public MainWindow()
{
watcher = new ManagementEventWatcher();
watcher.Query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent");
watcher.EventArrived += new EventArrivedEventHandler((object sender, EventArrivedEventArgs e) => Dispatcher.Invoke(() => Refresh()));
watcher.Start();
InitializeComponent();
}
public void Start(PagesPrinted callback)
{
Printed += callback;
try
{
ManagementScope scope;
if (!ComputerName.Equals("localhost", StringComparison.OrdinalIgnoreCase))
{
var conn = new ConnectionOptions();
conn.Username = "";
conn.Password = "";
conn.Authority = "ntlmdomain:DOMAIN";
scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", ComputerName), conn);
}
else
{
scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", ComputerName), null);
}
scope.Connect();
_watcher = new ManagementEventWatcher(scope, new EventQuery(WmiQuery));
_watcher.EventArrived += new EventArrivedEventHandler(this.WmiEventHandler);
_watcher.Start();
}
catch (Exception e)
{
Console.WriteLine("Exception {0} Trace {1}", e.Message, e.StackTrace);
}
}
public ProcessObserver()
{
watcher = new ManagementEventWatcher();
watcher.Query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""); ;
watcher.EventArrived += new EventArrivedEventHandler(OnProcessStarted);
watcher.Start();
}
static PathUtility()
{
var combinedPath = Path.Combine("a", "b");
DefaultDirectorySeparator = combinedPath.Substring(1, combinedPath.Length - 2);
//Insert
WqlEventQuery q_creation = new WqlEventQuery();
q_creation.EventClassName = "__InstanceCreationEvent";
q_creation.WithinInterval = new TimeSpan(0, 0, 2); //How often do you want to check it? 2Sec.
q_creation.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'";
_mweCreation = new ManagementEventWatcher(q_creation);
_mweCreation.EventArrived += UsbStorageInserted;
_mweCreation.Start(); // Start listen for events
//Remove
WqlEventQuery q_deletion = new WqlEventQuery();
q_deletion.EventClassName = "__InstanceDeletionEvent";
q_deletion.WithinInterval = new TimeSpan(0, 0, 2); //How often do you want to check it? 2Sec.
q_deletion.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition' ";
_mweDeletion = new ManagementEventWatcher(q_deletion);
_mweDeletion.EventArrived += UsbStorageRemoved;
_mweDeletion.Start(); // Start listen for events
Storage = _knownStorage;
UpdateStorage();
}
public ProcessWatcher(TaskScheduler scheduler, params string[] processNames)
{
Scheduler = scheduler;
foreach (var pname in processNames) {
var invariant = Path.GetFileNameWithoutExtension(pname).ToLowerInvariant();
ProcessNames.Add(invariant);
foreach (var process in Process.GetProcessesByName(invariant)) {
RunningProcessIds.Add(process.Id);
NewProcesses.Enqueue(process);
}
}
try {
var query = new WqlEventQuery(@"SELECT * FROM Win32_ProcessStartTrace");
Watcher = new ManagementEventWatcher(query);
Watcher.Options.BlockSize = 1;
Watcher.EventArrived += new EventArrivedEventHandler(OnEventArrived);
Watcher.Start();
WatcherEnabled = true;
} catch {
Watcher = null;
WatcherEnabled = false;
TimerTask = Scheduler.Start(InitTimer(), TaskExecutionPolicy.RunAsBackgroundTask);
}
}
static void Main(string[] args)
{
var thread = new Thread(() => {
Form1 form = new Form1();
ApiFetcher.registerEventHandler(form);
Application.Run(form);
});
thread.Start();
Thread.Sleep(2000);
mgmtWtch = new System.Management.ManagementEventWatcher("Select * From Win32_ProcessStartTrace");
mgmtWtch.EventArrived += new System.Management.EventArrivedEventHandler(mgmtWtch_EventArrived);
mgmtWtch.Start();
stopWatch = new System.Management.ManagementEventWatcher(" Select * From Win32_ProcessStopTrace");
