Search in sources :

Example 1 with GUID

use of com.sun.jna.platform.win32.Guid.GUID in project jna by java-native-access.

the class WevtapiTest method testReadEvents.

public void testReadEvents() throws Exception {
    EVT_HANDLE queryHandle = null;
    EVT_HANDLE contextHandle = null;
    File testEvtx = new File(getClass().getResource("/res/WevtapiTest.sample1.evtx").toURI());
    StringBuilder sb = new StringBuilder();
    try {
        // test EvtQuery
        queryHandle = Wevtapi.INSTANCE.EvtQuery(null, testEvtx.getPath(), null, Winevt.EVT_QUERY_FLAGS.EvtQueryFilePath);
        // test EvtCreateRenderContext
        String[] targets = { "Event/System/Provider/@Name", "Event/System/EventRecordID", "Event/System/EventID", "Event/EventData/Data", "Event/System/TimeCreated/@SystemTime" };
        contextHandle = Wevtapi.INSTANCE.EvtCreateRenderContext(targets.length, targets, Winevt.EVT_RENDER_CONTEXT_FLAGS.EvtRenderContextValues);
        // test EvtNext
        int eventArraySize = 10;
        int evtNextTimeout = 1000;
        int arrayIndex = 0;
        EVT_HANDLE[] eventArray = new EVT_HANDLE[eventArraySize];
        IntByReference returned = new IntByReference();
        SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd");
        while (Wevtapi.INSTANCE.EvtNext(queryHandle, eventArraySize, eventArray, evtNextTimeout, 0, returned)) {
            // test EvtRender
            Memory buff;
            IntByReference propertyCount = new IntByReference();
            Winevt.EVT_VARIANT evtVariant = new Winevt.EVT_VARIANT();
            for (int i = 0; i < returned.getValue(); i++) {
                buff = WevtapiUtil.EvtRender(contextHandle, eventArray[i], Winevt.EVT_RENDER_FLAGS.EvtRenderEventValues, propertyCount);
                assertThat("PropertyCount", propertyCount.getValue(), is(5));
                useMemory(evtVariant, buff, 0);
                assertThat("Provider Name", (String) evtVariant.getValue(), is("testSource"));
                sb.append((String) evtVariant.getValue());
                useMemory(evtVariant, buff, 1);
                assertThat("EventRecordID", (Long) evtVariant.getValue(), is((long) arrayIndex * eventArraySize + i + 1));
                useMemory(evtVariant, buff, 2);
                assertThat("EventID", (Short) evtVariant.getValue(), is((short) (5000 + (arrayIndex * eventArraySize + i + 1))));
                useMemory(evtVariant, buff, 3);
                String[] args = (String[]) evtVariant.getValue();
                assertThat("Data#length", args.length, is(1));
                assertThat("Data#value", args[0], is("testMessage" + (arrayIndex * eventArraySize + i + 1)));
                useMemory(evtVariant, buff, 4);
                Date systemtime = ((WinBase.FILETIME) evtVariant.getValue()).toDate();
                assertThat("TimeCreated", dateFormat.format(systemtime), is("2016-08-17"));
            }
            arrayIndex++;
        }
        if (Kernel32.INSTANCE.GetLastError() != WinError.ERROR_SUCCESS && Kernel32.INSTANCE.GetLastError() != WinError.ERROR_NO_MORE_ITEMS) {
            throw new Win32Exception(Kernel32.INSTANCE.GetLastError());
        }
        assertThat(sb.length() > 0, is(true));
    } finally {
        // test EvtClose
        if (queryHandle != null) {
            Wevtapi.INSTANCE.EvtClose(queryHandle);
        }
        if (contextHandle != null) {
            Wevtapi.INSTANCE.EvtClose(contextHandle);
        }
    }
    // =========== Test accessing binary data and empty value ================
    queryHandle = null;
    contextHandle = null;
    testEvtx = new File(getClass().getResource("/res/WevtapiTest.sample2.evtx").toURI());
    try {
        queryHandle = Wevtapi.INSTANCE.EvtQuery(null, testEvtx.getPath(), null, Winevt.EVT_QUERY_FLAGS.EvtQueryFilePath);
