4.3.3.1 Semisynchronous Delivery of IWbemServices ExecQuery and ExecMethod Operations
This section contains the information exchanged between SAI-NAV009 (client) and SAI-NAV009-2 (server).
First the client tries to connect to the server and obtains IWbemServices for namespace root\cimv2 as outlined in 4.1.1.
The client calls ExecQuery method on IwbemServices interface pointer with "select * from win32_process where Name='calc.exe'" as strQuery. It is assumed that an instance of calc.exe is running on the server:
-
- WMI: IWbemServices:ExecQuery Request, Flags=48 + StrQueryLanguage: WQL + StrQuery: select * from win32_process where Name='calc.exe' + Pad: 2 Bytes + Flags: 48 (0x30) + Ctx: NULL
In response to the method executed above, the server returns an IenumWbemClassObject interface pointer:
-
- WMI: IWbemServices:ExecQuery Response, ReturnValue=WBEM_S_NO_ERROR + Enum: OBJREFSTANDARD - {027947E1-D731-11CE-A357-000000000001} + Pad: 2 Bytes ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The client uses IRemUnknown and IRemUnknown2, as specified in [MS-DCOM], to obtain an IWbemFetchSmartEnum interface pointer from the IEnumWbemClassObject interface pointer. From this the client would know if the server is optimized:
-
- DCOM: IRemUnknown2:RemQueryInterface Request, DCOM Version=5.7 Causality Id={EF414E15-6ACF-408A-BB6E-ECB20DA968D8} + HeaderReq: DCOM Version=5.7 Causality Id={EF414E15-6ACF-408A-BB6E-ECB20DA968D8} QueriedObjectIpId: {0001B004-06C4-0000-712F-83B56A62FA75} PublicObjectReferenceCount: 5 (0x5) NumRequestedIIds: 1 (0x1) + Size: 1 Elements + InterfaceIds:
The server responds with a valid IWbemFetchSmartEnum interface pointer. This means that the server is optimized:
-
- DCOM: IRemUnknown2:RemQueryInterface Response, ORPCFNULL - No additional information in this packet + HeaderResp: ORPCFNULL - No additional information in this packet + RemqiresultPtr: Pointer To 0x00020000 + Size: 1 Elements + QueryInterfaceResults: + ReturnValue: Success
The client then calls the IWbemFetchSmartEnum::GetSmartEnum method to obtain the IWbemFetchSmartEnum interface pointer:
-
WMI: IWbemFetchSmartEnum:GetSmartEnum Request
The server responds with a valid IWbemWCOSmartEnum interface pointer:
-
- WMI: IWbemFetchSmartEnum:GetSmartEnum Response, ReturnValue=WBEM_S_NO_ERROR + SmartEnum: OBJREFSTANDARD - {423EC01E-2E35-11D2-B604-00104B703EFD} + Pad: 2 Bytes ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The client uses the IWbemWCOSmartEnum::Next method repeatedly to retrieve the IwbemClassObject interface pointers that contain the result set:
-
- WMI: IWbemWCOSmartEnum:Next Request, Timeout=5000 UCount=10 proxyGUID: {90B8134C-F980-415C-92E3-511819BC3BC5} Timeout: 5000 ms(0x1388) UCount: 10 (0xA)
The server responds with the result set with one win32_process object for calc.exe instance running. The results are encoded as an ObjectArray as specified in section 2.2.14:
-
- WMI: IWbemWCOSmartEnum:Next Response, PuReturned=1 BuffSize=9104 ReturnValue=0x00000300 - Unknown Value PuReturned: 1 (0x1) BuffSize: 9104 (0x2390) + BufferPtrSize: Pointer To 0x00020000, 9104 Elements + ObjectArray: + Pad: 2 Bytes ReturnValue: 0x00000300 - Unknown Value + msrpc: c/o Continued Response: IWbemWCOSmartEnum(WMIRP) {423EC01E-2E35-11D2-B604-00104B703EFD} Call=0xA Context=0x6 Hint=0xD1C Cancels=0x0 InstanceQuarlifier error: Unknown QualifierType
The client obtains __RELPATH property from IwbemClassObject as \\SAI-NAV009-2\root\cimv2:Win32_Process.Handle="2680".
