wmidump

Parse and display ACPI WMI (Windows Management Instrumentation) GUID data blocks from _WDG buffers found in DSDT/SSDT tables.

Building

make

Or directly:

gcc wmidump.c -std=gnu99 -o wmidump

Usage

wmidump

Find the _WDG method of your WMI device in your decompiled DSDT (e.g. via iasl -d dsdt.dat) and copy the content of the buffer into a file:

Name (_WDG, Buffer (0x50)
{
    /* 0000 */  0xD0, 0x5E, 0x84, 0x97, 0x6D, 0x4E, 0xDE, 0x11,
    /* 0008 */  0x8A, 0x39, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66,
    /* 0010 */  0x42, 0x43, 0x01, 0x02, 0xA0, 0x47, 0x67, 0x46,
    /* 0018 */  0xEC, 0x70, 0xDE, 0x11, 0x8A, 0x39, 0x08, 0x00,
    /* 0020 */  0x20, 0x0C, 0x9A, 0x66, 0x42, 0x44, 0x01, 0x02,
    /* 0028 */  0x72, 0x0F, 0xBC, 0xAB, 0xA1, 0x8E, 0xD1, 0x11,
    /* 0030 */  0x00, 0xA0, 0xC9, 0x06, 0x29, 0x10, 0x00, 0x00,
    /* 0038 */  0xD2, 0x00, 0x01, 0x08, 0x21, 0x12, 0x90, 0x05,
    /* 0040 */  0x66, 0xD5, 0xD1, 0x11, 0xB2, 0xF0, 0x00, 0xA0,
    /* 0048 */  0xC9, 0x06, 0x29, 0x10, 0x4D, 0x4F, 0x01, 0x00
})

Then pipe the file into wmidump:

$ ./wmidump < wdg
97845ED0-4E6D-11DE-8A39-0800200C9A66:
	object_id: BC
	instance_count: 1
	flags: 0x2 ACPI_WMI_METHOD
466747A0-70EC-11DE-8A39-0800200C9A66:
	object_id: BD
	instance_count: 1
	flags: 0x2 ACPI_WMI_METHOD
ABBC0F72-8EA1-11D1-00A0-C90629100000:
	notify_id: 0xD2
	instance_count: 1
	flags: 0x8 ACPI_WMI_EVENT
05901221-D566-11D1-B2F0-00A0C9062910:
	object_id: MO
	instance_count: 1
	flags: 0

wmixtract.py

Extract _WDG and WQXX buffers from a decompiled DSDT .dsl file. The resulting _WDG files can be parsed directly with wmidump. WQXX buffers contain compiled MOF (Managed Object Format) and can be decompiled using wmimofck.exe from the Windows Driver Kit (WDK).

$ python3 wmixtract.py DSDT.dsl

References

• Using Wmimofck.exe
• Windows Instrumentation: WMI and ACPI

License

This project is licensed under the GNU General Public License v2.0 - see the LICENSE file for details.