注册表处理之注册表监控

最新推荐文章于 2024-05-30 00:20:27 发布

Huaerge

最新推荐文章于 2024-05-30 00:20:27 发布

阅读量3.4k

点赞数

分类专栏： Wince 开发笔记文章标签： null user path winapi 存储 delete

本文链接：https://blog.csdn.net/Huaerge/article/details/6454148

版权

Wince 开发笔记专栏收录该内容

16 篇文章 0 订阅

订阅专栏

需求：

监控指定的注册表项包括其子项和键项的变化，当变化发生时根据策略进行处理（添加/删除/修改子项，添加/删除/修改键值）

思路：

1）程序启动，存储需要监控的注册表项包括其子项和键项的值

2）监控注册表，当变化发生时再次去取注册表项包括其子项和键项的值，将前后两次进行比较，找出不同，根据用户的策略进行处理

知识点：

监控注册表

注册表结构存储

根据注册表路径获取主键值和子键值

写入带子项的注册表

删除带子项的注册表

添加删除键项

写入DWORD类型或者字符串类型的键项

实现步骤如下：

1.存储注册表数据，监控变化

2.发生变化时进行处理

具体实现如下：

1.存储注册表数据，监控变化

HANDLE hStopEvent; HKEY *hkDriversList; HANDLE m_hdmonitorthread;//注册表改变监控线程 PREG_VALUE_CTRL * pRegValueCtrlList; PREG_INFO_CTRL *pRegInfoCtrlList; HANDLE *hFindList; //监控线程相关的变量和函数 BOOL g_bReturn = FALSE; DWORD g_dwThreadID; void WINAPI user_regmonitor(); //初始化 void InitialData()//对结构体进行初始化存储注册表项值的原始副本 { if(nRegCount > 0) { pRegValueCtrlList = new PREG_VALUE_CTRL[nRegCount]; ZeroMemory(pRegValueCtrlList,(sizeof(PREG_VALUE_CTRL))*nRegCount); pRegInfoCtrlList = new PREG_INFO_CTRL[nRegCount]; ZeroMemory(pRegInfoCtrlList,(sizeof(PREG_INFO_CTRL))*nRegCount); hkDriversList = new HKEY[nRegCount]; ZeroMemory(hkDriversList,(sizeof(HKEY))*nRegCount);//打开注册表项 int numHfind = nRegCount +1; hFindList = new HANDLE[numHfind]; ZeroMemory(hFindList,(sizeof(HANDLE))*numHfind);//监控变化 } for(int i = 0; i<nRegCount; i++) { //带两个参数，一个是根键，一个是相应的子键，定义四个宏 HKEY hMainKey; char mainkey_value[MAX_PATH] = {0}; sprintf(mainkey_value, "%s",userdefine_array[i]); hMainKey = GetMainKeyName(mainkey_value); char subkey_value[MAX_PATH] = {0}; sprintf(subkey_value, "%s",userdefine_array[i]); wchar_t * subKey = GetSubKeyName(subkey_value); pRegValueCtrlList[i] = GetRegValueStruct(hMainKey, subKey); GetRegStruct(hMainKey, subKey, &pRegInfoCtrlList[i]); } } for(int i = 0; i< nRegCount; i++)//打开注册表项准备进行监控 { if( ERROR_SUCCESS != RegOpenKeyEx(hMainKey,subKey,0,0,&hkDriversList[i])) //TEXT("MyApp//Test")// { const char * test = "Open Registry subKey Failed!"; log(test, strlen(test)); } } hStopEvent = CreateEvent(NULL, 0, 0, NULL);//创建事件对象 m_hdmonitorthread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)(&user_regmonitor),NULL, 0, &g_dwThreadID); void WINAPI user_regmonitor() { DWORD ret; for(int i = 0; i< nRegCount; i++) { hFindList[i] = CeFindFirstRegChange(hkDriversList[i],true, FILE_NOTIFY_CHANGE_CEGETINFO |REG_NOTIFY_CHANGE_NAME|REG_NOTIFY_CHANGE_LAST_SET); } hFindList[nRegCount] = hStopEvent; const char * notice13 = "打开监控句柄"; log(notice13, strlen(notice13)); do{ const char * notice = "等待变化发生"; log(notice, strlen(notice)); ret = WaitForMultipleObjects((nRegCount +1),hFindList,NULL,INFINITE); CeFindNextRegChange(hFindList[ret]); indexOfChange = ret;//记录是哪个注册表项被修改了 HKEY hMainKey; char mainkey_value[MAX_PATH] = {0}; sprintf(mainkey_value, "%s",userdefine_array[indexOfChange]); hMainKey = GetMainKeyName(mainkey_value); char subkey_value[MAX_PATH] = {0}; sprintf(subkey_value, "%s",userdefine_array[indexOfChange]); wchar_t * subKey = GetSubKeyName(subkey_value); change_sourceKeyName = wide2short(subKey); //以上只是得到主键和键值 PREG_INFO_CTRL old_infoStructCtrl = pRegInfoCtrlList[indexOfChange]; CompareInfoStruct(old_infoStructCtrl, hMainKey, subKey); } while(!g_bReturn); for(int i=0;i<= nRegCount; i++) CeFindCloseRegChange(hFindList[i]); /*This function stops change notification handle monitoring.*/ }

