deadbyte-mcp 0.15.21 → 0.15.22

package/native/deadbyte-hardware-observer.cpp

@@ -12,12 +12,15 @@
 #include <cstring>
 #include <iostream>
 #include <sstream>
+#include <stdexcept>
 #include <string>
 #include <vector>
 
+#pragma comment(lib, "advapi32.lib")
 #pragma comment(lib, "iphlpapi.lib")
 #pragma comment(lib, "setupapi.lib")
 #pragma comment(lib, "user32.lib")
+#pragma comment(lib, "ws2_32.lib")
 
 static std::string utf8(const wchar_t* text) {
     if (!text || !*text) return {};
@@ -62,6 +65,12 @@ static std::string trim_ascii(std::string value) {
     return value.substr(first);
 }
 
+static std::string win32_error(const char* operation, DWORD code = GetLastError()) {
+    std::ostringstream out;
+    out << operation << " failed win32=" << code;
+    return out.str();
+}
+
 static std::string cpu_json() {
     int regs[4] = {};
     __cpuid(regs, 0);
@@ -86,8 +95,8 @@ static std::string cpu_json() {
         __cpuid(regs, 1);
         const unsigned int eax = static_cast<unsigned int>(regs[0]);
         stepping = eax & 0x0fU;
-        unsigned int base_model = (eax >> 4U) & 0x0fU;
-        unsigned int base_family = (eax >> 8U) & 0x0fU;
+        const unsigned int base_model = (eax >> 4U) & 0x0fU;
+        const unsigned int base_family = (eax >> 8U) & 0x0fU;
         const unsigned int ext_model = (eax >> 16U) & 0x0fU;
         const unsigned int ext_family = (eax >> 20U) & 0xffU;
         family = base_family == 0x0fU ? base_family + ext_family : base_family;
@@ -230,7 +239,7 @@ static std::string get_device_property(HDEVINFO info, SP_DEVINFO_DATA& data, DWO
     DWORD type = 0, required = 0;
     SetupDiGetDeviceRegistryPropertyW(info, &data, property, &type, nullptr, 0, &required);
     if (required == 0) return {};
-    std::vector<BYTE> bytes(required + sizeof(wchar_t), 0);
+    std::vector<BYTE> bytes(static_cast<size_t>(required) + sizeof(wchar_t), 0);
     if (!SetupDiGetDeviceRegistryPropertyW(info, &data, property, &type, bytes.data(), static_cast<DWORD>(bytes.size()), nullptr)) return {};
     return utf8(reinterpret_cast<const wchar_t*>(bytes.data()));
 }
@@ -244,9 +253,9 @@ static std::string get_instance_id(HDEVINFO info, SP_DEVINFO_DATA& data) {
     return utf8(buffer.data());
 }
 
-static std::string pci_json() {
-    HDEVINFO info = SetupDiGetClassDevsW(nullptr, L"PCI", nullptr, DIGCF_ALLCLASSES | DIGCF_PRESENT);
-    if (info == INVALID_HANDLE_VALUE) throw std::runtime_error("SetupDiGetClassDevsW PCI failed");
+static std::string bus_json(const wchar_t* enumerator) {
+    HDEVINFO info = SetupDiGetClassDevsW(nullptr, enumerator, nullptr, DIGCF_ALLCLASSES | DIGCF_PRESENT);
+    if (info == INVALID_HANDLE_VALUE) throw std::runtime_error("SetupDiGetClassDevsW failed");
 
     std::ostringstream out;
     out << "{\"devices\":[";
@@ -275,7 +284,479 @@ static std::string pci_json() {
     return out.str();
 }
 
-static std::string build_data(const std::string& query) {
+static std::string pci_json() {
+    return bus_json(L"PCI");
+}
+
+static std::string usb_json() {
+    return bus_json(L"USB");
+}
+
+static std::string service_state_name(DWORD state) {
+    switch (state) {
+        case SERVICE_STOPPED: return "stopped";
+        case SERVICE_START_PENDING: return "start_pending";
+        case SERVICE_STOP_PENDING: return "stop_pending";
+        case SERVICE_RUNNING: return "running";
+        case SERVICE_CONTINUE_PENDING: return "continue_pending";