stopWatch.EventArrived += new System.Management.EventArrivedEventHandler(mgmtWtch_EventArrived);
stopWatch.Start();
var t = new Thread(() => ApiFetcher.getData(1, 1));
t.Start();
Process.GetCurrentProcess().WaitForExit();
}
private void AddInsertUSBHandler()
{
WqlEventQuery query;
ManagementScope scope = new ManagementScope("root\\CIMV2");
scope.Options.EnablePrivileges = true;
insertUSBWatcher = null;
try
{
query = new WqlEventQuery();
query.EventClassName = "__InstanceCreationEvent";
query.WithinInterval = new TimeSpan(0, 0, 3);
query.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
insertUSBWatcher = new ManagementEventWatcher(scope, query);
insertUSBWatcher.EventArrived += USBInserted;
insertUSBWatcher.Start();
}
catch(Exception e)
{
if (insertUSBWatcher != null)
{
insertUSBWatcher.Stop();
}
throw e;
}
}
public Boolean AddUSBEventWatcher(EventArrivedEventHandler usbInsertHandler, EventArrivedEventHandler usbRemoveHandler, TimeSpan withinInterval)
{
try
{
ManagementScope Scope = new ManagementScope("root\\CIMV2");
Scope.Options.EnablePrivileges = true;
if (usbInsertHandler != null)
{
WqlEventQuery InsertQuery = new WqlEventQuery("__InstanceCreationEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'");
insertWatcher = new ManagementEventWatcher(Scope, InsertQuery);
insertWatcher.EventArrived += usbInsertHandler;
insertWatcher.Start();
}
if (usbRemoveHandler != null)
{
WqlEventQuery RemoveQuery = new WqlEventQuery("__InstanceDeletionEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'");
removeWatcher = new ManagementEventWatcher(Scope, RemoveQuery);
removeWatcher.EventArrived += usbRemoveHandler;
removeWatcher.Start();
}
return true;
}
catch (Exception)
{
RemoveUSBEventWatcher();
return false;
}
}
static void Main()
{
string currentPath = System.Environment.CurrentDirectory;
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
iosSyslogger LoggerWindow = new iosSyslogger();
loggerTool tool = new loggerTool();
WqlEventQuery insertQuery = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2"); //Checking USB device insertion
ManagementEventWatcher insertWatcher = new ManagementEventWatcher(insertQuery);
WqlEventQuery removeQuery = new WqlEventQuery("SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_USBHub'"); //Checking USB removal
ManagementEventWatcher removeWatcher = new ManagementEventWatcher(removeQuery);
insertWatcher.EventArrived += new EventArrivedEventHandler((source, e) => DeviceInsertedEvent(source, e, LoggerWindow, tool));
insertWatcher.Start();
removeWatcher.EventArrived += new EventArrivedEventHandler((source, e) => DeviceRemovedEvent(source, e, LoggerWindow, tool));
removeWatcher.Start();
Thread loggerParentThread = new Thread(() => tool.readDeviceUUID(LoggerWindow, tool)); //Parent thread for Syslogger
loggerParentThread.Start();
Application.Run(LoggerWindow);
AppDomain.CurrentDomain.ProcessExit += new EventHandler(OnProcessExit);
}
protected override void OnStart(string[] args)
{
// EventLog.WriteEntry("Service Started", EventLogEntryType.Information);
mgmtWtch = new System.Management.ManagementEventWatcher("Select * From Win32_ProcessStartTrace");
mgmtWtch.EventArrived += new System.Management.EventArrivedEventHandler(mgmtWtch_EventArrived);
mgmtWtch.Start();
}
private void Init()
{
battlefieldIsRunning = false;
ShowStatus();
// Hook up to the Application Started events
startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
startWatch.EventArrived += new EventArrivedEventHandler(startWatch_EventArrived);
try
{
startWatch.Start();