2.发生变化时进行处理

处理结构图如下：

CompareInfoStruct

handleRegKeyDel //处理注册表项被删除的情况

AddRegInfoStruct

handleRegMainKeyValue //处理主键键值变化的情况

RepairRegItem

DeleteRedundantItem //删除添加的键项

HandleLack_ChangeValue//处理修改键值和删除键值的情况

isValueStructSame

handleRedundantRegKey //处理添加子项的情况

DeleteRedundantRegKey//删除多余项

RegDelnodeRecurse //删除带子项的注册表项

实现代码如下：

CompareInfoStruct

void CompareInfoStruct(PREG_INFO_CTRL old_infoStructCtrl,HKEY hMainKey, wchar_t * subKey) { //获取完整的注册表信息结构体，比较子键的数目是否改变，比较主键的键项有无改变 PREG_INFO_CTRL new_regInfoStruct;//从当前注册表中取数据 GetRegStruct(hMainKey, subKey, &new_regInfoStruct); int user_nDealMode ; // 处理方式1 询问拒绝允许 bool user_bAtdit ; // 审计 if(indexOfChange != -1 /*&& isRepair*/) { //通过编号可以知道是数组的哪一项变了，根据路径来找处理和审计方式 char * change = userdefine_array[indexOfChange]; PREG_USERDEFINE changeUsrDefine = pUserDefineReg; while(changeUsrDefine) { if(strcmp(change, changeUsrDefine->szRegPath) == 0) { user_nDealMode = changeUsrDefine->nDealMode; user_bAtdit = changeUsrDefine->bAtdit; break; } changeUsrDefine = changeUsrDefine->pNext; } } if(new_regInfoStruct == NULL)//此项被删除 { if(!handleRegKeyDel(old_infoStructCtrl, hMainKey , subKey ,user_nDealMode, user_bAtdit)) { const char * notice = "添加被删除的子键失败！"; log(notice, strlen(notice)); } } else { //比较子键，获取子键结构体递归调用 PREG_INFO_CTRL *pSubRegInfoCtrlList = new PREG_INFO_CTRL[MAX_PATH]; ZeroMemory(pSubRegInfoCtrlList,(sizeof(PREG_INFO_CTRL))*MAX_PATH); int old_count = 0; while(old_infoStructCtrl->pSubKeyCtrl[old_count] != NULL)//子键结构体数组赋值 { pSubRegInfoCtrlList[old_count]= old_infoStructCtrl->pSubKeyCtrl[old_count]; old_count++; } int new_count = 0; while(new_regInfoStruct->pSubKeyCtrl[new_count] != NULL) { new_count++; } if(new_count == old_count)//子键数目相同先比较主键的键项值是否相等 { PREG_VALUE_CTRL old_valudeStruct = old_infoStructCtrl->pRegValueCtrl; //PREG_VALUE_CTRL new_valudeStruct = GetRegValueStruct(hMainKey, subKey); PREG_VALUE_CTRL new_valudeStruct = new_regInfoStruct->pRegValueCtrl; if(!handleRegMainKeyValue(old_valudeStruct, new_valudeStruct, hMainKey, subKey, user_nDealMode,user_bAtdit)) { const char * notice = "处理主键键项失败！"; log(notice, strlen(notice)); } } if(new_count > old_count)//添加了新子项，找到该新子项并根据策略处理 { //找出多了哪些项，删除 PREG_INFO_CTRL tempcur_RegInfoCtrl = new_regInfoStruct; if(!handleRedundantRegKey(tempcur_RegInfoCtrl,old_infoStructCtrl,new_count, old_count, hMainKey,user_nDealMode,user_bAtdit)) { const char * notice = "处理多余的子项失败"; log(notice, strlen(notice)); } } for(int i = 0; i<old_count; i++) { PREG_INFO_CTRL regInfoCtrl = pSubRegInfoCtrlList[i];//取出每一个子项，每一个子项又是一个完整的结构体，此时用递归吧 //获取新的进行比较，此时需要组合出subkey wchar_t * subKeyName = short2wide(regInfoCtrl->szKeyName); CompareInfoStruct(regInfoCtrl,hMainKey, subKeyName); } if(NULL!= pSubRegInfoCtrlList) delete []pSubRegInfoCtrlList; } }

