注册表处理之注册表检查

 

需求：

        检查指定的注册表项的键值是否与给定的键值相同，同样是起线程不断检查

思路：

     1)打开需要检查的注册表项，查找该项的键值是否与给定的值相等，根据策略进行相应处理（添加，删除，修改键值或者不处理）

     2)监控这些注册表项，有变化发生时再次进行检查，根据策略进行相应处理

 

 

实现步骤：

 

1.初始化数据

2.启动监控

3. 检查键值

4.结束时释放内存

 

具体实现如下：

 

 

1.初始化数据

将需要检查的注册表项的路径，键项名和键项值存储到指针数组中 //添加注册表监控功能 char ** regCheck_pathArray ; //存储注册表检查项路径 char ** regCheck_nameArray; char ** regCheck_valueArray; //分配空间 nCount为需要检查的注册表键项的数目 regCheck_pathArray = new char*[nCount]; regCheck_nameArray = new char*[nCount]; regCheck_valueArray = new char*[nCount]; for(int i=0;i<nCount;i++) { regCheck_pathArray [i] = new char[MAX_PATH]; regCheck_nameArray [i] = new char[MAX_PATH]; regCheck_valueArray [i] = new char[MAX_PATH]; } //初始化数据 tempUserDefineRegCheck是存储信息的结构体 for(int i = 0; i<nCount; i++) { strcpy(regCheck_pathArray[i], tempUserDefineRegCheck->szRegPath);//存储注册表检查项地址 strcpy(regCheck_nameArray[i], tempUserDefineRegCheck->szRegName); strcpy(regCheck_valueArray[i], tempUserDefineRegCheck->szValue); //处理路径，得到根键名和子键目录名 DoRegCheck(i); //处理下一个注册表项 tempUserDefineRegCheck = tempUserDefineRegCheck->pNext; }  

 

2.启动监控

 

HKEY *hkDriversList; HANDLE *hFindList; HANDLE m_hdmonitorthread;//注册表改变监控线程 HANDLE hStopEvent; DWORD g_dwThreadID; BOOL g_bReturn = FALSE; hkDriversList = new HKEY[nCount]; ZeroMemory(hkDriversList,(sizeof(HKEY))*nCount);//打开注册表项 int numHfind = nCount +1; hFindList = new HANDLE[numHfind]; ZeroMemory(hFindList,(sizeof(HANDLE))*numHfind);//监控变化 for(int i = 0; i< nCount; i++)//打开注册表项准备进行监控 { HKEY hMainKey; char mainkey_value[MAX_PATH] = {0}; sprintf(mainkey_value, "%s",regCheck_pathArray[i]); hMainKey = GetMainKeyName(mainkey_value); char subkey_value[MAX_PATH] = {0}; sprintf(subkey_value, "%s",regCheck_pathArray[i]); wchar_t * subKey = GetSubKeyName(subkey_value); if( ERROR_SUCCESS != RegOpenKeyEx(hMainKey,subKey,0,0,&hkDriversList[i])) //打开欲检查的注册表准备监控 { const char * test = "Open Registry subKey Failed!"; log(test, strlen(test)); } hStopEvent = CreateEvent(NULL, 0, 0, NULL);//创建事件对象 m_hdmonitorthread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)(&user_regmonitor),NULL, 0, &g_dwThreadID); } //监控函数 void WINAPI user_regmonitor() { DWORD ret; for(int i = 0; i< nCount; i++) { hFindList[i] = CeFindFirstRegChange(hkDriversList[i],false, FILE_NOTIFY_CHANGE_CEGETINFO |REG_NOTIFY_CHANGE_NAME|REG_NOTIFY_CHANGE_LAST_SET); } hFindList[nCount] = hStopEvent; const char * notice13 = "打开监控句柄"; log(notice13, strlen(notice13)); do{ const char * notice = "等待变化发生"; log(notice, strlen(notice)); ret = WaitForMultipleObjects((nCount +1),hFindList,NULL,INFINITE); MTCHAR msg = {0}; char changeIndex[10]; sprintf(changeIndex, "%d ",ret); wcscpy(msg, short2wide(changeIndex)); CeFindNextRegChange(hFindList[ret]); indexOfChange = ret;//记录是哪个注册表项被修改了 //打开键获取键值并进行对比检查 DoRegCheck(indexOfChange); } while(!g_bReturn); for(int i=0;i<= nCount; i++) CeFindCloseRegChange(hFindList[i]); /*This function stops change notification handle monitoring.*/ const char * notice12 = "关闭监控句柄"; log(notice12, strlen(notice12)); }  

3. 检查键值

检查键值 if(uValueType == 1)//DWORD 类型数据 { DWORD dwData = 0; if(regCheck_valueArray[index] != NULL) { memcpy(&dwData, (DWORD*)regCheck_valueArray[index], 4);//字符串转换为DWORD类型 } DWORD dwbuf; DWORD dw = 20; DWORD dwType; if(ERROR_SUCCESS == RegQueryValueEx(hKey,strKeyName,0,&dwType,(BYTE*)&dwbuf,&dw)) { iskeyexist = true; if(dwData == dwbuf) { const char * notice = "值相等"; } else { const char * notice = "值不相等"; } } } else //字符串类型 { if(ERROR_SUCCESS == RegQueryValueEx(hKey,strKeyName,0,&dwType,(BYTE *)buf,&dw))//如果该项存在读出它的值 { iskeyexist = true; cur_buf = wide2short(buf); if(strcmp(cur_buf, regCheck_valueArray[index]) == 0) { const char * notice = "值相等"; } else { const char * notice = "值不相等"; } } } RegCloseKey(hKey); 

 

4.结束时释放内存

 

int WINAPI regcheck_close() { for(int i=0; i<nCount; i++)//清空用户自定义注册表项数组 { delete []regCheck_pathArray[i]; delete []regCheck_nameArray[i]; delete []regCheck_valueArray[i]; } delete []regCheck_pathArray; delete []regCheck_nameArray; delete []regCheck_valueArray; regCheck_pathArray = NULL; regCheck_nameArray = NULL; regCheck_valueArray = NULL; if(NULL!= hkDriversList) delete []hkDriversList; if(NULL!= hFindList) delete []hFindList; g_bReturn = TRUE; //WaitForSingleObject(g_hOnline,INFINITE); CloseHandle(m_hdmonitorthread); return 1 ; }