}
catch (Exception)
{
MessageBox.Show("Can't start the Process-Monitor! Are you running as admin?");
return;
}
// Hoop up to the Application closed events
stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
stopWatch.EventArrived += new EventArrivedEventHandler(stopWatch_EventArrived);
try
{
stopWatch.Start();
}
catch (Exception)
{
MessageBox.Show("Can't start the Process-Monitor! Are you running as admin?");
}
}
/// <summary>
/// USB 插入和拔出监测函数。
/// 使用ManagementEventWacher来预定特定系统事件，通过WqlEventQuery设置查询对象和条件以及其他属性（比如查询的轮询间隔），
/// 通过ManagementScope设置查询路径范围。
/// </summary>
public void USBRemoveWacher()
{
ManagementEventWatcher wacher = null;
WqlEventQuery query = null;
ManagementScope scope = null;
try
{
scope = new ManagementScope("root\\CIMV2"); //设置WMI路径
query = new WqlEventQuery(); //设置查询的事件类名，条件，查询间隔，也可一次在构造函数中初始化
query.EventClassName = "__InstanceDeletionEvent";
query.Condition = @"TargetInstance ISA 'Win32_USBControllerdevice'";
query.WithinInterval = new TimeSpan(1000);
wacher = new ManagementEventWatcher(scope, query);
wacher.EventArrived += new EventArrivedEventHandler(onUSBRemoved);
wacher.Start();
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
this.Closed += (s, e) =>
{
wacher.Stop();
wacher.Dispose();
};
}
public ChooseForm ()
{
InitializeComponent ();
processView.ListViewItemSorter = new ProcessViewItemComparer ();
usbDevView.ListViewItemSorter = new DeviceViewItemComparer ();
processViewUpdater = new ProcessViewUpdater (processView);
usbViewUpdater = new UsbViewUpdater (usbDevView);
WqlEventQuery startQuery = new WqlEventQuery ();
startQuery.EventClassName = "Win32_ProcessStartTrace";
WqlEventQuery stopQuery = new WqlEventQuery ();
stopQuery.EventClassName = "Win32_ProcessStopTrace";
ManagementEventWatcher w = new ManagementEventWatcher (startQuery);
w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived);
w.Start();
processStartWatcher = w;
w = new ManagementEventWatcher (stopQuery);
w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived);
w.Start ();
processStopWatcher = w;
}
static void Main(string[] args)
{
ManagementEventWatcher w1;
ManagementEventWatcher w2;
ManagementEventWatcher w3;
ManagementEventWatcher w4;
WqlEventQuery q1 = new WqlEventQuery("select * from __instanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' ");
w1 = new ManagementEventWatcher(q1);
w1.EventArrived += new EventArrivedEventHandler(WriteStarted);
WqlEventQuery q2 = new WqlEventQuery("select * from __instanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' ");
w2 = new ManagementEventWatcher(q2);
w2.EventArrived += new EventArrivedEventHandler(WriteFinished);
WqlEventQuery q3 = new WqlEventQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE'" + @" AND KeyPath = 'SOFTWARE\\LAB4'");
w3 = new ManagementEventWatcher(q3);
w3.EventArrived += new EventArrivedEventHandler(OnRegChanged);
WqlEventQuery q4 = new WqlEventQuery("Select * From __InstanceOperationEvent Within 2 Where TargetInstance Isa 'CIM_DataFile' And TargetInstance.Drive='C:' And " + @"TargetInstance.Path='\\Lab4\\test\\'");
w4 = new ManagementEventWatcher(q4);
w4.EventArrived += new EventArrivedEventHandler(OnFolderChanged);
w1.Start();
w2.Start();
w3.Start();
w4.Start();
System.Threading.Thread.Sleep(300000);
}
void SendLogEntry(WmiTraceListener listener,
LogEntry logEntry)
{
ManagementScope scope = new ManagementScope(@"\\." + wmiPath);
scope.Options.EnablePrivileges = true;
StringBuilder sb = new StringBuilder("SELECT * FROM ");
sb.Append("LogEntryV20");
string query = sb.ToString();
EventQuery eq = new EventQuery(query);