handleRegKeyDel

bool handleRegKeyDel(PREG_INFO_CTRL old_infoStructCtrl, HKEY hMainKey , wchar_t * subKey ,int user_nDealMode, bool user_bAtdit) { bool success = true; switch(user_nDealMode) { case 1://询问 { //判断当前该项和存储的对应项是否相同，如果相同不进行下面的操作 MTCHAR msg = {0}; wcscpy(msg, L"检测到注册表项: "); //wchar_t * wname = short2wide(subKey/*userdefine_array[indexOfChange]*/); wcscat(msg, subKey); wcscat(msg, L" 正在被修改,是否允许修改!"); if(IDOK != MessageBox(NULL,msg,L"Notice",MB_OKCANCEL)) { const char * notice = "用户选择了不允许修改"; log(notice, strlen(notice)); if(!AddRegInfoStruct(old_infoStructCtrl))//添加此项 { success = false; } GetRegStruct(hMainKey, subKey, &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 } else { const char * notice = "用户选择了允许修改"; log(notice, strlen(notice)); GetRegStruct(hMainKey, subKey, &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 } } break; case 2://拒绝 { const char * notice = "拒绝修改"; log(notice, strlen(notice)); if(!AddRegInfoStruct(old_infoStructCtrl))//添加此项 { success = false; } } break; case 3://允许 { const char * notice = "允许修改"; log(notice, strlen(notice)); } break; } return success; }

AddRegInfoStruct

bool AddRegInfoStruct(PREG_INFO_CTRL pRegInfoCtrl) { bool success = true; PREG_INFO_CTRL pRegStructCtrl = pRegInfoCtrl;//新创建一个结构体变量用于存储，否则会改变原来结构体指针中的数据 if(pRegStructCtrl) { //名称值下一个 char name[260] = {0}; strcpy(name, pRegStructCtrl->szKeyName); //创建键 HKEY hkey; DWORD dw;//-1表示创建失败 0表示创建成功 dw = RegCreateKeyEx(HKEY_CURRENT_USER,short2wide(name),0,NULL,0,0,NULL,&hkey,&dw);//创建或打开注册表 if(dw!=ERROR_SUCCESS) { //MessageBox(NULL,_T("create false"), L"Notice", MB_OK); const char * notice = "create false 11！"; log(notice, strlen(notice)); success = false; return success; } RegCloseKey(hkey); PREG_VALUE_CTRL pRegValueCtrl = pRegStructCtrl->pRegValueCtrl; //写入键值 while(pRegValueCtrl) { char valueName[260] = {0}; strcpy(valueName, pRegValueCtrl->szValueName); char value[260] = {0}; strcpy(value, pRegValueCtrl->szValue); HKEY hKey; DWORD dw; RegOpenKeyEx(HKEY_CURRENT_USER,short2wide(name),0,0,&hKey);//打开子键 wchar_t * strKeyName = short2wide(valueName); wchar_t * strKeyValue = short2wide(value); LONG lResult; lResult = RegSetValueEx(hKey,strKeyName,0,REG_SZ,(BYTE *)strKeyValue,wcslen(strKeyValue)*2); if(lResult != 0) { const char * notice = "设值失败！"; log(notice, strlen(notice)); success = false; return success; } RegCloseKey(hKey); pRegValueCtrl = pRegValueCtrl->pNext; } PREG_INFO_CTRL *pRegInfoCtrlList1 = new PREG_INFO_CTRL[MAX_PATH]; ZeroMemory(pRegInfoCtrlList1,(sizeof(PREG_INFO_CTRL))*MAX_PATH); int j = 0; while(pRegStructCtrl->pSubKeyCtrl[j] != NULL) { pRegInfoCtrlList1[j]= pRegStructCtrl->pSubKeyCtrl[j]; j++; } for(int i = 0; i<j; i++) { PREG_INFO_CTRL regInfoCtrl = pRegInfoCtrlList1[i];//取出每一个子项，每一个子项又是一个完整的结构体，此时用递归吧 AddRegInfoStruct(regInfoCtrl); } if(NULL!= pRegInfoCtrlList1) delete []pRegInfoCtrlList1; } return success; }