+        case SERVICE_PAUSE_PENDING: return "pause_pending";
+        case SERVICE_PAUSED: return "paused";
+        default: return "unknown";
+    }
+}
+
+static std::string services_json(DWORD service_type, const char* array_name) {
+    SC_HANDLE scm = OpenSCManagerW(nullptr, nullptr, SC_MANAGER_ENUMERATE_SERVICE);
+    if (!scm) throw std::runtime_error(win32_error("OpenSCManagerW"));
+
+    DWORD bytes_needed = 0;
+    DWORD count = 0;
+    DWORD resume = 0;
+    EnumServicesStatusExW(scm, SC_ENUM_PROCESS_INFO, service_type, SERVICE_STATE_ALL, nullptr, 0,
+        &bytes_needed, &count, &resume, nullptr);
+    const DWORD first_error = GetLastError();
+    if (bytes_needed == 0 && first_error != ERROR_MORE_DATA) {
+        CloseServiceHandle(scm);
+        if (first_error == ERROR_SUCCESS) return std::string("{\"") + array_name + "\":[]}";
+        throw std::runtime_error(win32_error("EnumServicesStatusExW(size)", first_error));
+    }
+
+    std::vector<BYTE> buffer(bytes_needed);
+    resume = 0;
+    if (!EnumServicesStatusExW(scm, SC_ENUM_PROCESS_INFO, service_type, SERVICE_STATE_ALL, buffer.data(),
+        static_cast<DWORD>(buffer.size()), &bytes_needed, &count, &resume, nullptr)) {
+        const DWORD error = GetLastError();
+        CloseServiceHandle(scm);
+        throw std::runtime_error(win32_error("EnumServicesStatusExW", error));
+    }
+    const auto* rows = reinterpret_cast<const ENUM_SERVICE_STATUS_PROCESSW*>(buffer.data());
+
+    std::ostringstream out;
+    out << "{\"" << array_name << "\":[";
+    for (DWORD index = 0; index < count; ++index) {
+        if (index) out << ',';
+        const auto& row = rows[index];
+        out << "{\"name\":" << quote(utf8(row.lpServiceName))
+            << ",\"display_name\":" << quote(utf8(row.lpDisplayName))
+            << ",\"service_type\":" << row.ServiceStatusProcess.dwServiceType
+            << ",\"state\":" << quote(service_state_name(row.ServiceStatusProcess.dwCurrentState))
+            << ",\"state_code\":" << row.ServiceStatusProcess.dwCurrentState
+            << ",\"process_id\":" << row.ServiceStatusProcess.dwProcessId
+            << ",\"controls_accepted\":" << row.ServiceStatusProcess.dwControlsAccepted
+            << ",\"win32_exit_code\":" << row.ServiceStatusProcess.dwWin32ExitCode
+            << ",\"service_specific_exit_code\":" << row.ServiceStatusProcess.dwServiceSpecificExitCode
+            << "}";
+    }
+    out << "]}";
+    CloseServiceHandle(scm);
+    return out.str();
+}
+
+static std::string ipv4_text(DWORD address) {
+    IN_ADDR addr{};
+    addr.S_un.S_addr = address;
+    char buffer[INET_ADDRSTRLEN] = {};
+    if (!InetNtopA(AF_INET, &addr, buffer, static_cast<DWORD>(sizeof(buffer)))) return {};
+    return buffer;
+}
+
+static std::string ipv6_text(const UCHAR* address) {
+    char buffer[INET6_ADDRSTRLEN] = {};
+    if (!InetNtopA(AF_INET6, const_cast<UCHAR*>(address), buffer, static_cast<DWORD>(sizeof(buffer)))) return {};
+    return buffer;
+}
+
+static unsigned short port_host(DWORD value) {
+    return ntohs(static_cast<unsigned short>(value & 0xffffU));
+}
+
+static void append_tcp4(std::ostringstream& out, bool& first) {
+    DWORD size = 0;
+    DWORD rc = GetExtendedTcpTable(nullptr, &size, FALSE, AF_INET, TCP_TABLE_OWNER_PID_ALL, 0);
+    if (rc != ERROR_INSUFFICIENT_BUFFER) {
+        if (rc == NO_ERROR) return;
+        throw std::runtime_error("GetExtendedTcpTable IPv4 size failed");
+    }
+    std::vector<BYTE> buffer(size);
+    rc = GetExtendedTcpTable(buffer.data(), &size, FALSE, AF_INET, TCP_TABLE_OWNER_PID_ALL, 0);
+    if (rc != NO_ERROR) throw std::runtime_error("GetExtendedTcpTable IPv4 failed");
+    const auto* table = reinterpret_cast<const MIB_TCPTABLE_OWNER_PID*>(buffer.data());
+    for (DWORD index = 0; index < table->dwNumEntries; ++index) {
+        const auto& row = table->table[index];
+        if (!first) out << ',';
+        first = false;
+        out << "{\"protocol\":\"tcp\",\"family\":\"ipv4\",\"local_address\":" << quote(ipv4_text(row.dwLocalAddr))
+            << ",\"local_port\":" << port_host(row.dwLocalPort)
+            << ",\"remote_address\":" << quote(ipv4_text(row.dwRemoteAddr))
+            << ",\"remote_port\":" << port_host(row.dwRemotePort)
+            << ",\"state\":" << row.dwState
+            << ",\"pid\":" << row.dwOwningPid
+            << "}";
+    }
+}
+
+static void append_tcp6(std::ostringstream& out, bool& first) {
+    DWORD size = 0;
+    DWORD rc = GetExtendedTcpTable(nullptr, &size, FALSE, AF_INET6, TCP_TABLE_OWNER_PID_ALL, 0);
+    if (rc != ERROR_INSUFFICIENT_BUFFER) {
+        if (rc == NO_ERROR) return;
+        throw std::runtime_error("GetExtendedTcpTable IPv6 size failed");
+    }
+    std::vector<BYTE> buffer(size);
+    rc = GetExtendedTcpTable(buffer.data(), &size, FALSE, AF_INET6, TCP_TABLE_OWNER_PID_ALL, 0);
+    if (rc != NO_ERROR) throw std::runtime_error("GetExtendedTcpTable IPv6 failed");
+    const auto* table = reinterpret_cast<const MIB_TCP6TABLE_OWNER_PID*>(buffer.data());
+    for (DWORD index = 0; index < table->dwNumEntries; ++index) {
+        const auto& row = table->table[index];
+        if (!first) out << ',';
+        first = false;
+        out << "{\"protocol\":\"tcp\",\"family\":\"ipv6\",\"local_address\":" << quote(ipv6_text(row.ucLocalAddr))
+            << ",\"local_scope_id\":" << row.dwLocalScopeId
+            << ",\"local_port\":" << port_host(row.dwLocalPort)
+            << ",\"remote_address\":" << quote(ipv6_text(row.ucRemoteAddr))
+            << ",\"remote_scope_id\":" << row.dwRemoteScopeId
+            << ",\"remote_port\":" << port_host(row.dwRemotePort)
+            << ",\"state\":" << row.dwState
+            << ",\"pid\":" << row.dwOwningPid
+            << "}";
+    }
+}
+
+static void append_udp4(std::ostringstream& out, bool& first) {
+    DWORD size = 0;
+    DWORD rc = GetExtendedUdpTable(nullptr, &size, FALSE, AF_INET, UDP_TABLE_OWNER_PID, 0);
+    if (rc != ERROR_INSUFFICIENT_BUFFER) {
+        if (rc == NO_ERROR) return;
+        throw std::runtime_error("GetExtendedUdpTable IPv4 size failed");
+    }
+    std::vector<BYTE> buffer(size);
+    rc = GetExtendedUdpTable(buffer.data(), &size, FALSE, AF_INET, UDP_TABLE_OWNER_PID, 0);
+    if (rc != NO_ERROR) throw std::runtime_error("GetExtendedUdpTable IPv4 failed");
+    const auto* table = reinterpret_cast<const MIB_UDPTABLE_OWNER_PID*>(buffer.data());
+    for (DWORD index = 0; index < table->dwNumEntries; ++index) {
+        const auto& row = table->table[index];
+        if (!first) out << ',';
+        first = false;
+        out << "{\"protocol\":\"udp\",\"family\":\"ipv4\",\"local_address\":" << quote(ipv4_text(row.dwLocalAddr))
+            << ",\"local_port\":" << port_host(row.dwLocalPort)
+            << ",\"pid\":" << row.dwOwningPid
+            << "}";
+    }
+}
+