using (ManagementEventWatcher watcher = new ManagementEventWatcher(scope, eq))
{
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Start();
LogSource source = new LogSource("notfromconfig", SourceLevels.All);
source.Listeners.Add(listener);
source.TraceData(TraceEventType.Error, 1, logEntry);
BlockUntilWMIEventArrives();
watcher.Stop();
}
}
protected void StartWatching()
{
StopWatching(); // Just to make sure
DeleteWatcher = new ManagementEventWatcher
{
Query = new WqlEventQuery
{
EventClassName = "__InstanceDeletionEvent",
Condition = "TargetInstance ISA 'Win32_PnPEntity'",
WithinInterval = new TimeSpan(0, 0, 1), //Todo: make the interval settable
},
};
DeleteWatcher.EventArrived += PortsChanged;
DeleteWatcher.Start();
CreateWatcher = new ManagementEventWatcher
{
Query = new WqlEventQuery
{
EventClassName = "__InstanceCreationEvent",
Condition = "TargetInstance ISA 'Win32_PnPEntity'",
WithinInterval = new TimeSpan(0, 0, 1), //Todo: make the interval settable
},
};
CreateWatcher.EventArrived += PortsChanged;
CreateWatcher.Start();
}
static void AddRemoveUSBHandler()
{
WqlEventQuery q;
try
{
q = new WqlEventQuery();
q.EventClassName = "__InstanceDeletionEvent";
q.WithinInterval = pollInterval;
//q.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
q.Condition = "TargetInstance ISA 'Win32_PnPEntity'";
//w = new ManagementEventWatcher(scope, q);
w = new ManagementEventWatcher(q);
w.EventArrived += USBRemoved;
w.Start();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
if (w != null)
{
w.Stop();
}
}
}
private ManagementEventWatcher StartNewWatcher(WqlEventQuery query, Action handler)
{
var watcher = new ManagementEventWatcher { Query = query };
watcher.EventArrived += (s, e) => handler();
watcher.Start();
return watcher;
}
private static void WaitForUSB()
{
ManagementEventWatcher watcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Query = query;
watcher.Start();
}
private void Window_Loaded(object sender, RoutedEventArgs e)
{
EventReceiver receiver = new EventReceiver();
watcher = GetWatcher(new EventArrivedEventHandler(receiver.OnEventArrived));
watcher.Start();
}
private void InitializeWatcher()
{
_watcher = new ManagementEventWatcher();
var query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2 or EventType = 3");
_watcher.EventArrived += WatcherOnEventArrived;
_watcher.Query = query;
_watcher.Start();
}
public UsbWrapper()
{
WqlEventQuery q = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_LogicalDisk'");
q.WithinInterval = TimeSpan.FromSeconds(1);
eventWatcher = new ManagementEventWatcher(q);
eventWatcher.EventArrived += new EventArrivedEventHandler(OnUsbEvent);
eventWatcher.Start();
App.Current.Exit += new ExitEventHandler(OnAppExit);
}
private void StartWatchDeleteProcess()
{
WqlEventQuery query = new WqlEventQuery("__InstanceDeletionEvent",
new TimeSpan(0, 0, 1),
"TargetInstance isa \"Win32_Process\"");
watch_del = new ManagementEventWatcher(query);
watch_del.EventArrived += new EventArrivedEventHandler(HandleProcessDeleteEvent);
watch_del.Start();
}
public WMIProcessFinder()
{
processStartWatcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
processStartWatcher.EventArrived += ProcessStart_EventArrived;
processStartWatcher.Start();
processStopWatcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
processStopWatcher.EventArrived += ProcessStop_EventArrived;
processStopWatcher.Start();
}
private void Processmonitor()
{
SystemEvents.SessionEnding += SystemEvents_SessionEnding;
StartWtch = new ManagementEventWatcher("Select * From Win32_ProcessStartTrace");