        String[] targets = { "Event/EventData/Binary", "Event/System/Correlation" };
        contextHandle = Wevtapi.INSTANCE.EvtCreateRenderContext(targets.length, targets, Winevt.EVT_RENDER_CONTEXT_FLAGS.EvtRenderContextValues);
        int read = 0;
        int eventArraySize = 1;
        int evtNextTimeout = 1000;
        EVT_HANDLE[] eventArray = new EVT_HANDLE[eventArraySize];
        IntByReference returned = new IntByReference();
        while (Wevtapi.INSTANCE.EvtNext(queryHandle, eventArraySize, eventArray, evtNextTimeout, 0, returned)) {
            Memory buff;
            IntByReference propertyCount = new IntByReference();
            Winevt.EVT_VARIANT evtVariant = new Winevt.EVT_VARIANT();
            for (int i = 0; i < returned.getValue(); i++) {
                read++;
                buff = WevtapiUtil.EvtRender(contextHandle, eventArray[i], Winevt.EVT_RENDER_FLAGS.EvtRenderEventValues, propertyCount);
                assertThat("PropertyCount", propertyCount.getValue(), is(2));
                useMemory(evtVariant, buff, 0);
                assertThat("Binary", (byte[]) evtVariant.getValue(), is(new byte[] { (byte) 0xD9, (byte) 0x06, 0, 0 }));
                useMemory(evtVariant, buff, 1);
                assertThat("Correlation", evtVariant.getValue(), nullValue());
            }
        }
        assertThat(read, is(1));
    } finally {
        // test EvtClose
        if (queryHandle != null) {
            Wevtapi.INSTANCE.EvtClose(queryHandle);
        }
        if (contextHandle != null) {
            Wevtapi.INSTANCE.EvtClose(contextHandle);
        }
    }
    // =========== Test accessing GUID + SID data ================
    queryHandle = null;
    contextHandle = null;
    testEvtx = new File(getClass().getResource("/res/WevtapiTest.sample3.evtx").toURI());
    try {
        queryHandle = Wevtapi.INSTANCE.EvtQuery(null, testEvtx.getPath(), null, Winevt.EVT_QUERY_FLAGS.EvtQueryFilePath);
        String[] targets = { "Event/System/Security/@UserID", "Event/System/Provider/@Guid" };
        contextHandle = Wevtapi.INSTANCE.EvtCreateRenderContext(targets.length, targets, Winevt.EVT_RENDER_CONTEXT_FLAGS.EvtRenderContextValues);
        int read = 0;
        int eventArraySize = 1;
        int evtNextTimeout = 1000;
        EVT_HANDLE[] eventArray = new EVT_HANDLE[eventArraySize];
        IntByReference returned = new IntByReference();
        while (Wevtapi.INSTANCE.EvtNext(queryHandle, eventArraySize, eventArray, evtNextTimeout, 0, returned)) {
            Memory buff;
            IntByReference propertyCount = new IntByReference();
            Winevt.EVT_VARIANT evtVariant = new Winevt.EVT_VARIANT();
            for (int i = 0; i < returned.getValue(); i++) {
                read++;
                buff = WevtapiUtil.EvtRender(contextHandle, eventArray[i], Winevt.EVT_RENDER_FLAGS.EvtRenderEventValues, propertyCount);
                assertThat("PropertyCount", propertyCount.getValue(), is(2));
                useMemory(evtVariant, buff, 0);
                assertThat("Security#UserID", ((WinNT.PSID) evtVariant.getValue()).getSidString(), is("S-1-5-21-3178902164-3053647283-518304804-1001"));
                useMemory(evtVariant, buff, 1);
                assertThat("Provider#GUID", ((Guid.GUID) evtVariant.getValue()).toGuidString(), is("{B0AA8734-56F7-41CC-B2F4-DE228E98B946}"));
            }
        }
        assertThat(read, is(1));
    } finally {
        // test EvtClose
        if (queryHandle != null) {
            Wevtapi.INSTANCE.EvtClose(queryHandle);
        }
        if (contextHandle != null) {
            Wevtapi.INSTANCE.EvtClose(contextHandle);
        }
    }
}
Also used : IntByReference(com.sun.jna.ptr.IntByReference) Memory(com.sun.jna.Memory) Date(java.util.Date) EVT_HANDLE(com.sun.jna.platform.win32.Winevt.EVT_HANDLE) File(java.io.File) SimpleDateFormat(java.text.SimpleDateFormat)

