Export a WMI data into a file and display it in UI

1

I'm a beginner to the Windows Management Instrumentation(WMI). I'm working on WMI with C++ to collect data from the Windows log files("Security logs being accessed in this program"). I was able to read and display the contents in the log file using the WMI program along with the valuable corrections mentioned by the Stack Overflow users. Thanks a lot for your help.

Further, I was trying to save the data into a file. Since I could't directly convert it into an XML file, I converted the bstr (data type being returned by "vtProp.bstrVal") into a string and saved it into a text file using the program given below. My intention is to display the information in the log file as a table in a User Interfae. That would have been much easier if that was an XML file. So is there a way I can export the content into an XML file using a Windows query or something?

The property that i passed as an argument for the "pclsObj->Get()" function is Message so that all the details under the Message tag is being displayed in the console or the file. The second thing I wanted to enquire is regarding these properties. Looking into the XML file(saved from the evtx file), I find similar tags like Data,Tasks etc. But when I try to display them, an exception is thrown mentioning a problem accessing the file.

Program:

    #define _WIN32_DCOM
    #include <iostream>
    using namespace std;
    #include <comdef.h>
    #include <Wbemidl.h>
    #include<string>
    #include<fstream>

    #pragma comment(lib, "wbemuuid.lib")

    int main()//(int argc, char **argv)
    {
        HRESULT hres;

        // Step 1: --------------------------------------------------
        // Initialize COM. ------------------------------------------

        hres = CoInitializeEx(0, COINIT_MULTITHREADED);
        if (FAILED(hres))
        {
            cout << "Failed to initialize COM library. Error code = 0x"
                << hex << hres << endl;
            return 1;                  // Program has failed.
        }

        cout << "Initilized the COM" << endl;

        // Step 2: --------------------------------------------------
        // Set general COM security levels --------------------------

        hres = CoInitializeSecurity(
            NULL,
            -1,                          // COM authentication
            NULL,                        // Authentication services
            NULL,                        // Reserved
            RPC_C_AUTHN_LEVEL_DEFAULT,   // Default authentication 
            RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation  
            NULL,                        // Authentication info
            EOAC_NONE,                   // Additional capabilities 
            NULL                         // Reserved
        );


        if (FAILED(hres))
        {
            cout << "Failed to initialize security. Error code = 0x"
                << hex << hres << endl;
            CoUninitialize();
            return 1;                    // Program has failed.
        }

        // Step 3: ---------------------------------------------------
        // Obtain the initial locator to WMI -------------------------

        IWbemLocator *pLoc = NULL;
        //string amp;

        hres = CoCreateInstance(
            CLSID_WbemLocator,
            0,
            CLSCTX_INPROC_SERVER,
            IID_IWbemLocator, (LPVOID *)&pLoc);//&amp; pLoc);

        if (FAILED(hres))
        {
            cout << "Failed to create IWbemLocator object."
                << " Err code = 0x"
                << hex << hres << endl;
            CoUninitialize();
            return 1;                 // Program has failed.
        }

        // Step 4: -----------------------------------------------------
        // Connect to WMI through the IWbemLocator::ConnectServer method

        IWbemServices *pSvc = NULL;

        // Connect to the root\cimv2 namespace with
        // the current user and obtain pointer pSvc
        // to make IWbemServices calls.
        hres = pLoc->ConnectServer(
            _bstr_t(L"ROOT\\CIMV2"), // Object path of WMI namespace
            NULL,                    // User name. NULL = current user
            NULL,                    // User password. NULL = current
            0,                       // Locale. NULL indicates current
            NULL,                    // Security flags.
            0,                       // Authority (for example, Kerberos)
            0,                       // Context object 
            &pSvc                // pointer to IWbemServices proxy
        );

        if (FAILED(hres))
        {
            cout << "Could not connect. Error code = 0x"
                << hex << hres << endl;
            pLoc->Release();
            CoUninitialize();
            return 1;                // Program has failed.
        }

        cout << "Connected to ROOT\\CIMV2 WMI namespace" << endl;
        cout << "Connected to WMI" << endl;



        // Step 5: --------------------------------------------------
        // Set security levels on the proxy -------------------------

        hres = CoSetProxyBlanket(
            pSvc,                        // Indicates the proxy to set
            RPC_C_AUTHN_WINNT,           // RPC_C_AUTHN_xxx
            RPC_C_AUTHZ_NONE,            // RPC_C_AUTHZ_xxx
            NULL,                        // Server principal name 
            RPC_C_AUTHN_LEVEL_CALL,      // RPC_C_AUTHN_LEVEL_xxx 
            RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx
            NULL,                        // client identity
            EOAC_NONE                    // proxy capabilities 
        );

        if (FAILED(hres))
        {
            cout << "Could not set proxy blanket. Error code = 0x"
                << hex << hres << endl;
            pSvc->Release();
            pLoc->Release();
            CoUninitialize();
            return 1;               // Program has failed.
        }

        cout << "Security level set on wmi connection" << endl;

        // Step 6: --------------------------------------------------
        // Use the IWbemServices pointer to make requests of WMI ----

        // For example, get the name of the operating system
        IEnumWbemClassObject* pEnumerator = NULL;
        hres = pSvc->ExecQuery(
            bstr_t("WQL"),
            //bstr_t("wevtutil gl Security /f:XML"),
            bstr_t("SELECT * FROM Win32_NTLogEvent Where (Logfile = 'Security')"),
            //bstr_t(Cquery),
            //bstr_t("wevtutil gl Security /f:XML"),
            WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
            NULL,
            &pEnumerator);

        if (FAILED(hres))
        {
            cout << "Query for operating system name failed."
                << " Error code = 0x"
                << hex << hres << endl;
            pSvc->Release();
            pLoc->Release();
            CoUninitialize();
            return 1;               // Program has failed.
        }

        cout << "data is obtained from the operating system" << endl;


        // Step 7: -------------------------------------------------
        // Get the data from the query in step 6 -------------------

        IWbemClassObject *pclsObj = NULL;
        ULONG uReturn = 0;
        ofstream ofs("log.txt");
        while (pEnumerator)
        {
            HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1,
                &pclsObj, &uReturn);

            if (0 == uReturn)
            {
                break;
            }

            VARIANT vtProp;
            char* data;

            // Get the value of the Name property
            hr = pclsObj->Get(L"Message", 0, &vtProp, 0, 0);//&amp; vtProp, 0, 0);
            wcout << " Message : " << vtProp.bstrVal << endl;                       //Display the value in under Message tag
            _bstr_t b = vtProp.bstrVal;                                             
            ofs << " Message : " << (char*)b << endl;                               //Saving it into a text file
            VariantClear(&vtProp); 

            pclsObj->Release();
        }
        ofs.close();

        // Cleanup
        // ========

        pSvc->Release();
        pLoc->Release();
        pEnumerator->Release();
        CoUninitialize();

        cin.get();
        return 0;   // Program successfully completed.
    }

When I try to access the information under the tag, the following exception is thrown:

Exception thrown at 0x0F831D73 (ucrtbased.dll) in test_project.exe: 
0xC0000005: Access violation reading location 0x00000000.

Kindly help me with the above queries since I find it really difficult to figure out the WMI programs.

Thank you

c++
wmi
wql
asked on Stack Overflow Jul 6, 2018 by Anand

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0