2025-04-27 07:49:33 -04:00

56 lines
1.3 KiB
Plaintext

#pragma namespace ("\\\\.\\Root\\BVTAPITEST")
// register me as a Physical Event Consumer Provider.
instance of __Win32Provider as $P
{
Name = "CmdLineEventConsumer";
Clsid = "{892C6A1B-266C-4699-96FA-2FF67D647FC8}";
};
instance of __EventConsumerProviderRegistration
{
Provider = $P;
ConsumerClassNames = {"CmdLineEventConsumer"};
};
// This is my logical consumer class. You MUST derive a class from
// __EventConsumer and you MUST add a [key] property. This
// definition is tightly tied to the consumer that potentially
// uses it.
class CmdLineEventConsumer : __EventConsumer
{
[key] string Name;
[read, write]
string cmdLine;
[read, write]
uint8 showWindow;
};
// Make an instance. Make more if want.
instance of CmdLineEventConsumer
{
Name = "Start Notepad";
cmdLine = "notepad";
showWindow = 1;
};
// These are for event binding. Normally, these are done separately
// because everything above here is one-time only.
instance of __EventFilter
{
Name = "New One";
QueryLanguage="WQL";
Query="select * from __InstanceCreationEvent where TargetInstance isa \"PermClass1\"";
};
// register for the event.
instance of __FilterToConsumerBinding
{
Consumer = "CmdLineEventConsumer.Name=\"Start Notepad\"";
Filter = "__EventFilter.Name=\"New One\"";
};