Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

query wmi with IoWMIOpenBlock

MakMak Member Posts: 50

We have this IoWMIOpenBlock but how to get the UUID from e.g. "Win32_InfraredDevice" or "Win32_NetworkLoginProfile".
I know the header "wmidata.h" but this file has not all GUID of the available classes from "cimv2".

Thanks in advance


  • MakMak Member Posts: 50

    Does someone use this IoWMIOpenBlock functions? It seems to me that the most of them are not supported now.

  • Jeffrey_Tippet_[MSFT]Jeffrey_Tippet_[MSFT] Member - All Emails Posts: 527

    IoWMIOpenBlock is still supported. But WMI in general is not under active development, so you'll probably find there are not many experts, and the documentation might be a bit stale.

    Furthermore, IoWMIOpenBlock can only query kernel providers. It's not supported (or really a desirable architecture) for a kernel client to query a usermode provider. Since most WMI classes are implemented by a usermode provider, this means that your kernel driver cannot query most classes, including the two you mention.

    How can you determine whether a WMI class is implemented by a kernel or usermode provider? Query the class definition via PowerShell:

    (Get-CimClass -Namespace root\cimv2 -Class Win32_NetworkLoginProfile).CimClassQualifiers['provider'].Value

    A provider value of CIMWin32 means it's implemented by some sort of usermode COM server. A value of WMIProv means it's implemented internally by WMI, which includes kernel providers. (To see an example of a kernel-provided WMI class, you can query root\wmi\MSNdis_RSSEnabled.)

    To answer your specific question: you can always obtain the UUID for a class by querying WMI:

    (Get-CimClass -Namespace root\cimv2 -Class Win32_NetworkLoginProfile).CimClassQualifiers['UUID']

    In this case, the UUID is part of the contract for the class, so it's safe to lift the UUID from a running system and hardcode the UUID into your code. (Microsoft won't "change" the UUID unless the class takes a breaking change that makes it fundamentally semantically incompatible with the old class.)

  • MakMak Member Posts: 50

    Thank you jeffrey.
    I looked at the file wmidata.h winsdk in the "km" folder:
    There is for example this guid:

    // MSSmBios_SysidUUID - SYSID_UUID

    define MSSmBios_SysidUUIDGuid \

    { 0x8f680852,0xa584,0x11d1, { 0xbf,0x38,0x00,0xa0,0xc9,0x06,0x29,0x10 } }

    It seems for me that this is especially done for KM. If I try this guid and others with your get-cimclass, I get always the output "Not found"

  • Jeffrey_Tippet_[MSFT]Jeffrey_Tippet_[MSFT] Member - All Emails Posts: 527

    That class is in a different namespace:

    get-cimclass -Namespace root\wmi MSSmBios_SysidUUID

    It does appear that this one has a kernel provider, so there's some chance you can query it from a kernel client. Although, you probably have to query for MSSmBios_SysidUUIDList; the MSSmBios_SysidUUID is just a helper class.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA