ShadowCopy creation

Sundance · March 13, 2014

Hiho together.

As a systemadministrator I have sometimes to get some data back which the customers deleted. Surely we have a backup but the possibilities of shadowcopy are very fine!

First I tried to use programs like vssadmin and vshadow.exe but as a lover of AutoIt I don't like to call exxes from my scripts and searched the internet for a solution.

When looking at the vss apis its really a pain in the... you know what i mean. :-)

After some days of searching and trying I would liketo post the information I have and the point where I'am standing. My goal is for example to create a shadowcopy set. Add some drives to the set and then let it create the shadowcopys all at one...

So here we go.

First problem. You can't use dll calls for it. The only way I see is using the COMs given.

There is one dllcall as a starting point for creating the IVssBackupComponents interface. With the help of this interface you can use many methods for managing shadowcopys.

( http://msdn.microsoft.com/en-us/library/aa381517(v=vs.85).aspx )

This is the code which gives me the

"Doubly indirect pointer to the created IVssBackupComponents interface object.".

Local $hVSS = DllOpen("c:\windows\system32\vssapi.dll")
Local $aResult

$aResult = DllCall($hVSS, "handle", "CreateVssBackupComponentsInternal", "ptr*", 0)
ConsoleWrite("CreateVssBackupComponentsInternal: " & @error & "   " & $aResult[1] & @CRLF)

Now I have a pointer pointing to a pointer to the needed component.

And now I'am stuck. I don't know how to use this pointer. The next thing to do for example would be acall

like this (in C#) backupComponents->InitializeForBackup();

( http://social.msdn.microsoft.com/Forums/vstudio/en-US/2aab5683-d34d-4ff9-861d-174d30c84181/cant-access-vss-under-windows-81?forum=vcgeneral )

I tried using the OLE/COM Object Viewer but haven't found any usefull information.

Does someone of you guys know how to use this pointer?

many thanks in advance for a little hint!

Sundance

LarsJ · March 13, 2014

Sundance, You use this interface pointer to create an interface object. You create an interface object with the AutoIt command ObjCreateInterface:

$oIVssBackupComponents = ObjCreateInterface( $pIVssBackupComponents, $sIID_IVssBackupComponents, $dtag_IVssBackupComponents )
If IsObj( $oIVssBackupComponents ) Then
  ConsoleWrite( "$oIVssBackupComponents OK" & @CRLF )
  $oIVssBackupComponents.InitializeForBackup( "bstrXML" )
Else
  ConsoleWrite( "$oIVssBackupComponents ERR" & @CRLF )
EndIf

$pIVssBackupComponents is the interface pointer.

This is the IID and interface description string:

Global Const $sIID_IVssBackupComponents = "{665C1D5F-C218-414D-A05D-7FEF5F9D5C86}"
Global Const $dtag_IVssBackupComponents = _
  "GetWriterComponentsCount hresult();" & _  ; <-- Add parameters for all methods
  "GetWriterComponents hresult();" & _
  "InitializeForBackup hresult(bstr);" & _   ; <-- InitializeForBackup
  "SetBackupState hresult();" & _
  "InitializeForRestore hresult();" & _
  "SetRestoreState hresult();" & _
  "GatherWriterMetadata hresult();" & _
  "GetWriterMetadataCount hresult();" & _
  "GetWriterMetadata hresult();" & _
  "FreeWriterMetadata hresult();" & _
  "AddComponent hresult();" & _
  "PrepareForBackup hresult();" & _
  "AbortBackup hresult();" & _
  "GatherWriterStatus hresult();" & _
  "GetWriterStatusCount hresult();" & _
  "FreeWriterStatus hresult();" & _
  "GetWriterStatus hresult();" & _
  "SetBackupSucceeded hresult();" & _
  "SetBackupOptions hresult();" & _
  "SetSelectedForRestore hresult();" & _
  "SetRestoreOptions hresult();" & _
  "SetAdditionalRestores hresult();" & _
  "SetPreviousBackupStamp hresult();" & _
  "SaveAsXML hresult();" & _
  "BackupComplete hresult();" & _
  "AddAlternativeLocationMapping hresult();" & _
  "AddRestoreSubcomponent hresult();" & _
  "SetFileRestoreStatus hresult();" & _
  "AddNewTarget hresult();" & _
  "SetRangesFilePath hresult();" & _
  "PreRestore hresult();" & _
  "PostRestore hresult();" & _
  "SetContext hresult();" & _
  "StartSnapshotSet hresult();" & _
  "AddToSnapshotSet hresult();" & _
  "DoSnapshotSet hresult();" & _
  "DeleteSnapshots hresult();" & _
  "ImportSnapshots hresult();" & _
  "BreakSnapshotSet hresult();" & _
  "GetSnapshotProperties hresult();" & _
  "Query hresult();" & _
  "IsVolumeSupported hresult();" & _
  "DisableWriterClasses hresult();" & _
  "EnableWriterClasses hresult();" & _
  "DisableWriterInstances hresult();" & _
  "ExposeSnapshot hresult();" & _
  "RevertToSnapshot hresult();" & _
  "QueryRevertStatus hresult();"

