/// <summary>
/// The start detection.
/// </summary>
/// <param name="action">
/// The detection Action.
/// </param>
public void StartDetection(Action action)
{
ThreadPool.QueueUserWorkItem(
delegate
{
this.detectionAction = action;
var options = new ConnectionOptions { EnablePrivileges = true };
var scope = new ManagementScope(@"root\CIMV2", options);
try
{
var query = new WqlEventQuery
{
EventClassName = "__InstanceModificationEvent",
WithinInterval = TimeSpan.FromSeconds(1),
Condition = @"TargetInstance ISA 'Win32_LogicalDisk' and TargetInstance.DriveType = 5" // DriveType - 5: CDROM
};
this.watcher = new ManagementEventWatcher(scope, query);
this.watcher.EventArrived += this.WatcherEventArrived;
this.watcher.Start();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
}
});
}
private void AddInsertUSBHandler()
{
WqlEventQuery query;
ManagementScope scope = new ManagementScope("root\\CIMV2");
scope.Options.EnablePrivileges = true;
insertUSBWatcher = null;
try
{
query = new WqlEventQuery();
query.EventClassName = "__InstanceCreationEvent";
query.WithinInterval = new TimeSpan(0, 0, 3);
query.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
insertUSBWatcher = new ManagementEventWatcher(scope, query);
insertUSBWatcher.EventArrived += USBInserted;
insertUSBWatcher.Start();
}
catch(Exception e)
{
if (insertUSBWatcher != null)
{
insertUSBWatcher.Stop();
}
throw e;
}
}
public ProcessWatcher(TaskScheduler scheduler, params string[] processNames)
{
Scheduler = scheduler;
foreach (var pname in processNames) {
var invariant = Path.GetFileNameWithoutExtension(pname).ToLowerInvariant();
ProcessNames.Add(invariant);
foreach (var process in Process.GetProcessesByName(invariant)) {
RunningProcessIds.Add(process.Id);
NewProcesses.Enqueue(process);
}
}
try {
var query = new WqlEventQuery(@"SELECT * FROM Win32_ProcessStartTrace");
Watcher = new ManagementEventWatcher(query);
Watcher.Options.BlockSize = 1;
Watcher.EventArrived += new EventArrivedEventHandler(OnEventArrived);
Watcher.Start();
WatcherEnabled = true;
} catch {
Watcher = null;
WatcherEnabled = false;
TimerTask = Scheduler.Start(InitTimer(), TaskExecutionPolicy.RunAsBackgroundTask);
}
}
public void AddProcessStopEventHandler(string processName, Action handler)
{
WqlEventQuery query = new WqlEventQuery(PROCESS_INSTANCE_DELETION_EVENT, _eventQueryWithinInterval,
string.Format(PROCESS_QUERY_CONDITION, processName));
_watchers.Add(StartNewWatcher(query, handler));
}
public UsbDeviceEvent()
{
this.creationEventWatcher = (ManagementEventWatcher)null;
ManagementOperationObserver operationObserver = new ManagementOperationObserver();
ManagementScope scope = new ManagementScope("root\\CIMV2");
scope.Options.EnablePrivileges = true;
try
{
WqlEventQuery wqlEventQuery = new WqlEventQuery();
wqlEventQuery.EventClassName = "__InstanceCreationEvent";
wqlEventQuery.WithinInterval = new TimeSpan(0, 0, 3);
wqlEventQuery.Condition = "TargetInstance ISA 'Win32_USBControllerDevice'";
Console.WriteLine(wqlEventQuery.QueryString);
this.creationEventWatcher = new ManagementEventWatcher(scope, (EventQuery)wqlEventQuery);
this.creationEventWatcher.EventArrived += new EventArrivedEventHandler(this.creationEventWatcher_EventArrived);
this.creationEventWatcher.Start();
wqlEventQuery.EventClassName = "__InstanceDeletionEvent";
wqlEventQuery.WithinInterval = new TimeSpan(0, 0, 3);
wqlEventQuery.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
Console.WriteLine(wqlEventQuery.QueryString);
this.deletionEventWatcher = new ManagementEventWatcher(scope, (EventQuery)wqlEventQuery);
this.deletionEventWatcher.EventArrived += new EventArrivedEventHandler(this.deletionEventWatcher_EventArrived);