The client makes ExecMethod operation on IWbemServices interface pointer to call terminate() method on Win32_Process object corresponding to calc.exe instance obtained above. [This action terminates the process calc.exe on the server]:
-
- WMI: IWbemServices:ExecMethod Request, Flags=16 + StrObjectPath: \\SAI-NAV009-2\root\cimv2:Win32_Process.Handle="2680" + StrMethodName: Terminate + Pad: 2 Bytes Flags: WBEM_FLAG_RETURN_IMMEDIATELY - If this bit is not set, the server MUST make the method call synchronously. If this bit is set, the server MUST make the method call semisynchronously. + Ctx: NULL + InParams: OBJREFCUSTOM - {DC12A681-737F-11CF-884D-00AA004B2E24} + OutParams: NULL + CallResult: NULL
The server responds with a valid IWbemCallResult interface pointer corresponding to the ExecMethod operation above:
-
- WMI: IWbemServices:ExecMethod Response, ReturnValue=WBEM_S_NO_ERROR + OutParams: NULL + CallResult: OBJREFSTANDARD - {44ACA675-E8FC-11D0-A07C-00C04FB68820} + Pad: 2 Bytes ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The client calls GetCallStatus on IWbemCallResult interface pointer to obtain the status of the ExecMethod operation above:
-
- WMI: IWbemCallResult:GetCallStatus Request, Timeout=5000 Timeout: 5000 ms(0x1388)
The server responds with ReturnValue WBEM_S_NO_ERROR, and the Status as S_OK. This implies that the ExecMethod operation above was successfully executed on the server:
-
- WMI: IWbemCallResult:GetCallStatus Response, Status=0 ReturnValue=WBEM_S_NO_ERROR Status: 0 (0x0) ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The client calls GetResultObject method on IWbemCallResult interface pointer to get the result object:
-
- WMI: IWbemCallResult:GetCallStatus Response, Status=0 ReturnValue=WBEM_S_NO_ERROR Status: 0 (0x0) ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The server responds with WBEM_S_NO_ERROR, and an instance of IwbemClassObject that contains the return value from Terminate method above:
-
- WMI: IWbemCallResult:GetResultObject Response, ReturnValue=WBEM_S_NO_ERROR + ResultObject: OBJREFCUSTOM - {DC12A681-737F-11CF-884D-00AA004B2E24} + pad: 3 Bytes ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
To confirm that calc.exe instance is indeed terminated, the client calls ExecQuery method on IWbemServices interface pointer with "select * from win32_process where Name='calc.exe'" as strQuery:
-
- WMI: IWbemServices:ExecQuery Request, Flags=48 + StrQueryLanguage: WQL + StrQuery: select * from win32_process where Name='calc.exe' + Pad: 2 Bytes + Flags: 48 (0x30) + Ctx: NULL
In response to the method executed above, the server returns an IEnumWbemClassObject interface pointer:
-
- WMI: IWbemServices:ExecQuery Response, ReturnValue=WBEM_S_NO_ERROR + Enum: OBJREFSTANDARD - {027947E1-D731-11CE-A357-000000000001} + Pad: 2 Bytes ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The client uses IRemUnknown and IRemUnknown2, as specified in [MS-DCOM], to obtain an IWbemFetchSmartEnum interface pointer from the IEnumWbemClassObject interface pointer. From this the client knows whether the server is optimized:
-
- DCOM: IRemUnknown2:RemQueryInterface Request, DCOM Version=5.7 Causality Id={EF414E15-6ACF-408A-BB6E-ECB20DA968D8} + HeaderReq: DCOM Version=5.7 Causality Id={EF414E15-6ACF-408A-BB6E-ECB20DA968D8} QueriedObjectIpId: {0001942E-06C4-0000-E48B-1633B50E272E} PublicObjectReferenceCount: 5 (0x5) NumRequestedIIds: 1 (0x1) + Size: 1 Elements + InterfaceIds:
The server responds with a valid IWbemFetchSmartEnum interface pointer. This means that the server is optimized:
-
- DCOM: IRemUnknown2:RemQueryInterface Response, ORPCFNULL - No additional information in this packet + HeaderResp: ORPCFNULL - No additional information in this packet + RemqiresultPtr: Pointer To 0x00020000 + Size: 1 Elements + QueryInterfaceResults: + ReturnValue: Success
The client then calls the IWbemFetchSmartEnum::GetSmartEnum method to obtain the IWbemWCOSmartEnum interface pointer:
-
WMI: IWbemFetchSmartEnum:GetSmartEnum Request
The server responds with a valid IWbemWCOSmartEnum interface pointer:
-
- WMI: IWbemFetchSmartEnum:GetSmartEnum Response, ReturnValue=WBEM_S_NO_ERROR + SmartEnum: OBJREFSTANDARD - {423EC01E-2E35-11D2-B604-00104B703EFD} + Pad: 2 Bytes ReturnValue: 0x00000000 - WBEM_S_NO_ERROR - Indicates a successful completion to the method call.
The client uses the IWbemWCOSmartEnum::Next method repeatedly to retrieve the IwbemClassObject interface pointers that contain the result set:
-
- WMI: IWbemWCOSmartEnum:Next Request, Timeout=5000 UCount=10 proxyGUID: {4382C990-EC38-4C41-8A88-A1B14E7DE10B} Timeout: 5000 ms(0x1388) UCount: 10 (0xA)
The server responds with the result set this time with no calc.exe instances. (This proves that the terminate method was called and has terminated calc.exe process on the server):
-
- WMI: IWbemWCOSmartEnum:Next Response, PuReturned=0 BuffSize=0 ReturnValue=WBEM_S_FALSE PuReturned: 0 (0x0) BuffSize: 0 (0x0) + BufferPtrSize: Pointer To NULL Pad: 0 Bytes ReturnValue: 0x00000001 - WBEM_S_FALSE - Either no more CIM objects are available, the number of returned CIM objects is less than the number requested, or this is the end of an enumeration.