You have to fill in the parameters for all the methods you need, but you can test InitializeForBackup with this description string.

Regards Lars.

Sundance · March 13, 2014

Hi Lars,

thanks for your post! I tried the ObjCreateInterface but hadn't any luck and also I was a little bit irritated by the help file which says that the command could be deleted in the next version of Autoit...

I will try your sample code.

Where did you get the IID Lars?

Many thanks again Lars!!!

sincerely yours

Sundance

Sundance · March 13, 2014

Hi Lars,

its me again :-)

I did to do a InitializeForBackup. When using it for non transported shadow copies it is to be called without a parameter. I did now try doing this but getting errors.

I did change "InitializeForBackup hresult(bstr);" into "InitializeForBackup hresult();" but COM error is 80020010 .

Can you help me one more time Lars?

thanks in advance!!

Sundance

LarsJ · March 13, 2014

The warnings of ObjCreateInterface in the help file are greatly exaggerated. The function does work, it does not contain any bugs (just go through all the examples in the example section), and I don't think the function will be removed. To remove this function would be like to remove an entire dimension from AutoIt.

I googled "IVssBackupComponents IID" to find the IID. You can also find it in the header files in the SDK.

Try the definition "InitializeForBackup hresult(ptr);" and call it with $oIVssBackupComponents.InitializeForBackup(0).

You should definitely use a COM error handler. You can find one in the example for the ObjEvent function in the helpfile.

Lars.

Sundance · March 14, 2014

Thanks Lars. I allready have a COM error handler in the code :-)

I had InitializeForBackup(0) also tried but not with the definition of hresult(ptr).

Many thanks again Lars !!!1

greetings from sunny germany

Sundance

Sundance · March 14, 2014

Hi Lars,

I really hate it when people asking everything and all and wanting step by step help and it seems they haven't done there homework. I think you could think the same about me but I really tried now for 5 hours to get the call .StartSnapshotSet running but it won't I looked at the other post containing some COM related questions but haven't found a solution. Can I post my code so far? I hope so. :-) Possibly you can help my again?

So here is the code I have so far.

Global $iEventError = 0 ; to be checked to know if com error occurs. Must be reset after handling.
$oMyError = ObjEvent("AutoIt.Error", "ErrFunc") ; Install a custom error handler

Local $hVSS = DllOpen("c:\windows\system32\vssapi.dll")
Local $aResult

$aResult = DllCall($hVSS, "handle", "CreateVssBackupComponentsInternal", "ptr*", 0)
ConsoleWrite("CreateVssBackupComponentsInternal: " & @error & "   " & $aResult[0] & "  " & $aResult[1] & @CRLF)

Local $pIVssBackupComponents = $aResult[1]

Global $VolumeD = DllStructCreate("wchar[250]")
DllStructSetData($VolumeD, 1, "d:\")

Global $GUID_NULL = DllStructCreate($tagGUID )
DllStructSetData($GUID_NULL, 1, _WinAPI_GUIDFromString("{00000000-0000-0000-0000-000000000000}"))