this.deletionEventWatcher.Start();
}
catch
{
this.Dispose();
}
}
private void MainWindow1_Initialized(object sender, EventArgs e)
{
BackgroundWorker detect = new BackgroundWorker();
detect.DoWork += new DoWorkEventHandler(detect_work);
detect.RunWorkerAsync();
queryadd = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2");
watcheradd.EventArrived += new EventArrivedEventHandler(watcher_deviceadded);
watcheradd.Query = queryadd;
watcheradd.Start();
queryremove = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 3");
watcherremove.EventArrived += new EventArrivedEventHandler(watcher_deviceremoved);
watcherremove.Query = queryremove;
watcherremove.Start();
if (queryadd.Equals(true))
{
watcherremove.Stop();
watcherremove.Start();
}
if (queryremove.Equals(true))
{
watcherremove.Stop();
watcherremove.Start();
}
}
static void Main(string[] args)
{
ManagementEventWatcher w1;
ManagementEventWatcher w2;
ManagementEventWatcher w3;
ManagementEventWatcher w4;
WqlEventQuery q1 = new WqlEventQuery("select * from __instanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' ");
w1 = new ManagementEventWatcher(q1);
w1.EventArrived += new EventArrivedEventHandler(WriteStarted);
WqlEventQuery q2 = new WqlEventQuery("select * from __instanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' ");
w2 = new ManagementEventWatcher(q2);
w2.EventArrived += new EventArrivedEventHandler(WriteFinished);
WqlEventQuery q3 = new WqlEventQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE'" + @" AND KeyPath = 'SOFTWARE\\LAB4'");
w3 = new ManagementEventWatcher(q3);
w3.EventArrived += new EventArrivedEventHandler(OnRegChanged);
WqlEventQuery q4 = new WqlEventQuery("Select * From __InstanceOperationEvent Within 2 Where TargetInstance Isa 'CIM_DataFile' And TargetInstance.Drive='C:' And " + @"TargetInstance.Path='\\Lab4\\test\\'");
w4 = new ManagementEventWatcher(q4);
w4.EventArrived += new EventArrivedEventHandler(OnFolderChanged);
w1.Start();
w2.Start();
w3.Start();
w4.Start();
System.Threading.Thread.Sleep(300000);
}
public static void Run()
{
// Create event query to be notified within 1 second of
// a new process being created
WqlEventQuery query =
new WqlEventQuery("__InstanceCreationEvent",
new TimeSpan(0, 0, 1),
"TargetInstance isa \"Win32_Process\"");
// Initialize an event watcher and subscribe to events
// that match this query
ManagementEventWatcher watcher =
new ManagementEventWatcher(query);
// times out watcher.WaitForNextEvent in 5 seconds
watcher.Options.Timeout = new TimeSpan(0, 0, 5);
// Block until the next event occurs
// Note: this can be done in a loop if waiting for
// more than one occurrence
Console.WriteLine(
"Open an application (notepad.exe) to trigger an event.");
ManagementBaseObject e = watcher.WaitForNextEvent();
log.Debug(e.GetText(TextFormat.Mof ));
ManagementBaseObject target = (ManagementBaseObject)e["TargetInstance"];
Object targetName = target["Name"];
Object targetPath = target["ExecutablePath"];
//Display information from the event
log.Info(
"Process {0} has been created, path is: " + targetName + ", " + targetPath);
//Cancel the subscription
watcher.Stop();
}
static void AddRemoveUSBHandler()
{
WqlEventQuery q;
try
{
q = new WqlEventQuery();
q.EventClassName = "__InstanceDeletionEvent";
q.WithinInterval = pollInterval;
//q.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
q.Condition = "TargetInstance ISA 'Win32_PnPEntity'";
//w = new ManagementEventWatcher(scope, q);
w = new ManagementEventWatcher(q);
w.EventArrived += USBRemoved;
w.Start();
}
catch (Exception e)
{
Console.WriteLine(e.Message);
if (w != null)
{
w.Stop();
}
}
}
public void StartWatcher()
{
try
{
ManagementScope managementScope = new ManagementScope("root\\CIMV2");