StopWtch = new ManagementEventWatcher("Select * From Win32_ProcessStopTrace");
StartWtch.EventArrived += mgmtWtch_EventArrived;
StopWtch.EventArrived += mgmtWtch_EventArrived;
StopWtch.Start();
StartWtch.Start();
}
public MPCProcWatcher()
{
m_mpcWatcher = new ManagementEventWatcher();
m_mpcWatcher.Query = new WqlEventQuery("__InstanceOperationEvent", TimeSpan.FromSeconds(1),
@"TargetInstance ISA 'Win32_Process' AND ( TargetInstance.Name = 'mpc-hc.exe' OR TargetInstance.Name = 'mpc-hc64.exe')");
m_mpcWatcher.Scope = m_wScope;
m_mpcWatcher.EventArrived += new EventArrivedEventHandler(m_mpcWatcher_EventArrived);
m_mpcWatcher.Start();
}
public ProcWatchers()
{
//Hook WMI because its awesome
watcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace");
watcher.Query = query;
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Start();
w = Writer.getInstance();
builder = new StringBuilder();
}
public static void WatchDrives(Action handler)
{
using (var watcher = new ManagementEventWatcher())
{
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
watcher.EventArrived += (e, sender) => handler();
watcher.Query = query;
watcher.Start();
watcher.WaitForNextEvent();
}
}
// プロセス監視開始
public Boolean ProcessStartTrace(Action <object, EventArrivedEventArgs> callback)
{
Boolean result = false;
System.Management.ManagementEventWatcher w = new System.Management.ManagementEventWatcher("Select * From Win32_ProcessStartTrace");
w.EventArrived += new System.Management.EventArrivedEventHandler(callback);
w.Start();
result = true;
return(result);
}
internal void StartUSBCloneEngine(string destinationDirectory)
{
this.destinationDirectory = destinationDirectory;
ioHelper = new IOHelper();
insertQuery = new WqlEventQuery(UsbDetectionQuery);
insertWatcher = new ManagementEventWatcher(insertQuery);
insertWatcher.EventArrived += new EventArrivedEventHandler(DeviceInsertedEvent);
insertWatcher.Start();
}
public WmiEventWatcher(int numberOfEventsToWatchFor)
{
this.numberOfEventsToWatchFor = numberOfEventsToWatchFor;
WqlEventQuery eventQuery = new WqlEventQuery("BaseWmiEvent");
ManagementScope scope = new ManagementScope(@"\\.\root\EnterpriseLibrary");
eventWatcher = new ManagementEventWatcher(scope, eventQuery);
eventWatcher.EventArrived += new EventArrivedEventHandler(delegate_EventArrived);
eventWatcher.Start();
}
protected override void OnStart(string[] args)
{
watcher = new ManagementEventWatcher();
watcher.EventArrived += USBwatcher_EventArrived;
watcher.Query = query;
watcher.Start();
//starts the background pipe command server
startPipeServerThread();
EventLog.WriteEntry("The service was started successfully.", EventLogEntryType.Information);
}
public WmiEventWatcher(int numberOfEventsToWatchFor,
string query)
{
this.numberOfEventsToWatchFor = numberOfEventsToWatchFor;
WqlEventQuery eventQuery = new WqlEventQuery(query);
ManagementScope scope = new ManagementScope(@"\\.\root\EnterpriseLibrary");
eventWatcher = new ManagementEventWatcher(scope, eventQuery);
eventWatcher.EventArrived += delegate_EventArrived;
eventWatcher.Start();
}
private GameScanner()
{
fetchGameList();
ProcessStartWatcher = new System.Management.ManagementEventWatcher(Constants.selectStart);
ProcessStopWatcher = new System.Management.ManagementEventWatcher(Constants.selectStop);
ProcessStartWatcher.EventArrived += new System.Management.EventArrivedEventHandler(ProcessUpdateWatcher_EventArrived);
ProcessStopWatcher.EventArrived += new System.Management.EventArrivedEventHandler(ProcessUpdateWatcher_EventArrived);
ProcessStartWatcher.Start();
ProcessStopWatcher.Start();
}