Global $SetIdentifier = DllStructCreate($tagGUID )
Global $pSI = DllStructGetPtr($SetIdentifier,1)
Global $ID_D = DllStructCreate("char[64]")
Global $ID_J = DllStructCreate("char[64]")
Global $ppAsync = DllStructCreate("ptr")
Global Const $sIID_IVssBackupComponents = "{665C1D5F-C218-414D-A05D-7FEF5F9D5C86}"
Global Const $dtag_IVssBackupComponents = _
  "GetWriterComponentsCount hresult();" & _  ; <-- Add parameters for all methods
  "GetWriterComponents hresult();" & _
  "InitializeForBackup hresult(ptr);" & _   ; <-- InitializeForBackup
  "SetBackupState hresult(boolean; boolean; int; boolean);" & _
  "InitializeForRestore hresult();" & _
  "SetRestoreState hresult();" & _
  "GatherWriterMetadata hresult();" & _
  "GetWriterMetadataCount hresult();" & _
  "GetWriterMetadata hresult();" & _
  "FreeWriterMetadata hresult();" & _
  "AddComponent hresult();" & _
  "PrepareForBackup hresult();" & _
  "AbortBackup hresult();" & _
  "GatherWriterStatus hresult();" & _
  "GetWriterStatusCount hresult();" & _
  "FreeWriterStatus hresult();" & _
  "GetWriterStatus hresult();" & _
  "SetBackupSucceeded hresult();" & _
  "SetBackupOptions hresult();" & _
  "SetSelectedForRestore hresult();" & _
  "SetRestoreOptions hresult();" & _
  "SetAdditionalRestores hresult();" & _
  "SetPreviousBackupStamp hresult();" & _
  "SaveAsXML hresult();" & _
  "BackupComplete hresult();" & _
  "AddAlternativeLocationMapping hresult();" & _
  "AddRestoreSubcomponent hresult();" & _
  "SetFileRestoreStatus hresult();" & _
  "AddNewTarget hresult();" & _
  "SetRangesFilePath hresult();" & _
  "PreRestore hresult();" & _
  "PostRestore hresult();" & _
  "SetContext hresult(long);" & _
  "StartSnapshotSet hresult(ptr);" & _
  "AddToSnapshotSet hresult(char[250]; char[250]; ptr);" & _
  "DoSnapshotSet hresult(ptr);" & _
  "DeleteSnapshots hresult();" & _
  "ImportSnapshots hresult();" & _
  "BreakSnapshotSet hresult();" & _
  "GetSnapshotProperties hresult();" & _
  "Query hresult();" & _
  "IsVolumeSupported hresult();" & _
  "DisableWriterClasses hresult();" & _
  "EnableWriterClasses hresult();" & _
  "DisableWriterInstances hresult();" & _
  "ExposeSnapshot hresult();" & _
  "RevertToSnapshot hresult();" & _
  "QueryRevertStatus hresult();"


$oIVssBackupComponents = ObjCreateInterface( $pIVssBackupComponents, $sIID_IVssBackupComponents, $dtag_IVssBackupComponents )
If IsObj( $oIVssBackupComponents ) Then
  ConsoleWrite( "$oIVssBackupComponents OK" & @CRLF )
  $iResult = $oIVssBackupComponents.InitializeForBackup(0)
    If $iResult Then
      ConsoleWrite("error Initializing (" & Hex($iResult) & ")" & @CRLF)
      Exit(1)
    Else
        ConsoleWrite("Initializing done." & @CRLF)
    EndIf

  $iResult = $oIVssBackupComponents.SetBackupState(0, 0, 1, 0)
    If $iResult Then
      ConsoleWrite("error setting backup state (" & Hex($iResult) & ")" & @CRLF)
      Exit(1)
    Else
        ConsoleWrite("setting backup state done." & @CRLF)
    EndIf

  $iResult = $oIVssBackupComponents.SetContext(BitOR(1,8,10))
    If $iResult Then
      ConsoleWrite("error setting context (" & Hex($iResult) & ")" & @CRLF)
      Exit(1)
    Else
        ConsoleWrite("setting context done." & @CRLF)
    EndIf

  $iResult = $oIVssBackupComponents.StartSnapshotSet($pSI)
    If $iResult > 0 Then
      ConsoleWrite("error starting snapshot set (" & Hex($iResult) & ")" & @CRLF)
      Exit(1)
    Else
        ConsoleWrite("starting snapshot set done. ( " & _WinAPI_StringFromGUID(DllStructGetData($SetIdentifier,1)) & " )" & @CRLF)
    EndIf

  $iResult = $oIVssBackupComponents.AddToSnapshotSet(DllStructGetData($VolumeD, 1), DllStructGetData($GUID_NULL, 1), DllStructGetPtr($ID_D))
    If $iResult Then
      ConsoleWrite("error adding d:\ to snapshot set (" & Hex($iResult) & ")" & @CRLF)
      Exit(1)
    Else
        ConsoleWrite("adding d:\ to snapshot set done." & " (" & DllStructGetData($ID_D,1) & ")" & @CRLF)
    EndIf

;~   $iResult = $oIVssBackupComponents.AddToSnapshotSet("j:\", "{00000000-0000-0000-0000-000000000000}", DllStructGetPtr($ID_J))
;~  If $iResult Then
;~    ConsoleWrite("error adding j:\ to snapshot set (" & Hex($iResult) & ")" & @CRLF)
;~    Exit(1)
;~  Else
;~      ConsoleWrite("adding j:\ to snapshot set done." & " (" & DllStructGetData($ID_J,1) & ")" & @CRLF)
;~  EndIf