managementScope.Options.EnablePrivileges = true;
const String query = @"TargetInstance ISA 'Win32_USBControllerDevice'";
WqlEventQuery wqlEventQuery = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), query);
this.managementEventWatcherDeviceConnected = new ManagementEventWatcher(managementScope, wqlEventQuery);
this.managementEventWatcherDeviceConnected.EventArrived += this.OnDeviceConnected;
this.managementEventWatcherDeviceConnected.Start();
wqlEventQuery = new WqlEventQuery("__InstanceDeletionEvent", new TimeSpan(0, 0, 1), query);
this.managementEventWatcherDeviceDisconnected = new ManagementEventWatcher(managementScope, wqlEventQuery);
this.managementEventWatcherDeviceDisconnected.EventArrived += this.OnDeviceDisconnected;
this.managementEventWatcherDeviceDisconnected.Start();
wqlEventQuery = new WqlEventQuery("__InstanceModificationEvent", new TimeSpan(0, 0, 1), query);
this.managementEventWatcherDeviceModified = new ManagementEventWatcher(managementScope, wqlEventQuery);
this.managementEventWatcherDeviceModified.EventArrived += this.OnDeviceModified;
this.managementEventWatcherDeviceModified.Start();
}
catch (Exception ex)
{
Tracer.Trace(ex, "Error starting WMI watcher");
}
}
private void ListenForDeviceConnectionChanges()
{
var attachedDeviceQuery = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType=2");
var watcher = new ManagementEventWatcher(attachedDeviceQuery);
watcher.EventArrived += ReAttachDeviceIfRequired;
watcher.Start();
}
static void Main()
{
string currentPath = System.Environment.CurrentDirectory;
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
iosSyslogger LoggerWindow = new iosSyslogger();
loggerTool tool = new loggerTool();
WqlEventQuery insertQuery = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2"); //Checking USB device insertion
ManagementEventWatcher insertWatcher = new ManagementEventWatcher(insertQuery);
WqlEventQuery removeQuery = new WqlEventQuery("SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_USBHub'"); //Checking USB removal
ManagementEventWatcher removeWatcher = new ManagementEventWatcher(removeQuery);
insertWatcher.EventArrived += new EventArrivedEventHandler((source, e) => DeviceInsertedEvent(source, e, LoggerWindow, tool));
insertWatcher.Start();
removeWatcher.EventArrived += new EventArrivedEventHandler((source, e) => DeviceRemovedEvent(source, e, LoggerWindow, tool));
removeWatcher.Start();
Thread loggerParentThread = new Thread(() => tool.readDeviceUUID(LoggerWindow, tool)); //Parent thread for Syslogger
loggerParentThread.Start();
Application.Run(LoggerWindow);
AppDomain.CurrentDomain.ProcessExit += new EventHandler(OnProcessExit);
}
public ChooseForm ()
{
InitializeComponent ();
processView.ListViewItemSorter = new ProcessViewItemComparer ();
usbDevView.ListViewItemSorter = new DeviceViewItemComparer ();
processViewUpdater = new ProcessViewUpdater (processView);
usbViewUpdater = new UsbViewUpdater (usbDevView);
WqlEventQuery startQuery = new WqlEventQuery ();
startQuery.EventClassName = "Win32_ProcessStartTrace";
WqlEventQuery stopQuery = new WqlEventQuery ();
stopQuery.EventClassName = "Win32_ProcessStopTrace";
ManagementEventWatcher w = new ManagementEventWatcher (startQuery);
w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived);
w.Start();
processStartWatcher = w;
w = new ManagementEventWatcher (stopQuery);
w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived);
w.Start ();
processStopWatcher = w;
}
public Boolean AddUSBEventWatcher(EventArrivedEventHandler usbInsertHandler, EventArrivedEventHandler usbRemoveHandler, TimeSpan withinInterval)
{
try
{
ManagementScope Scope = new ManagementScope("root\\CIMV2");
