Dump WMI informations from ACPI tables
C Python Makefile
Latest commit 1634cc1 Sep 28, 2015 @iksaif Remove old README
Signed-off-by: Corentin Chary <corentin.chary@gmail.com>
Permalink
Failed to load latest commit information.
.gitignore
Makefile
README.md
wmidump.c
wmixtract.py

README.md

wmidump

Build

gcc wmidump.c -std=gnu99 -o wmidump

Usage

Find the _WDG method of your WMI device and copy the content of the buffer in a file.

Name (_WDG, Buffer (0x50)
{
  --- cut here ---
  /* 0000 */    0xD0, 0x5E, 0x84, 0x97, 0x6D, 0x4E, 0xDE, 0x11, 
  /* 0008 */    0x8A, 0x39, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66, 
  /* 0010 */    0x42, 0x43, 0x01, 0x02, 0xA0, 0x47, 0x67, 0x46, 
  /* 0018 */    0xEC, 0x70, 0xDE, 0x11, 0x8A, 0x39, 0x08, 0x00, 
  /* 0020 */    0x20, 0x0C, 0x9A, 0x66, 0x42, 0x44, 0x01, 0x02, 
  /* 0028 */    0x72, 0x0F, 0xBC, 0xAB, 0xA1, 0x8E, 0xD1, 0x11, 
  /* 0030 */    0x00, 0xA0, 0xC9, 0x06, 0x29, 0x10, 0x00, 0x00, 
  /* 0038 */    0xD2, 0x00, 0x01, 0x08, 0x21, 0x12, 0x90, 0x05, 
  /* 0040 */    0x66, 0xD5, 0xD1, 0x11, 0xB2, 0xF0, 0x00, 0xA0, 
  /* 0048 */    0xC9, 0x06, 0x29, 0x10, 0x4D, 0x4F, 0x01, 0x00
  --- end cut ---
})

Then run ./wmidump < file and it should output something like that:

$ ./wmidump < ../wdg
97845ED0-4E6D-11DE-8A39-0800200C9A66:
        object_id: BC
        notify_id: 42
        reserved: 43
        instance_count: 1
        flags: 0x2 ACPI_WMI_METHOD 
466747A0-70EC-11DE-8A39-0800200C9A66:
        object_id: BD
        notify_id: 42
        reserved: 44
        instance_count: 1
        flags: 0x2 ACPI_WMI_METHOD 
ABBC0F72-8EA1-11D1-00A0-C90629100000:
        object_id: �
        notify_id: D2
        reserved: 00
        instance_count: 1
        flags: 0x8 ACPI_WMI_EVENT 
05901221-D566-11D1-B2F0-00A0C9062910:
        object_id: MO
        notify_id: 4D
        reserved: 4F
        instance_count: 1
        flags: 0

wmixtract.py

wmixtract.py is a small python script to extract _WDG and WQXX buffers. Resulting _WDG files can be parsed with wmidump directly. WQXX buffers contain compiled MOF (Managed Object Format) and can be decompiled using the wmimofck.exe program available in Windows Driver Kit (WDK).

references: