p) {
                    p->Print(hFile, 0);
                    delete p;
                  }
                }
                ++toc;
              }
            }
          }
        }
        else
          break;
        currentoffset.QuadPart += justread;
        ++page;
      }
    }
    ::CloseHandle(hFile);
  }
}