handleRegMainKeyValue

bool handleRegMainKeyValue(PREG_VALUE_CTRL old_valudeStruct, PREG_VALUE_CTRL new_valudeStruct, HKEY hMainKey, wchar_t * subKey, int user_nDealMode, bool user_bAtdit) { bool success = true; //比较主键的键项 if(isValueStructSame(old_valudeStruct, new_valudeStruct) == true)//有可能数目都不同 { const char * notice = "结构体值相同"; log(notice, strlen(notice)); } else { const char * noticemsg = "Registry change detected!"; log(noticemsg, strlen(noticemsg)); if(indexOfChange != -1 /*&& isRepair*/) { switch(user_nDealMode) { case 1://询问 { //判断当前该项和存储的对应项是否相同，如果相同不进行下面的操作 MTCHAR msg = {0}; wcscpy(msg, L"检测到注册表项: "); //wchar_t * wname = short2wide(subKey/*userdefine_array[indexOfChange]*/); wcscat(msg, subKey); wcscat(msg, L" 正在被修改,是否允许修改!"); if(IDOK != MessageBox(NULL,msg,L"Notice",MB_OKCANCEL)) { const char * notice = "用户选择了不允许修改"; log(notice, strlen(notice)); if(!RepairRegItem(old_valudeStruct, new_valudeStruct, hMainKey, subKey)) { success = false; } } else { const char * notice = "用户选择了允许修改"; log(notice, strlen(notice)); GetRegStruct(hMainKey, short2wide(change_sourceKeyName), &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 } } break; case 2://拒绝 { const char * notice = "拒绝修改"; log(notice, strlen(notice)); if(!RepairRegItem(old_valudeStruct, new_valudeStruct, hMainKey, subKey)) { success = false; } } break; case 3://允许 { const char * notice = "允许修改"; log(notice, strlen(notice)); GetRegStruct(hMainKey, short2wide(change_sourceKeyName), &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 } break; } } } return success; }

RepairRegItem

bool RepairRegItem(PREG_VALUE_CTRL old_RegValueCtrl, PREG_VALUE_CTRL cur_RegValueCtrl, HKEY hMainKey, wchar_t * subKey) { bool success = true; //先比较 //找出差异少了多了改值了 //恢复原状 //PREG_VALUE_CTRL old_RegValueCtrl = pRegValueCtrlList[index]; //计数 PREG_VALUE_CTRL countold_RegValueCtrl = old_RegValueCtrl; int old_count = countItem(countold_RegValueCtrl); //计数 PREG_VALUE_CTRL countcur_RegValueCtrl = cur_RegValueCtrl; int cur_count = countItem(countcur_RegValueCtrl); //解决多了项的问题 if(cur_count > old_count)//增加了项 { //找出多了哪些项，删除 PREG_VALUE_CTRL tempcur_RegValueCtrl = cur_RegValueCtrl; if(! DeleteRedundantItem(tempcur_RegValueCtrl,old_RegValueCtrl, hMainKey, subKey))//删除多余项 { const char * notice = "监控到有多余的键值项，删除失败"; log(notice, strlen(notice)); success = false; return success; } } PREG_VALUE_CTRL templackchangeold_RegValueCtrl = old_RegValueCtrl; PREG_VALUE_CTRL templackchangecur_RegValueCtrl = cur_RegValueCtrl; HandleLack_ChangeValue( templackchangeold_RegValueCtrl, templackchangecur_RegValueCtrl, hMainKey, subKey); PREG_VALUE_CTRL reg_RegValueCtrl = GetRegValueStruct(hMainKey, subKey);//经过处理以后 cur_count = countItem(reg_RegValueCtrl); //处理键名被修改，找出该项并删除因为我的处理导致的项增多 if(cur_count > old_count) { if(! DeleteRedundantItem(reg_RegValueCtrl,old_RegValueCtrl, hMainKey, subKey))//删除多余项 { const char * notice = "处理以后键值项增多，删除失败"; log(notice, strlen(notice)); success = false; return success; } } //pRegValueCtrlList[index] = GetRegValueStruct(hMainKey, subKey);//自己修改的键存入old里面，下次对比不认为被修改了 GetRegStruct(hMainKey, short2wide(change_sourceKeyName), &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 return success; }