  $iResult = $oIVssBackupComponents.DoSnapshotSet(DllStructGetPtr($ppAsync))
    If $iResult Then
      ConsoleWrite("error doing snapshot set (" & Hex($iResult) & ")" & @CRLF)
      Exit(1)
    Else
        ConsoleWrite("doing snapshot set done." & @CRLF)
    EndIf




;~   $oIVssBackupComponents.StartSnapshotSet( DllStructGetPtr($SetIdentifier,1) )
  ConsoleWrite("SetIdentifier: " & DllStructGetData($SetIdentifier, 1) & @CRLF)

Else
  ConsoleWrite( "$oIVssBackupComponents ERR" & @CRLF )
EndIf






; This is a custom error handler
Func ErrFunc()
    $HexNumber = Hex($oMyError.number, 8)
    MsgBox(0, "", "We intercepted a COM Error !" & @CRLF & _
            "Number is: " & $HexNumber & @CRLF & _
            "WinDescription is: " & $oMyError.windescription)
    $iEventError = 1 ; Use to check when a COM Error occurs
EndFunc   ;==>ErrFunc

Its doing the calls of :

$oIVssBackupComponents.InitializeForBackup

$oIVssBackupComponents.SetBackupState

$oIVssBackupComponents.SetContext

They are returning with the value S_OK.

Then comes $oIVssBackupComponents.StartSnapshotSet and this throws my AutoIt against a wall. It errors out that Autoit doesn't function anymore... puuuhhh.

The call needs a pointer to a VSS_ID

HRESULT StartSnapshotSet(
  [out]  VSS_ID *pSnapshotSetId
);

I created a dll structure with the $tagGUID structure and gave the $oIVssBackupComponents.StartSnapshotSet call the pointer to it.

Also I defined the method as "StartSnapshotSet hresult(ptr);"

Its only one parameter but its giving me a big headache :-|

again some ~17°C warm greetings from germany

Sundance

LarsJ · March 14, 2014

Note that it's an output parameter. The definition and code should be:

"StartSnapshotSet hresult(ptr*);" ; Note the star

Local $pSI
$iResult = $oIVssBackupComponents.StartSnapshotSet($pSI)
ConsoleWrite(Ptr($pSI) & @CRLF)

Sundance · March 14, 2014

Oh man. Thanks LArs. How should I know about the star? Is there some manual/side to look for such an info?

Thanks again Lars!!!

Sundance

JohnOne · March 14, 2014

way over my head this COM stuff but humor me a moment.

should

$aResult = DllCall($hVSS, "handle", "CreateVssBackupComponentsInternal", "ptr*", 0)

be

$aResult = DllCall($hVSS, "handle", "CreateVssBackupComponents", "ptr*", 0)

http://msdn.microsoft.com/en-us/library/aa381517(v=vs.85).aspx

Sundance · March 14, 2014

Hi John,

I also read the note ( Note This function is exported as CreateVssBackupComponentsInternal, but you should call CreateVssBackupComponents, not CreateVssBackupComponentsInternal.) but I think you can only use the name CreateVssBackupComponents when using the VssAPI.lib within C cause there is the 'alias' set. So on my Win7 prof its working with CreateVssBackupComponentsInternal but I think it could be a problem on other Operating Systems.

But thanks for looking at the code. Still trouble with the StartSnapshotSet method. Still won't function. Its really a hell with this COM stuff but there is no other way of making ShadowCopies without a third party program. :-(

LarsJ · March 14, 2014

I just saw in documentation that StartSnapshotSet returns some kind of a GUID.

You can try this:

"StartSnapshotSet hresult(ptr);" ; Note no star

Global Const $tagGUID = "ulong Data1;ushort Data2;ushort Data3;byte Data4[8]"
$tGUID = DllStructCreate( $tagGUID )
$pGUID = DllStructGetPtr( $tGUID )

$iResult = $oIVssBackupComponents.StartSnapshotSet($pGUID)

Sundance · March 14, 2014

Hi Lars,

this is nearly the code I posted at 2:51pm. I tried then to output the GUID with

ConsoleWrite("starting snapshot set done. ( " & _WinAPI_StringFromGUID(DllStructGetData($SetIdentifier,1)) & " )" & @CRLF)

This throws an exception of AutoIt. Going to dig further... Really complex thingy :-)

Sundance · March 14, 2014

Okay. Now I have the guid in the console output. Just a little error:

ConsoleWrite("starting snapshot set done. ( " & _WinAPI_StringFromGUID(DllStructGetData($SetIdentifier,1)) & " )" & @CRLF)

Should be:

ConsoleWrite("starting snapshot set done. ( " & _WinAPI_StringFromGUID(DllStructGetPtr($SetIdentifier,1)) & " )" & @CRLF)

So next fight is the next command AddToSnapshotSet. Till now it kills AutoIt. Digging again :-)

Edited March 14, 2014 by Sundance

Sundance · March 14, 2014

The last step is to add a drive for shadowing.