+static void append_udp6(std::ostringstream& out, bool& first) {
+    DWORD size = 0;
+    DWORD rc = GetExtendedUdpTable(nullptr, &size, FALSE, AF_INET6, UDP_TABLE_OWNER_PID, 0);
+    if (rc != ERROR_INSUFFICIENT_BUFFER) {
+        if (rc == NO_ERROR) return;
+        throw std::runtime_error("GetExtendedUdpTable IPv6 size failed");
+    }
+    std::vector<BYTE> buffer(size);
+    rc = GetExtendedUdpTable(buffer.data(), &size, FALSE, AF_INET6, UDP_TABLE_OWNER_PID, 0);
+    if (rc != NO_ERROR) throw std::runtime_error("GetExtendedUdpTable IPv6 failed");
+    const auto* table = reinterpret_cast<const MIB_UDP6TABLE_OWNER_PID*>(buffer.data());
+    for (DWORD index = 0; index < table->dwNumEntries; ++index) {
+        const auto& row = table->table[index];
+        if (!first) out << ',';
+        first = false;
+        out << "{\"protocol\":\"udp\",\"family\":\"ipv6\",\"local_address\":" << quote(ipv6_text(row.ucLocalAddr))
+            << ",\"local_scope_id\":" << row.dwLocalScopeId
+            << ",\"local_port\":" << port_host(row.dwLocalPort)
+            << ",\"pid\":" << row.dwOwningPid
+            << "}";
+    }
+}
+
+static std::string sockets_json() {
+    WSADATA wsa{};
+    if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) throw std::runtime_error("WSAStartup failed");
+    try {
+        std::ostringstream out;
+        out << "{\"sockets\":[";
+        bool first = true;
+        append_tcp4(out, first);
+        append_tcp6(out, first);
+        append_udp4(out, first);
+        append_udp6(out, first);
+        out << "]}";
+        WSACleanup();
+        return out.str();
+    } catch (...) {
+        WSACleanup();
+        throw;
+    }
+}
+
+static std::vector<std::string> volume_paths(const wchar_t* volume_name) {
+    DWORD needed = 0;
+    GetVolumePathNamesForVolumeNameW(volume_name, nullptr, 0, &needed);
+    if (needed == 0) return {};
+    std::vector<wchar_t> buffer(static_cast<size_t>(needed) + 1U, L'\0');
+    if (!GetVolumePathNamesForVolumeNameW(volume_name, buffer.data(), static_cast<DWORD>(buffer.size()), &needed)) return {};
+    std::vector<std::string> paths;
+    for (const wchar_t* item = buffer.data(); *item; item += wcslen(item) + 1U) paths.push_back(utf8(item));
+    return paths;
+}
+
+static std::string volumes_json() {
+    std::array<wchar_t, MAX_PATH + 1> volume{};
+    HANDLE find = FindFirstVolumeW(volume.data(), static_cast<DWORD>(volume.size()));
+    if (find == INVALID_HANDLE_VALUE) throw std::runtime_error(win32_error("FindFirstVolumeW"));
+
+    std::ostringstream out;
+    out << "{\"volumes\":[";
+    bool first = true;
+    for (;;) {
+        wchar_t label[MAX_PATH + 1] = {};
+        wchar_t filesystem[MAX_PATH + 1] = {};
+        DWORD serial = 0, max_component = 0, flags = 0;
+        const BOOL volume_ok = GetVolumeInformationW(volume.data(), label, MAX_PATH, &serial, &max_component, &flags, filesystem, MAX_PATH);
+        ULARGE_INTEGER available{}, total{}, free_bytes{};
+        const BOOL space_ok = GetDiskFreeSpaceExW(volume.data(), &available, &total, &free_bytes);
+        const auto paths = volume_paths(volume.data());
+        if (!first) out << ',';
+        first = false;
+        out << "{\"volume_name\":" << quote(utf8(volume.data()))
+            << ",\"label\":" << quote(volume_ok ? utf8(label) : std::string())
+            << ",\"filesystem\":" << quote(volume_ok ? utf8(filesystem) : std::string())
