一段注册表监控驱动代码

#define SUBVERSION_MASK     0x000000FF
//
// macros to extract various version fields from the NTDDI version
//
#define OSVER(Version) ((Version) &OSVERSION_MASK)
#define SPVER(Version) (((Version) &SPVERSION_MASK) >>8)
#define SUBVER(Version) (((Version) &SUBVERSION_MASK) )
//#define NTDDI_VERSION   NTDDI_WINXPSP2
#include <ntifs.h>
#include <wdm.h>
#include <ntstrsafe.h>
#define FILE_DEVICE_UNKNOWN 0x00000022
#define IOCTL_UNKNOWN_BASE FILE_DEVICE_UNKNOWN
#define IOCTL_CAPTURE_GET_REGEVENTS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER,FILE_READ_DATA | FILE_WRITE_DATA)
#define USERSPACE_CONNECTION_TIMEOUT 10
#define REGISTRY_POOL_TAG 'pRE'
typedef unsigned int UINT;
typedef char * PCHAR;
typedef PVOID POBJECT;
/* Registry event */
typedef struct _REGISTRY_EVENT {
REG_NOTIFY_CLASS eventType;
TIME_FIELDS time;
HANDLE processId;
ULONG dataType;
ULONG dataLengthB;
ULONG registryPathLengthB;
/* Contains path and optionally data */
UCHAR registryData[];
} REGISTRY_EVENT, * PREGISTRY_EVENT;
/* Storage for registry event to be put into a linked list */
typedef struct _REGISTRY_EVENT_PACKET {
   LIST_ENTRY     Link;
PREGISTRY_EVENT pRegistryEvent;
} REGISTRY_EVENT_PACKET, * PREGISTRY_EVENT_PACKET;
/* Context stuff */
typedef struct _CAPTURE_REGISTRY_MANAGER
{
   PDEVICE_OBJECT deviceObject;
BOOLEAN bReady;
LARGE_INTEGER registryCallbackCookie;
LIST_ENTRY lQueuedRegistryEvents;
KTIMER connectionCheckerTimer;
KDPC connectionCheckerFunction;
KSPIN_LOCK lQueuedRegistryEventsSpinLock;
ULONG lastContactTime;
} CAPTURE_REGISTRY_MANAGER , *PCAPTURE_REGISTRY_MANAGER;
/* Methods */
NTSTATUS KDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS KDispatchCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS RegistryCallback(INPVOID CallbackContext, IN PVOID Argument1, IN PVOID Argument2);
//BOOLEAN GetRegistryObjectCompleteName(PREGISTRY_EVENT pRegistryEvent, PUNICODE_STRING pPartialObjectName, PVOID pRegistryObject);
//VOID QueueRegistryEvent(PREGISTRY_EVENT pRegistryEvent);
VOID UpdateLastContactTime();
ULONG GetCurrentTime();
NTSTATUS HandleIoctlGetRegEvents(IN PDEVICE_OBJECT DeviceObject, PIRP Irp,
    PIO_STACK_LOCATION pIoStackIrp, UINT *pdwDataWritten);
VOID ConnectionChecker(
   IN struct _KDPC *Dpc,
   IN PVOID DeferredContext,
   IN PVOID SystemArgument1,
   IN PVOID SystemArgument2
   );
/* Global values */
PDEVICE_OBJECT gpDeviceObject;
/* Main entry point into the driver, is called when the driver is loaded */
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
   NTSTATUS status;
   UNICODE_STRING uszDriverString;
   UNICODE_STRING uszDeviceString;
LARGE_INTEGER registryEventsTimeout;
   PDEVICE_OBJECT pDeviceObject;
   PCAPTURE_REGISTRY_MANAGER pRegistryManager;
  
// Point uszDriverString at the driver name
   RtlInitUnicodeString(&uszDriverString, L"\\Device\\RegistryMonitor");
   // Create and initialize device object
status = IoCreateDevice(
DriverObject,
       sizeof(CAPTURE_REGISTRY_MANAGER),
       &uszDriverString,
       FILE_DEVICE_UNKNOWN,
       0,
       FALSE,
       &pDeviceObject
);
   if(!NT_SUCCESS(status))
{
DbgPrint("RegistryMonitor: ERROR IoCreateDevice -> \\Device\\RegistryMonitor - %08x\n", status);
      return status;
}
  
/* Set global device object to newly created object */
gpDeviceObject = pDeviceObject;
/* Get the registr manager from the extension of the device */
pRegistryManager = gpDeviceObject->DeviceExtension;
pRegistryManager->bReady = FALSE;
  
/* Point uszDeviceString at the device name */
   RtlInitUnicodeString(&uszDeviceString, L"\\DosDevices\\RegistryMonitor");
/* Create symbolic link to the user-visible name */
   status = IoCreateSymbolicLink(&uszDeviceString, &us