DeleteRedundantItem

处理新增加了键值项的情况 bool DeleteRedundantItem(PREG_VALUE_CTRL cur_RegValueCtrl, PREG_VALUE_CTRL old_RegValueCtrl, HKEY hMainKey, wchar_t * subKey)//删除多余项 { //找出多了哪些项，删除 PREG_VALUE_CTRL tempcur_RegValueCtrl = cur_RegValueCtrl; while(tempcur_RegValueCtrl) { //名称值下一个 char curname[260] = {0}; strcpy(curname, tempcur_RegValueCtrl->szValueName); bool isexist = false; PREG_VALUE_CTRL tempold_RegValueCtrl = old_RegValueCtrl; while(tempold_RegValueCtrl) { char oldname[260] = {0}; strcpy(oldname, tempold_RegValueCtrl->szValueName); if(strcmp(curname, oldname) == 0)//原来没有现在有，删除 { isexist = true; break; } tempold_RegValueCtrl = tempold_RegValueCtrl->pNext; } if(!isexist)//找遍了不存在的话才删除 { HKEY hKey; if(!ERROR_SUCCESS ==RegOpenKeyEx(hMainKey,subKey,0,0,&hKey)) { MessageBox(NULL, L"打开欲删除的键失败", L"Notice", MB_OK); } if(!ERROR_SUCCESS == RegDeleteValue(hKey, short2wide(curname))) { MessageBox(NULL, L"删除键失败", L"Notice", MB_OK); } RegCloseKey(hKey); } tempcur_RegValueCtrl = tempcur_RegValueCtrl->pNext; } return true; }

HandleLack_ChangeValue

处理键值项被删除或者值被修改的情况 void HandleLack_ChangeValue(PREG_VALUE_CTRL templackchangeold_RegValueCtrl, PREG_VALUE_CTRL templackchangecur_RegValueCtrl, HKEY hMainKey, wchar_t * subKey)//处理修改键值和删除键值的情况 { PREG_VALUE_CTRL old_RegValueCtrl = templackchangeold_RegValueCtrl; //解决同名项值不同，与原来比少了项的问题 while(old_RegValueCtrl) { //名称值下一个 bool valueexist = false; char oldname[260] = {0}; strcpy(oldname, old_RegValueCtrl->szValueName); PREG_VALUE_CTRL cur_RegValueCtrl = templackchangecur_RegValueCtrl;//每次都需要一个完整的结构体 while(cur_RegValueCtrl) { //名称值下一个 char cur_name[260] = {0}; strcpy(cur_name, cur_RegValueCtrl->szValueName); if(strcmp(oldname, cur_name) == 0)//两个表里都存在的键值是否被修改 { valueexist = true;//此名的键存在 if(strcmp(old_RegValueCtrl->szValue, cur_RegValueCtrl->szValue) != 0) //不相等就改回去 { HKEY hKey; DWORD dw; //HKEY hMainKey; //char mainkey_value[MAX_PATH] = {0}; //sprintf(mainkey_value, "%s",userdefine_array[index]); //hMainKey = GetMainKeyName(mainkey_value); //char subkey_value[MAX_PATH] = {0}; //sprintf(subkey_value, "%s",userdefine_array[index]); //wchar_t * subKey = GetSubKeyName(subkey_value); if(RegOpenKeyEx(hMainKey,subKey,0,0,&hKey) == ERROR_SUCCESS) {//打开子键 LPCTSTR strKeyName = short2wide(cur_name); LPCTSTR strKeyValue = short2wide(old_RegValueCtrl->szValue); if(RegSetValueEx(hKey,strKeyName,0,REG_SZ,(BYTE *)strKeyValue,wcslen(strKeyValue)*2)== ERROR_SUCCESS) { //AfxMessageBox(TEXT("设置成功！")); const char * notice = "设置成功!"; log(notice, strlen(notice)); //pRegValueCtrlList[index] = GetRegValueStruct(hMainKey, subKey);//自己修改的键存入old里面，下次对比不认为被修改了 } else { //AfxMessageBox(TEXT("设置失败！")); const char * notice = "设置失败!"; log(notice, strlen(notice)); } RegCloseKey(hKey); } else { //AfxMessageBox(TEXT("打开欲还原的键失败！")); const char * notice = "打开欲还原的键失败!"; log(notice, strlen(notice)); } } break; } cur_RegValueCtrl = cur_RegValueCtrl->pNext; } if(!valueexist)//如果键值不存在，写入键值 { HKEY hKey; DWORD dw; RegOpenKeyEx(hMainKey,subKey,0,0,&hKey);//打开子键 LPCTSTR strKeyName = short2wide(old_RegValueCtrl->szValueName); LPCTSTR strKeyValue = short2wide(old_RegValueCtrl->szValue); RegSetValueEx(hKey,strKeyName,0,REG_SZ,(BYTE *)strKeyValue,wcslen(strKeyValue)*2); RegCloseKey(hKey); //pRegValueCtrlList[index] = GetRegValueStruct(hMainKey, subKey);//自己修改的键存入old里面，下次对比不认为被修改了 } old_RegValueCtrl = old_RegValueCtrl->pNext; } }