+            << ",\"serial\":" << (volume_ok ? serial : 0U)
+            << ",\"flags\":" << (volume_ok ? flags : 0U)
+            << ",\"total_bytes\":" << (space_ok ? total.QuadPart : 0ULL)
+            << ",\"free_bytes\":" << (space_ok ? free_bytes.QuadPart : 0ULL)
+            << ",\"available_bytes\":" << (space_ok ? available.QuadPart : 0ULL)
+            << ",\"paths\":[";
+        for (size_t index = 0; index < paths.size(); ++index) {
+            if (index) out << ',';
+            out << quote(paths[index]);
+        }
+        out << "]}";
+
+        if (FindNextVolumeW(find, volume.data(), static_cast<DWORD>(volume.size()))) continue;
+        const DWORD error = GetLastError();
+        FindVolumeClose(find);
+        if (error != ERROR_NO_MORE_FILES) throw std::runtime_error(win32_error("FindNextVolumeW", error));
+        break;
+    }
+    out << "]}";
+    return out.str();
+}
+
+static HKEY hive_from_name(const std::wstring& hive) {
+    if (hive == L"HKLM") return HKEY_LOCAL_MACHINE;
+    if (hive == L"HKCU") return HKEY_CURRENT_USER;
+    throw std::runtime_error("registry hive must be HKLM or HKCU");
+}
+
+static std::string registry_type_name(DWORD type) {
+    switch (type) {
+        case REG_NONE: return "REG_NONE";
+        case REG_SZ: return "REG_SZ";
+        case REG_EXPAND_SZ: return "REG_EXPAND_SZ";
+        case REG_BINARY: return "REG_BINARY";
+        case REG_DWORD: return "REG_DWORD";
+        case REG_MULTI_SZ: return "REG_MULTI_SZ";
+        case REG_QWORD: return "REG_QWORD";
+        default: return "REG_OTHER";
+    }
+}
+
+static std::string bytes_hex(const BYTE* data, DWORD size, DWORD limit = 4096) {
+    static const char hex[] = "0123456789abcdef";
+    const DWORD bounded = (std::min)(size, limit);
+    std::string out;
+    out.reserve(static_cast<size_t>(bounded) * 2U);
+    for (DWORD i = 0; i < bounded; ++i) {
+        out.push_back(hex[(data[i] >> 4U) & 0x0fU]);
+        out.push_back(hex[data[i] & 0x0fU]);
+    }
+    return out;
+}
+
+static std::string registry_data_json(DWORD type, const BYTE* data, DWORD size) {
+    if ((type == REG_SZ || type == REG_EXPAND_SZ) && size >= sizeof(wchar_t)) {
+        return quote(utf8(reinterpret_cast<const wchar_t*>(data)));
+    }
+    if (type == REG_DWORD && size >= sizeof(DWORD)) {
+        DWORD value = 0;
+        std::memcpy(&value, data, sizeof(value));
+        return std::to_string(value);
+    }
+    if (type == REG_QWORD && size >= sizeof(ULONGLONG)) {
+        ULONGLONG value = 0;
+        std::memcpy(&value, data, sizeof(value));
+        return quote(std::to_string(value));
+    }
+    if (type == REG_MULTI_SZ && size >= sizeof(wchar_t)) {
+        const wchar_t* cursor = reinterpret_cast<const wchar_t*>(data);
+        const wchar_t* end = reinterpret_cast<const wchar_t*>(data + size);
+        std::ostringstream out;
+        out << '[';
+        bool first = true;
+        while (cursor < end && *cursor) {
+            if (!first) out << ',';
+            first = false;
+            out << quote(utf8(cursor));
+            cursor += wcslen(cursor) + 1U;
+        }
+        out << ']';
+        return out.str();
+    }
+    return quote(bytes_hex(data, size));
+}
+
+static std::string registry_value_json(HKEY key, const std::wstring& value_name) {
+    DWORD type = 0;
+    DWORD size = 0;
+    const wchar_t* name = value_name.empty() ? L"" : value_name.c_str();