Example 2 with GUID

use of com.sun.jna.platform.win32.Guid.GUID in project jna by java-native-access.

the class Netapi32UtilTest method main.

public static void main(String[] args) {
    junit.textui.TestRunner.run(Netapi32UtilTest.class);
    System.out.println("Domain: " + Netapi32Util.getDomainName("localhost"));
    // server local groups
    Netapi32Util.LocalGroup[] localGroups = Netapi32Util.getLocalGroups();
    System.out.println("Local groups: " + localGroups.length);
    for (Netapi32Util.LocalGroup localGroup : localGroups) {
        System.out.println(" " + localGroup.name + " (" + localGroup.comment + ")");
    }
    // global groups
    Netapi32Util.Group[] groups = Netapi32Util.getGlobalGroups();
    System.out.println("Global groups: " + groups.length);
    for (Netapi32Util.Group group : groups) {
        System.out.println(" " + group.name);
    }
    // server users
    Netapi32Util.User[] users = Netapi32Util.getUsers();
    System.out.println("Users: " + users.length);
    for (Netapi32Util.User user : users) {
        System.out.println(" " + user.name);
    }
    // user local groups
    Netapi32Util.Group[] userLocalGroups = Netapi32Util.getCurrentUserLocalGroups();
    System.out.println("Local user groups: " + userLocalGroups.length);
    for (Netapi32Util.Group localGroup : userLocalGroups) {
        System.out.println(" " + localGroup.name);
    }
    // domain controller
    if (Netapi32Util.getJoinStatus() == LMJoin.NETSETUP_JOIN_STATUS.NetSetupDomainName) {
        System.out.println("Pdc: " + Netapi32Util.getDCName());
        DomainController dc = Netapi32Util.getDC();
        System.out.println("Domain controller:");
        System.out.println("    name: " + dc.name);
        System.out.println(" address: " + dc.address);
        System.out.println("  domain: " + dc.domainName);
        System.out.println("    site: " + dc.clientSiteName);
        System.out.println("  forest: " + dc.dnsForestName);
        System.out.println("    guid: " + Ole32Util.getStringFromGUID(dc.domainGuid));
    }
    // domain trusts
    if (Netapi32Util.getJoinStatus() == LMJoin.NETSETUP_JOIN_STATUS.NetSetupDomainName) {
        DomainTrust[] trusts = Netapi32Util.getDomainTrusts();
        System.out.println("Domain trusts: (" + trusts.length + ")");
        for (DomainTrust trust : trusts) {
            System.out.println(" " + trust.NetbiosDomainName + ": " + trust.DnsDomainName + " (" + trust.DomainSidString + ")");
        }
    }
}
Also used : DomainController(com.sun.jna.platform.win32.Netapi32Util.DomainController) DomainTrust(com.sun.jna.platform.win32.Netapi32Util.DomainTrust)

Example 3 with GUID

use of com.sun.jna.platform.win32.Guid.GUID in project jna by java-native-access.

the class Ole32Test method testCoCreateGUID.

public void testCoCreateGUID() {
    GUID pguid = new GUID();
    assertEquals(W32Errors.S_OK, Ole32.INSTANCE.CoCreateGuid(pguid));
    assertTrue(pguid.Data1 != 0 || pguid.Data2 != 0 || pguid.Data3 != 0 && pguid.Data4 != null);
}
Also used : GUID(com.sun.jna.platform.win32.Guid.GUID)

Example 4 with GUID

use of com.sun.jna.platform.win32.Guid.GUID in project jna by java-native-access.

the class Ole32UtilTest method testGenerateGUID.

public void testGenerateGUID() {
    GUID guid1 = Ole32Util.generateGUID();
    GUID guid2 = Ole32Util.generateGUID();
    assertTrue(guid1 != guid2);
    assertTrue(Ole32Util.getStringFromGUID(guid1) != Ole32Util.getStringFromGUID(guid2));
}
Also used : GUID(com.sun.jna.platform.win32.Guid.GUID)

Example 5 with GUID

use of com.sun.jna.platform.win32.Guid.GUID in project jna by java-native-access.

the class Ole32UtilTest method testGetGUIDToFromString.

public void testGetGUIDToFromString() {
    GUID guid = Ole32Util.generateGUID();
    assertEquals(guid, Ole32Util.getGUIDFromString(Ole32Util.getStringFromGUID(guid)));
}
Also used : GUID(com.sun.jna.platform.win32.Guid.GUID)

Aggregations

GUID (com.sun.jna.platform.win32.Guid.GUID)20 HRESULT (com.sun.jna.platform.win32.WinNT.HRESULT)10 PointerByReference (com.sun.jna.ptr.PointerByReference)7 COMException (com.sun.jna.platform.win32.COM.COMException)3 Dispatch (com.sun.jna.platform.win32.COM.Dispatch)2 IDispatch (com.sun.jna.platform.win32.COM.IDispatch)2 ComObject (com.sun.jna.platform.win32.COM.util.annotation.ComObject)2 WinNT (com.sun.jna.platform.win32.WinNT)2 HANDLE (com.sun.jna.platform.win32.WinNT.HANDLE)2 Memory (com.sun.jna.Memory)1 CLSID (com.sun.jna.platform.win32.Guid.CLSID)1 REFIID (com.sun.jna.platform.win32.Guid.REFIID)1 DomainController (com.sun.jna.platform.win32.Netapi32Util.DomainController)1 DomainTrust (com.sun.jna.platform.win32.Netapi32Util.DomainTrust)1 EVT_HANDLE (com.sun.jna.platform.win32.Winevt.EVT_HANDLE)1 IntByReference (com.sun.jna.ptr.IntByReference)1 File (java.io.File)1 SimpleDateFormat (java.text.SimpleDateFormat)1 Date (java.util.Date)1