This is the original info from microsoft:

HRESULT AddToSnapshotSet(
  [in]   VSS_PWSZ pwszVolumeName,
  [in]   VSS_ID ProviderId,
  [out]  VSS_ID *pidSnapshot
);

Parameters pwszVolumeName [in]

Null-terminated wide character string containing the name of the volume or the UNC path of the remote file share to be shadow copied.

ProviderId [in]

The provider to be used. GUID_NULL can be used, in which case the default provider will be used.

pidSnapshot [out]

Returned identifier of the added shadow copy.

In the script I use this as the method definition:

"AddToSnapshotSet hresult(wchar[250]; byte[16]; ptr);"

Meanig I give it a wide char string, then the GUID which consists of 16 byte and a pointer targeting to the dll struct which should hold the new snapshotID.

These are the definitions of the variables:

Global $VolumeD = DllStructCreate("wchar[250]")
DllStructSetData($VolumeD, 1, "d:\")
Global $pVolumeD = DllStructGetPtr($VolumeD)

Global $GUID_NULL = DllStructCreate("byte[16]")
DllStructSetData($GUID_NULL, 1, _WinAPI_GUIDFromString("00000000-0000-0000-0000-000000000000"))

And this is the call:

$iResult = $oIVssBackupComponents.AddToSnapshotSet(DllStructGetData($VolumeD,1), DllStructGetData($GUID_NULL,1), $pID_D)

I also tried using the $tagGUID when creating the $GUID_NULL structure but I think that DllStructGetData then will only grab the first 4 bytes of the ulong Data1 !?

Thats where I'am hanging now. The last command $oIVssBackupComponents.DoSnapshotSet seems to work. So this is the last peace of the puzzle :-)

Going to sleep and hope to find tommorow the light...

Good night and I will report what I have come up with....

JohnOne · March 14, 2014

where does $pID_D come from?

LarsJ · March 15, 2014

AddToSnapshotSet. I think the description and code should be something like this:

"AddToSnapshotSet hresult(wstr; ptr; ptr);" ; Last parameter as last parameter in StartSnapshotSet

iResult = $oIVssBackupComponents.AddToSnapshotSet("d:\", DllStructGetPtr($GUID_NULL), $pID_D)
; Last parameter as last parameter in StartSnapshotSet

Sundance · March 15, 2014

Good morning. *gähn*

Sorry John. I did change the code a little bid. I did define $pID_D as DllStructGetPtr($ID_D). Only to make reading the method call easier.

And good morning Lars. Just woke up and bevore going to work to shut down all our servers cause of a service event from the electrical guys I thougth of looking into the forum.

I will try your idea ASAP .

Yesterday I was really tired after programming/trying 10hours with just minor success....

I will report back guys!

Sundance

Sundance · March 15, 2014

Hiho,

so I'am back from work and kids are sleeping so I directly tried again. But it still throws AutoIt of the wall.

I've found a webpage where they do the same thing in C++.

http://wj32.org/wp/2012/12/13/how-to-backup-files-in-c-using-the-volume-shadow-copy-service-vss/

The line with the AddToSnapshotSet is like this:

result = backupComponents->AddToSnapshotSet(L"D:\\", GUID_NULL, &snapshotId);

I used "D:", DllStructGetData($GUID_NULL,1), $pID_D)

with the method AddToSnapshotSet hresult(wstr; byte[16]; ptr);"

This seems to make most sense to me but no success....

This is really tough stuff...

COMshadow.au3

Edited March 15, 2014 by Sundance

JohnOne · March 16, 2014

when I find GUID structure it looks like this...

typedef struct _GUID {
    unsigned long  Data1;
    unsigned short Data2;
    unsigned short Data3;
    unsigned char  Data4[ 8 ];
} GUID;

Is yours the same?

ShadowCopy creation

Recommended Posts

Link to comment

Share on other sites

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Sundance

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Create an account or sign in to comment

Create an account

Sign in

Recently Browsing 0 members