isValueStructSame

判断键值结构体是否相同（如果相同不进行下面的操作，导致这种情况的原因是在根据策略处理的时候修改了注册表，但是这个修改后的注册表跟原始注册表是相同的哦，但是系统还是检测到注册表被修改了，这个时候是不需要处理的哈） bool isValueStructSame(PREG_VALUE_CTRL old_valudeStruct, PREG_VALUE_CTRL new_valueStruct) { //计数 int old_count = countItem(old_valudeStruct); int cur_count = countItem(new_valueStruct); if(cur_count != old_count)//键值项数目不等 { const char * notice = "有多余的键值项"; log(notice, strlen(notice)); return false; } PREG_VALUE_CTRL old_RegValueCtrl = old_valudeStruct; //数目相同，查看具体的键名和键值是否相同 while(old_RegValueCtrl) { //名称值下一个 bool valueexist = false; char oldname[260] = {0}; strcpy(oldname, old_RegValueCtrl->szValueName); PREG_VALUE_CTRL cur_RegValueCtrl = new_valueStruct;//每次都需要一个完整的结构体 while(cur_RegValueCtrl) { char cur_name[260] = {0}; strcpy(cur_name, cur_RegValueCtrl->szValueName); if(strcmp(oldname, cur_name) == 0)//两个表里都存在的键值是否被修改 { valueexist = true;//此名的键存在 if(strcmp(old_RegValueCtrl->szValue, cur_RegValueCtrl->szValue) != 0) { return false; } } cur_RegValueCtrl = cur_RegValueCtrl->pNext; } if(!valueexist)//如果键值不存在 { return false; } old_RegValueCtrl = old_RegValueCtrl->pNext; } return true; }

handleRedundantRegKey

bool handleRedundantRegKey(PREG_INFO_CTRL tempcur_RegInfoCtrl,PREG_INFO_CTRL old_infoStructCtrl,int new_count, int old_count, HKEY hMainKey,int user_nDealMode,bool user_bAtdit) { bool success = true; switch(user_nDealMode) { case 1://询问 { //判断当前该项和存储的对应项是否相同，如果相同不进行下面的操作 MTCHAR msg = {0}; wcscpy(msg, L"检测到监控项新添加了子键: "); wchar_t * wname = short2wide(userdefine_array[indexOfChange]); wcscat(msg, L"是否允许添加？"); if(IDOK != MessageBox(NULL,msg,L"Notice",MB_OKCANCEL)) { const char * notice = "用户选择了不允许添加"; log(notice, strlen(notice)); if(! DeleteRedundantRegKey(tempcur_RegInfoCtrl,old_infoStructCtrl,new_count, old_count, hMainKey))//删除多余项 { const char * notice = "监控到有多余的子项，删除失败"; log(notice, strlen(notice)); } } else { const char * notice = "用户选择了允许添加"; log(notice, strlen(notice)); GetRegStruct(hMainKey, short2wide(change_sourceKeyName), &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 } } break; case 2://拒绝 { const char * notice = "拒绝添加"; log(notice, strlen(notice)); if(! DeleteRedundantRegKey(tempcur_RegInfoCtrl,old_infoStructCtrl,new_count, old_count, hMainKey))//删除多余项 { const char * notice = "监控到有多余的子项，删除失败"; log(notice, strlen(notice)); } } break; case 3://允许 { const char * notice = "允许添加"; log(notice, strlen(notice)); GetRegStruct(hMainKey, short2wide(change_sourceKeyName), &pRegInfoCtrlList[indexOfChange]);//自己修改的键存入old里面，下次对比不认为被修改了 } break; } return success; }

