How are WMI instance IDs guaranteed to be unique?

  • Article

This is related to today's previous topic of how the manager makes device interface GUIDs unique.  Let's now look at how the kernel implementation of WMI (or IRP_MJ_SYSTEM_CONTROL if you are dealing with PIRPs or WBEM to you user mode folks) works.  When you register an instance of a WMI provider, the instance must have a unique identifier, just like its device interface cousin.  A driver writer has two (actually it is more subtle then 2, but that is a topic for another day) choices in how it will identify the instance.

  • the driver must create a string that is unique in the system...not a trivial task!
  • the driver allows the kernel WMI provider to assign an instance ID

How to create a unique string is another topic left for another day.  So, how does the kernel assign your instance a unique ID?  It also uses the device instance path (which is why i consider a WMI instance and the device interface cousins).  To tell the kernel that you want it to create you a unique ID based on the instance, you specify WMIREG_FLAG_INSTANCE_PDO during WMI registration. 

That's it, plain and simple...but let's look a little further.  The kernel never actually gives the driver the unique ID, but we can find it in user mode.  I have a WMI unit test driver for KMDF which dynamically creates and destroys instances at runtime.  The device which creates the instance has the folliwing instance path

DevNode 0x81a483e0 for PDO 0x818f6678
InstancePath is "ROOT\SYSTEM\0004"
ServiceName is "WmiUnitTest"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)

and if we look at an instance it created, it has this ID, ROOT\SYSTEM\0004_0. If we break down the instance ID we see that it is <instance path> + <extra stuff>. Unlike a device interface where the GUID is a part of the ID, the provider GUID is not a part of the instance ID for a WMI instance. If you took the experiment further, you would see that you would have a similar WMI instance ID if you registered an instance on a different provider GUID. 

Disclaimer:  the OS implementation of how it generates can change from release to release you should never ever hardcode the WMI instance ID if the driver is letting the kernel generate an ID.