code例如以下：

#include "stdafx.h"

#include <objbase.h>

#include <windows.h>

#include <stdio.h>

#include <wbemidl.h>

#include <comdef.h>

#pragma comment(lib, "wbemuuid.lib")

#pragma comment(lib, "comsuppw.lib")

int _tmain(int argc, _TCHAR* argv[])

{

    IWbemLocator 	* pLocator = NULL;

    IWbemServices 	* pNamespace = 0;

    IWbemClassObject * pClass = NULL;

    IWbemClassObject * pInClass = NULL;

    IWbemClassObject * pInInst = NULL;

	IEnumWbemClassObject *pEnum = NULL;

	HRESULT hr = S_OK;

    BSTR path = SysAllocString(L"root\\wmi");

    BSTR ClassPath = SysAllocString(L"WmiMonitorBrightnessMethods");

    BSTR MethodName = SysAllocString(L"WmiSetBrightness");

    BSTR ArgName0 = SysAllocString(L"Timeout");

	BSTR ArgName1 = SysAllocString(L"Brightness");

	BSTR bstrQuery = SysAllocString(L"Select * from WmiMonitorBrightnessMethods");

	if (!path || ! ClassPath || !MethodName || ! ArgName0)

	{

		printf("SysAllocString failed. Out of memory.\n");

		{printf("\n[-] Err: xxx");goto cleanup;}

	}

    // Initialize COM and connect up to CIMOM

    hr = CoInitialize(0);

	if (FAILED(hr))

	{

		printf("CoInitialize returned 0x%x:", hr);

		{printf("\n[-] Err: CoInitialize");goto cleanup;}

	}

	//  NOTE:

	//  When using asynchronous WMI API's remotely in an environment where the "Local System" account

	//  has no network identity (such as non-Kerberos domains), the authentication level of

	//  RPC_C_AUTHN_LEVEL_NONE is needed. However, lowering the authentication level to

	//  RPC_C_AUTHN_LEVEL_NONE makes your application less secure. It is wise to

	// use semi-synchronous API's for accessing WMI data and events instead of the asynchronous ones.

    hr = CoInitializeSecurity(NULL,

							-1,

							NULL,

							NULL,

							RPC_C_AUTHN_LEVEL_DEFAULT,

							RPC_C_IMP_LEVEL_IMPERSONATE,

							NULL,

							EOAC_NONE, //change to EOAC_NONE if you change dwAuthnLevel to RPC_C_AUTHN_LEVEL_NONE

							NULL );

	if (FAILED(hr))

	{

		printf("CoInitializeSecurity returned 0x%x:", hr);

		{printf("\n[-] Err: CoInitializeSecurity");goto cleanup;}

	}

    hr = CoCreateInstance(CLSID_WbemLocator,

						0,

						CLSCTX_INPROC_SERVER,

						IID_IWbemLocator,

						(LPVOID *) &pLocator);

	if (FAILED(hr))

	{

		printf("CoCreateInstance returned 0x%x:", hr);

		{printf("\n[-] Err: CoCreateInstance");goto cleanup;}

	}

    hr = pLocator->ConnectServer(path,

								NULL,

								NULL,

								NULL,

								0,

								NULL,

								NULL,

								&pNamespace);

    printf("\nConnectServer returned 0x%x:", hr);

    if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: ConnectServer");goto cleanup;}

	hr = CoSetProxyBlanket(pNamespace,

						RPC_C_AUTHN_WINNT,

						RPC_C_AUTHZ_NONE,

						NULL,

						RPC_C_AUTHN_LEVEL_CALL,

						RPC_C_IMP_LEVEL_IMPERSONATE,

						NULL,

						EOAC_NONE);

    if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: CoSetProxyBlanket");goto cleanup;}

	hr =pNamespace->ExecQuery(_bstr_t(L"WQL"), //Query Language

							bstrQuery, //Query to Execute

							WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, //Make a semi-synchronous call

							NULL, //Context

							&pEnum /*Enumeration Interface*/);

   if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: ExecQuery");goto cleanup;}

	hr = WBEM_S_NO_ERROR;

	ULONG ulReturned;

	IWbemClassObject *pObj;

	DWORD retVal = 0;

	//Get the Next Object from the collection

	hr = pEnum->Next(WBEM_INFINITE, //Timeout

					1, //No of objects requested

					&pObj, //Returned Object

					&ulReturned /*No of object returned*/);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: Next");goto cleanup;}

	// Get the class object

	hr = pNamespace->GetObject(ClassPath, 0, NULL, &pClass, NULL);

	printf("\nGetObject returned 0x%x:", hr);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: GetObject");goto cleanup;}

	// Get the input argument and set the property

	hr = pClass->GetMethod(MethodName, 0, &pInClass, NULL);

	printf("\nGetMethod returned 0x%x:", hr);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: GetMethod");goto cleanup;}

	hr = pInClass->SpawnInstance(0, &pInInst);

	printf("\nSpawnInstance returned 0x%x:", hr);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: SpawnInstance");goto cleanup;}

	VARIANT var1;

	VariantInit(&var1);

	V_VT(&var1) = VT_BSTR;

	V_BSTR(&var1) = SysAllocString(L"0");

	hr = pInInst->Put(ArgName0,

					0,

					&var1,

					CIM_UINT32); //CIM_UINT64

	//var1.vt = VT_I4;

	//var1.ullVal = 0;

	//hr = pInInst->Put(ArgName0, 0, &var1, 0);

	printf("\nPut ArgName0 returned 0x%x:", hr);

	VariantClear(&var1);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: Put ArgName0");goto cleanup;}

	VARIANT var;

	VariantInit(&var);

	V_VT(&var) = VT_BSTR;

	V_BSTR(&var) = SysAllocString(L"100");

	hr = pInInst->Put(ArgName1,

					0,

					&var,

					CIM_UINT8); 

	//var.vt=VT_UI1;

	//var.uiVal = 100;

	//hr = pInInst->Put(ArgName1, 0, &var, 0);

	VariantClear(&var);

	printf("\nPut ArgName1 returned 0x%x:", hr);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: Put ArgName1");goto cleanup;}

	// Call the method

	VARIANT pathVariable;

	VariantInit(&pathVariable);

	hr = pObj->Get(_bstr_t(L"__PATH"),

				0,

				&pathVariable,

				NULL,

				NULL);

	printf("\npObj Get returned 0x%x:", hr);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: Get");goto cleanup;}

	hr =pNamespace->ExecMethod(pathVariable.bstrVal,

							MethodName,

							0,

							NULL,

							pInInst,

							NULL,

							NULL);

	VariantClear(&pathVariable);

	printf("\nExecMethod returned 0x%x:", hr);

	if(hr != WBEM_S_NO_ERROR)

		{printf("\n[-] Err: ExecMethod");goto cleanup;}

	printf("Terminating normally\n");

// Free up resources

cleanup:

    SysFreeString(path);

    SysFreeString(ClassPath);

    SysFreeString(MethodName);

    SysFreeString(ArgName0);

	SysFreeString(ArgName1);

	SysFreeString(bstrQuery);

	if (pClass)	pClass->Release();

	if (pInInst) pInInst->Release();

	if (pInClass) pInClass->Release();

	if (pLocator) pLocator->Release();

	if (pNamespace) pNamespace->Release();

    CoUninitialize();

	return 0;

}