+    LONG rc = RegQueryValueExW(key, name, nullptr, &type, nullptr, &size);
+    if (rc != ERROR_SUCCESS) throw std::runtime_error(win32_error("RegQueryValueExW(size)", static_cast<DWORD>(rc)));
+    if (size > 1024U * 1024U) throw std::runtime_error("registry value exceeds 1 MiB bound");
+    std::vector<BYTE> data(static_cast<size_t>(size) + sizeof(wchar_t), 0);
+    rc = RegQueryValueExW(key, name, nullptr, &type, data.data(), &size);
+    if (rc != ERROR_SUCCESS) throw std::runtime_error(win32_error("RegQueryValueExW", static_cast<DWORD>(rc)));
+    std::ostringstream out;
+    out << "{\"name\":" << quote(utf8(name))
+        << ",\"type\":" << quote(registry_type_name(type))
+        << ",\"data\":" << registry_data_json(type, data.data(), size)
+        << "}";
+    return out.str();
+}
+
+static std::string registry_json(const std::wstring& hive_name, const std::wstring& key_name, const wchar_t* value_name) {
+    HKEY key = nullptr;
+    const LONG open_rc = RegOpenKeyExW(hive_from_name(hive_name), key_name.c_str(), 0, KEY_READ | KEY_WOW64_64KEY, &key);
+    if (open_rc != ERROR_SUCCESS) throw std::runtime_error(win32_error("RegOpenKeyExW", static_cast<DWORD>(open_rc)));
+
+    try {
+        std::ostringstream out;
+        out << "{\"hive\":" << quote(utf8(hive_name.c_str()))
+            << ",\"key\":" << quote(utf8(key_name.c_str()));
+        if (value_name != nullptr) {
+            out << ",\"value\":" << registry_value_json(key, value_name) << "}";
+            RegCloseKey(key);
+            return out.str();
+        }
+
+        out << ",\"subkeys\":[";
+        bool first = true;
+        for (DWORD index = 0; index < 1024U; ++index) {
+            std::array<wchar_t, 16384> name{};
+            DWORD chars = static_cast<DWORD>(name.size());
+            FILETIME written{};
+            const LONG rc = RegEnumKeyExW(key, index, name.data(), &chars, nullptr, nullptr, nullptr, &written);
+            if (rc == ERROR_NO_MORE_ITEMS) break;
+            if (rc != ERROR_SUCCESS) throw std::runtime_error(win32_error("RegEnumKeyExW", static_cast<DWORD>(rc)));
+            if (!first) out << ',';
+            first = false;
+            out << quote(utf8(name.data()));
+        }
+        out << "],\"values\":[";
+        first = true;
+        for (DWORD index = 0; index < 1024U; ++index) {
+            std::array<wchar_t, 16384> name{};
+            DWORD chars = static_cast<DWORD>(name.size());
+            DWORD type = 0;
+            DWORD size = 0;
+            LONG rc = RegEnumValueW(key, index, name.data(), &chars, nullptr, &type, nullptr, &size);
+            if (rc == ERROR_NO_MORE_ITEMS) break;
+            if (rc != ERROR_SUCCESS && rc != ERROR_MORE_DATA) throw std::runtime_error(win32_error("RegEnumValueW(size)", static_cast<DWORD>(rc)));
+            const std::wstring value(name.data(), chars);
+            if (!first) out << ',';
+            first = false;
+            out << registry_value_json(key, value);
+        }
+        out << "]}";
+        RegCloseKey(key);
+        return out.str();
+    } catch (...) {
+        RegCloseKey(key);
+        throw;
+    }
+}
+
+static bool reg_read_string(HKEY key, const wchar_t* name, std::string& out_value) {
+    DWORD type = 0;
+    DWORD size = 0;
+    LONG rc = RegQueryValueExW(key, name, nullptr, &type, nullptr, &size);
+    if (rc != ERROR_SUCCESS || (type != REG_SZ && type != REG_EXPAND_SZ) || size < sizeof(wchar_t)) return false;
