Wmi queries question

[merfin993]

Hi, Sorry for my bad english, is it possible to hook wmi query with hyperdbg?

[SinaKarvandi]

Hi,
Thanks for asking.

Actually, yes, you can hook any functionalities in Windows. However, like other debuggers, you should know the exact functions or the system-call and its parameters to make a hook. I don't know how WMI works internally, but if there is a function in which it passes its queries, it'll be possible to hook it in HyperDbg.

[JafarAkhondali]

+1
It would be nice if you can add a guide for it. Currently many laptops use WMI to interact with hardware for special features like keyboard RGB control. I had some rough times understanding the way the drivers were working, so that I can implement them in Linux kernel. Having this feature drastically saves time for us.

[SinaKarvandi]

Hi,
Not sure if we're on the same page. By WMI, I mean those WMI queries I see on Windows (example).

Then how could it be related to HyperDbg? or Am I missing something here? By WMI, do you mean something else?

[JafarAkhondali]

Hi Sina,
Yes, but instead of querying the WMI objects, we use it to invoke WMI methods. For example, this is how we use it in Linux:
https://github.com/torvalds/linux/blob/c33ffdb70cc6df4105160f991288e7d2567d7ffa/drivers/platform/x86/acer-wmi.c#L1432
For example for Acer gaming laptops, two WMI methods(GetGamingFanSpeed and SetGamingFanSpeed) are in the AcerGamingFunction namespace that control fan speed. The official Acer software uses these methods, but if we want to implement these features in Linux, we usually have to guess the parameters or decompile the software and read the code. I'm looking for methods that can help us understand when we click on a part of the Acer software to for example change the fan speed, what WMI method is called, and what the parameters are.

I think this is how it's used in Windows:
https://www.codeproject.com/Questions/614206/Execute-WMI-method-on-remote-computer

So not sure if it's related to HyperDbg, I just hope it's possible to monitor inputs and class names when a program invokes a WMI method.

[SinaKarvandi]

Hi Jafar,

Thank you for your explanation. I understand. However, the to-do list for HyperDbg currently has many tasks still pending:
https://github.com/HyperDbg/HyperDbg/blob/master/CONTRIBUTING.md

Given the number of developers, it will likely take a long time to implement all these features. If you have experience in low-level system programming, your help in developing these features would be greatly appreciated.