Scope.Options.EnablePrivileges = true;
if (usbInsertHandler != null)
{
WqlEventQuery InsertQuery = new WqlEventQuery("__InstanceCreationEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'");
insertWatcher = new ManagementEventWatcher(Scope, InsertQuery);
insertWatcher.EventArrived += usbInsertHandler;
insertWatcher.Start();
}
if (usbRemoveHandler != null)
{
WqlEventQuery RemoveQuery = new WqlEventQuery("__InstanceDeletionEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'");
removeWatcher = new ManagementEventWatcher(Scope, RemoveQuery);
removeWatcher.EventArrived += usbRemoveHandler;
removeWatcher.Start();
}
return true;
}
catch (Exception)
{
RemoveUSBEventWatcher();
return false;
}
}
/// <exception cref="System.Security.SecurityException">
/// 当前用户没有访问监控器中项的许可时抛出。
/// </exception>
/// <exception cref="System.ArgumentException">
/// 当监控器中的项不存在时抛出。
/// </exception>
public RegistryWatcher(RegistryKey hive, string keyPath)
{
this.Hive = hive;
this.KeyPath = keyPath;
// 如果你把这个项目的平台设为x86，则在一个64位的机器上运行此项目时，当你的项路径
// 是HKEY_LOCAL_MACHINE\SOFTWARE时，你将会在HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node
// 下找到注册表项。
this.KeyToMonitor = hive.OpenSubKey(keyPath);
if (KeyToMonitor != null)
{
// 构造查询字符串。
string queryString = string.Format(@"SELECT * FROM RegistryKeyChangeEvent
WHERE Hive = '{0}' AND KeyPath = '{1}' ", this.Hive.Name, this.KeyPath);
WqlEventQuery query = new WqlEventQuery();
query.QueryString = queryString;
query.EventClassName = "RegistryKeyChangeEvent";
query.WithinInterval = new TimeSpan(0, 0, 0, 1);
this.Query = query;
this.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);
}
else
{
string message = string.Format(
@"注册表项 {0}\{1} 不存在。",
hive.Name,
keyPath);
throw new ArgumentException(message);
}
}
public static ManagementEventWatcher GetWatcher(EventArrivedEventHandler handler)
{
WqlEventQuery query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\"");
ManagementEventWatcher watcher = new ManagementEventWatcher(query);
watcher.EventArrived += new EventArrivedEventHandler(handler);
return watcher;
}
/// <summary>
/// USB 插入和拔出监测函数。
/// 使用ManagementEventWacher来预定特定系统事件，通过WqlEventQuery设置查询对象和条件以及其他属性（比如查询的轮询间隔），
/// 通过ManagementScope设置查询路径范围。
/// </summary>
public void USBRemoveWacher()
{
ManagementEventWatcher wacher = null;
WqlEventQuery query = null;
ManagementScope scope = null;
try
{
scope = new ManagementScope("root\\CIMV2"); //设置WMI路径
query = new WqlEventQuery(); //设置查询的事件类名，条件，查询间隔，也可一次在构造函数中初始化
query.EventClassName = "__InstanceDeletionEvent";
query.Condition = @"TargetInstance ISA 'Win32_USBControllerdevice'";
query.WithinInterval = new TimeSpan(1000);
wacher = new ManagementEventWatcher(scope, query);
wacher.EventArrived += new EventArrivedEventHandler(onUSBRemoved);
wacher.Start();
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
this.Closed += (s, e) =>
{
wacher.Stop();
wacher.Dispose();
};
}
static PathUtility()
{
var combinedPath = Path.Combine("a", "b");
DefaultDirectorySeparator = combinedPath.Substring(1, combinedPath.Length - 2);
//Insert
WqlEventQuery q_creation = new WqlEventQuery();
q_creation.EventClassName = "__InstanceCreationEvent";
q_creation.WithinInterval = new TimeSpan(0, 0, 2); //How often do you want to check it? 2Sec.
q_creation.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'";
_mweCreation = new ManagementEventWatcher(q_creation);
_mweCreation.EventArrived += UsbStorageInserted;
_mweCreation.Start(); // Start listen for events
//Remove
WqlEventQuery q_deletion = new WqlEventQuery();
q_deletion.EventClassName = "__InstanceDeletionEvent";
q_deletion.WithinInterval = new TimeSpan(0, 0, 2); //How often do you want to check it? 2Sec.