+    std::vector<BYTE> data(static_cast<size_t>(size) + sizeof(wchar_t), 0);
+    rc = RegQueryValueExW(key, name, nullptr, &type, data.data(), &size);
+    if (rc != ERROR_SUCCESS) return false;
+    out_value = utf8(reinterpret_cast<const wchar_t*>(data.data()));
+    return true;
+}
+
+static bool reg_read_dword(HKEY key, const wchar_t* name, DWORD& out_value) {
+    DWORD type = 0;
+    DWORD size = sizeof(out_value);
+    DWORD value = 0;
+    const LONG rc = RegQueryValueExW(key, name, nullptr, &type, reinterpret_cast<BYTE*>(&value), &size);
+    if (rc != ERROR_SUCCESS || type != REG_DWORD || size != sizeof(value)) return false;
+    out_value = value;
+    return true;
+}
+
+static std::string wsl_json() {
+    const wchar_t* lxss_path = L"Software\\Microsoft\\Windows\\CurrentVersion\\Lxss";
+    HKEY root = nullptr;
+    const LONG open_rc = RegOpenKeyExW(HKEY_CURRENT_USER, lxss_path, 0, KEY_READ | KEY_WOW64_64KEY, &root);
+    if (open_rc == ERROR_FILE_NOT_FOUND) return "{\"distributions\":[]}";
+    if (open_rc != ERROR_SUCCESS) throw std::runtime_error(win32_error("RegOpenKeyExW(WSL)", static_cast<DWORD>(open_rc)));
+
+    std::ostringstream out;
+    out << "{\"distributions\":[";
+    bool first = true;
+    try {
+        for (DWORD index = 0; index < 1024U; ++index) {
+            std::array<wchar_t, 256> subkey_name{};
+            DWORD chars = static_cast<DWORD>(subkey_name.size());
+            FILETIME written{};
+            const LONG rc = RegEnumKeyExW(root, index, subkey_name.data(), &chars, nullptr, nullptr, nullptr, &written);
+            if (rc == ERROR_NO_MORE_ITEMS) break;
+            if (rc != ERROR_SUCCESS) throw std::runtime_error(win32_error("RegEnumKeyExW(WSL)", static_cast<DWORD>(rc)));
+            HKEY distro = nullptr;
+            if (RegOpenKeyExW(root, subkey_name.data(), 0, KEY_READ, &distro) != ERROR_SUCCESS) continue;
+            std::string name;
+            std::string base_path;
+            DWORD version = 0;
+            DWORD default_uid = 0;
+            DWORD flags = 0;
+            const bool has_name = reg_read_string(distro, L"DistributionName", name);
+            reg_read_string(distro, L"BasePath", base_path);
+            reg_read_dword(distro, L"Version", version);
+            reg_read_dword(distro, L"DefaultUid", default_uid);
+            reg_read_dword(distro, L"Flags", flags);
+            RegCloseKey(distro);
+            if (!has_name) continue;
+            if (!first) out << ',';
+            first = false;
+            out << "{\"id\":" << quote(utf8(subkey_name.data()))
+                << ",\"name\":" << quote(name)
+                << ",\"base_path\":" << quote(base_path)
+                << ",\"version\":" << version
+                << ",\"default_uid\":" << default_uid
+                << ",\"flags\":" << flags
+                << "}";
+        }
+        RegCloseKey(root);
+    } catch (...) {
+        RegCloseKey(root);
+        throw;
+    }
+    out << "]}";
+    return out.str();
+}
+
+static bool is_hardware_query(const std::string& query) {
+    return query == "cpu" || query == "memory" || query == "storage" || query == "network" || query == "gpu" || query == "pci";
+}
+
+static bool is_windows_query(const std::string& query) {
+    return query == "registry" || query == "services" || query == "drivers" || query == "sockets" ||
+        query == "volumes" || query == "usb" || query == "wsl";
+}
+