DeleteRedundantRegKey

bool DeleteRedundantRegKey(PREG_INFO_CTRL cur_RegInfoCtrl, PREG_INFO_CTRL old_RegInfoCtrl, int new_count, int old_count, HKEY hMainKey)//删除多余项 { bool success = true; for(int i = 0; i<new_count; i++) { char curKeyName[260] = {0}; strcpy(curKeyName, cur_RegInfoCtrl->pSubKeyCtrl[i]->szKeyName); bool isexist = false; for(int j = 0; j<old_count; j++) { char oldname[260] = {0}; strcpy(oldname, old_RegInfoCtrl->pSubKeyCtrl[j]->szKeyName); if(strcmp(curKeyName, oldname) == 0)//原来没有现在有，删除 { isexist = true; break; } } if(!isexist)//找遍了不存在的话才删除 { TCHAR szDelKey[MAX_PATH*2]; StringCchCopy (szDelKey, MAX_PATH*2, short2wide(curKeyName)); bool success = RegDelnodeRecurse(hMainKey, szDelKey ); if(!success) { const char * notice = "删除子项失败！"; log(notice, strlen(notice)); success = false; } } } return success; }

RegDelnodeRecurse

MSDN上下的，之前自己也写了一个 http://msdn.microsoft.com/en-us/library/ms724235(v=vs.85).aspx BOOL RegDelnodeRecurse(HKEY hKeyRoot, LPTSTR lpSubKey) { LPTSTR lpEnd; LONG lResult; DWORD dwSize; TCHAR szName[MAX_PATH]; HKEY hKey; FILETIME ftWrite; // First, see if we can delete the key without having // to recurse. lResult = RegDeleteKey(hKeyRoot, lpSubKey); if (lResult == ERROR_SUCCESS) return TRUE; lResult = RegOpenKeyEx (hKeyRoot, lpSubKey, 0, KEY_READ, &hKey); if (lResult != ERROR_SUCCESS) { if (lResult == ERROR_FILE_NOT_FOUND) { printf("Key not found./n"); return TRUE; } else { printf("Error opening key./n"); return FALSE; } } // Check for an ending slash and add one if it is missing. lpEnd = lpSubKey + lstrlen(lpSubKey); if (*(lpEnd - 1) != TEXT('//')) { *lpEnd = TEXT('//'); lpEnd++; *lpEnd = TEXT('/0'); } // Enumerate the keys dwSize = MAX_PATH; lResult = RegEnumKeyEx(hKey, 0, szName, &dwSize, NULL, NULL, NULL, &ftWrite); if (lResult == ERROR_SUCCESS) { do { StringCchCopy (lpEnd, MAX_PATH*2, szName); if (!RegDelnodeRecurse(hKeyRoot, lpSubKey)) { break; } dwSize = MAX_PATH; lResult = RegEnumKeyEx(hKey, 0, szName, &dwSize, NULL, NULL, NULL, &ftWrite); } while (lResult == ERROR_SUCCESS); } lpEnd--; *lpEnd = TEXT('/0'); RegCloseKey (hKey); // Try again to delete the key. lResult = RegDeleteKey(hKeyRoot, lpSubKey); if (lResult == ERROR_SUCCESS) return TRUE; return FALSE; }

Huaerge

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
注册表处理之注册表监控

 需求： 监控指定的注册表项包括其子项和键项的变化，当变化发生时根据策略进行处理（添加/删除/修改子项，添加/删除/修改键值） 思路： 1）程序启动，存储需要监控的注册表项包括其子项和键项的值 2）监控注册表，当变化发生时再次去取注册表项包括其子项和键项的值，将前后两次进行比较，找出不同，根据用户的策略进行处理 知识点： 监控注册表 
复制链接

扫一扫