q_deletion.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition' ";
_mweDeletion = new ManagementEventWatcher(q_deletion);
_mweDeletion.EventArrived += UsbStorageRemoved;
_mweDeletion.Start(); // Start listen for events
Storage = _knownStorage;
UpdateStorage();
}
public DriveService()
{
// Bind to local machine
var options = new ConnectionOptions { EnablePrivileges = true };
var scope = new ManagementScope(@"root\CIMV2", options);
try
{
var query = new WqlEventQuery
{
EventClassName = "__InstanceModificationEvent",
WithinInterval = TimeSpan.FromSeconds(1),
Condition = @"TargetInstance ISA 'Win32_LogicalDisk' and TargetInstance.DriveType = 5" // DriveType - 5: CDROM
};
this.watcher = new ManagementEventWatcher(scope, query);
// register async. event handler
this.watcher.EventArrived += this.HandleDiscEvent;
this.watcher.Start();
}
catch (Exception e)
{
System.Diagnostics.Debug.WriteLine(e.Message);
}
}
private static void WaitForUSB()
{
ManagementEventWatcher watcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Query = query;
watcher.Start();
}
private ManagementEventWatcher StartNewWatcher(WqlEventQuery query, Action handler)
{
var watcher = new ManagementEventWatcher { Query = query };
watcher.EventArrived += (s, e) => handler();
watcher.Start();
return watcher;
}
private void InitializeWatcher()
{
_watcher = new ManagementEventWatcher();
var query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2 or EventType = 3");
_watcher.EventArrived += WatcherOnEventArrived;
_watcher.Query = query;
_watcher.Start();
}
public DeviceEnumerationListener()
{
WqlEventQuery query = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_PnPEntity'") {
WithinInterval = new TimeSpan(0, 0, 1)
};
this.watcher = new ManagementEventWatcher(query);
this.watcher.EventArrived += new EventArrivedEventHandler(this.watcher_EventArrived);
this.watcher.Start();
}
public UsbWrapper()
{
WqlEventQuery q = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_LogicalDisk'");
q.WithinInterval = TimeSpan.FromSeconds(1);
eventWatcher = new ManagementEventWatcher(q);
eventWatcher.EventArrived += new EventArrivedEventHandler(OnUsbEvent);
eventWatcher.Start();
App.Current.Exit += new ExitEventHandler(OnAppExit);
}
private void StartWatchDeleteProcess()
{
WqlEventQuery query = new WqlEventQuery("__InstanceDeletionEvent",
new TimeSpan(0, 0, 1),
"TargetInstance isa \"Win32_Process\"");
watch_del = new ManagementEventWatcher(query);
watch_del.EventArrived += new EventArrivedEventHandler(HandleProcessDeleteEvent);
watch_del.Start();
}
public DeviceListManager(ConfigurationManager configurationManager)
{
ConfigurationManager = configurationManager;
ManagementEventWatcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery(DeviceChangeEventQuery);
ManagementEventWatcher.EventArrived += Watcher_EventArrived;
ManagementEventWatcher.Query = query;
IsKeepRunning = false;
}
public WMIWatcher(string eventClassName, string processName, Action<DateTime> notifyAction)
{
this.notifyAction = notifyAction;
this.processName = processName;
var q = new WqlEventQuery();
q.EventClassName = eventClassName;
this.w = new ManagementEventWatcher(q);
this.w.EventArrived += new EventArrivedEventHandler(ProcessStartEventArrived);
this.w.Start();
}
public void Start(delegate_action action)
{
_action = action;
_q = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_USBControllerDevice' ");
_q.WithinInterval = TimeSpan.FromSeconds(1);
_w = new ManagementEventWatcher(_q);
_w.EventArrived += new EventArrivedEventHandler(onEventArrived);
_w.Start();
}
public ProcWatchers()
{
//Hook WMI because its awesome
watcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace");
watcher.Query = query;
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Start();
w = Writer.getInstance();
builder = new StringBuilder();
}
public static void WatchDrives(Action handler)
{
using (var watcher = new ManagementEventWatcher())
{
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
watcher.EventArrived += (e, sender) => handler();
watcher.Query = query;
watcher.Start();
watcher.WaitForNextEvent();
}
}
public static ManagementEventWatcher GetWatcher(EventArrivedEventHandler handler)
{
WqlEventQuery query = new WqlEventQuery("__InstanceModificationEvent", new TimeSpan(0, 0, 1),
"TargetInstance isa 'Win32_LocalTime' AND TargetInstance.Second = 0");
ManagementEventWatcher watcher = new ManagementEventWatcher(query);
watcher.EventArrived += new EventArrivedEventHandler(handler);
return watcher;
}
private void subscribeEvent(Threshold th)
{
string dirSymbol;
if (th.Threshold_dir == Threshold_X_Dir.ABOVE_THRESHOLD)
{
dirSymbol = ">";
}
else
{
dirSymbol = "<";
}
wqlquery = new System.Management.WqlEventQuery("__InstanceModificationEvent"
, new TimeSpan(0, 0, 1)
, "TargetInstance isa \"Win32_NetworkAdapter\" AND TargetInstance.GUID='" + Information.GenericInfo.InterfaceGUID + "' AND TargetInstance.Speed " + dirSymbol + th.Threshold_Val);
mw = new System.Management.ManagementEventWatcher(wqlquery);
mw.EventArrived += new System.Management.EventArrivedEventHandler(mw_EventArrived);
mw.Start();
}