+static std::string build_hardware_data(const std::string& query) {
     if (query == "cpu") return cpu_json();
     if (query == "memory") return memory_json();
     if (query == "storage") return storage_json();
@@ -285,6 +766,39 @@ static std::string build_data(const std::string& query) {
     throw std::runtime_error("unsupported hardware query");
 }
 
+static std::string build_windows_data(const std::string& query, int argc, wchar_t** argv) {
+    if (query == "services") {
+        if (argc != 2) throw std::runtime_error("services query takes no selectors");
+        return services_json(SERVICE_WIN32, "services");
+    }
+    if (query == "drivers") {
+        if (argc != 2) throw std::runtime_error("drivers query takes no selectors");
+        return services_json(SERVICE_DRIVER, "drivers");
+    }
+    if (query == "sockets") {
+        if (argc != 2) throw std::runtime_error("sockets query takes no selectors");
+        return sockets_json();
+    }
+    if (query == "volumes") {
+        if (argc != 2) throw std::runtime_error("volumes query takes no selectors");
+        return volumes_json();
+    }
+    if (query == "usb") {
+        if (argc != 2) throw std::runtime_error("usb query takes no selectors");
+        return usb_json();
+    }
+    if (query == "wsl") {
+        if (argc != 2) throw std::runtime_error("wsl query takes no selectors");
+        return wsl_json();
+    }
+    if (query == "registry") {
+        if (argc != 4 && argc != 5) throw std::runtime_error("registry usage: registry <HKLM|HKCU> <key> [value]");
+        const wchar_t* value = argc == 5 ? argv[4] : nullptr;
+        return registry_json(argv[2], argv[3], value);
+    }
+    throw std::runtime_error("unsupported Windows query");
+}
+
 int wmain(int argc, wchar_t** argv) {
     try {
         if (argc == 2 && std::wstring(argv[1]) == L"--selftest") {
@@ -293,14 +807,23 @@ int wmain(int argc, wchar_t** argv) {
             std::cout << "{\"status\":\"passed\",\"schema\":\"deadbyte.hardware-observer-selftest.v1\"}\n";
             return 0;
         }
-        if (argc != 2) {
-            std::cerr << "usage: deadbyte-hardware-observer-r45.exe <cpu|gpu|memory|storage|network|pci>\n";
+        if (argc < 2) {
+            std::cerr << "usage: deadbyte-hardware-observer-r45.exe <cpu|gpu|memory|storage|network|pci|services|drivers|sockets|volumes|usb|wsl|registry> [selectors]\n";
             return 2;
         }
         const std::string query = utf8(argv[1]);
-        const std::string data = build_data(query);
-        std::cout << "{\"schema\":\"deadbyte.hardware-query.v1\",\"query\":" << quote(query) << ",\"data\":" << data << "}\n";
-        return 0;
+        if (is_hardware_query(query)) {
+            if (argc != 2) throw std::runtime_error("hardware query takes no selectors");
+            const std::string data = build_hardware_data(query);
+            std::cout << "{\"schema\":\"deadbyte.hardware-query.v1\",\"query\":" << quote(query) << ",\"data\":" << data << "}\n";
+            return 0;
+        }
+        if (is_windows_query(query)) {
+            const std::string data = build_windows_data(query, argc, argv);
+            std::cout << "{\"schema\":\"deadbyte.windows-query.v1\",\"query\":" << quote(query) << ",\"data\":" << data << "}\n";
+            return 0;
+        }
+        throw std::runtime_error("unsupported query");
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
         return 1;