我可以使用以下PowerShell代码创建伪造的WMI类:
# Win32_SMBIOSMemory
$newClass = New-Object System.Management.ManagementClass("root\cimv2", [String]::Empty, $null);
$newClass["__CLASS"] = "Win32_SMBIOSMemory";
$newClass.Qualifiers.Add("Static", $true)
$newClass.Properties.Add("Name", [System.Management.CimType]::String, $false)
$newClass.Properties["Name"].Qualifiers.Add("read", $true)
$newClass.Properties["Name"].Qualifiers.Add("Key", $true)
$newClass.Put()
Set-WmiInstance -Path \\.\root\cimv2:Win32_SMBIOSMemory -Arguments @{Name="Memory Array";}
如果我对CIM类尝试相同的操作,将无法正常工作
# CIM_Memory
$newClass = New-Object System.Management.ManagementClass("root\cimv2", [String]::Empty, $null);
$newClass["__CLASS"] = "CIM_Memory";
$newClass.Qualifiers.Add("Static", $true)
$newClass.Properties.Add("DeviceID", [System.Management.CimType]::String, $false)
$newClass.Properties["DeviceID"].Qualifiers.Add("read", $true)
$newClass.Properties["DeviceID"].Qualifiers.Add("Key", $true)
$newClass.Put()
Set-WmiInstance -Path \\.\root\cimv2:CIM_Memory -Arguments @{DeviceID="Cache Memory 0";}
错误:
Exception calling "Put" with "0" argument(s): "Class has children "
我检查了是否还有New-CimInstance,但是到目前为止还没有创建一个伪造的实例。