创建伪造的CIM类

时间:2019-04-17 13:43:10

标签: powershell wmi cim

我可以使用以下PowerShell代码创建伪造的WMI类:

# Win32_SMBIOSMemory
$newClass = New-Object System.Management.ManagementClass("root\cimv2", [String]::Empty, $null); 
$newClass["__CLASS"] = "Win32_SMBIOSMemory"; 
$newClass.Qualifiers.Add("Static", $true)
$newClass.Properties.Add("Name", [System.Management.CimType]::String, $false)
$newClass.Properties["Name"].Qualifiers.Add("read", $true)
$newClass.Properties["Name"].Qualifiers.Add("Key", $true)
$newClass.Put()
Set-WmiInstance -Path \\.\root\cimv2:Win32_SMBIOSMemory -Arguments @{Name="Memory Array";}

如果我对CIM类尝试相同的操作,将无法正常工作

# CIM_Memory
$newClass = New-Object System.Management.ManagementClass("root\cimv2", [String]::Empty, $null); 
$newClass["__CLASS"] = "CIM_Memory"; 
$newClass.Qualifiers.Add("Static", $true)
$newClass.Properties.Add("DeviceID", [System.Management.CimType]::String, $false)
$newClass.Properties["DeviceID"].Qualifiers.Add("read", $true)
$newClass.Properties["DeviceID"].Qualifiers.Add("Key", $true)
$newClass.Put()
Set-WmiInstance -Path \\.\root\cimv2:CIM_Memory -Arguments @{DeviceID="Cache Memory 0";}

错误:

Exception calling "Put" with "0" argument(s): "Class has children "

我检查了是否还有New-CimInstance,但是到目前为止还没有创建一个伪造的实例。

0 个答案:

没有答案