RegNotifyChangeKeyValue的问题。

[bridge]

我用这个函数来监测注册表有没有被非法的改动。
用一个线程来实现这个代码，但问题是：我能够收到第一次的改动消息
但以后的改动就收不到了。
以下代码在线程函数中。
DWORD WINAPI ThreadWatchReg(LPVOID lpParam)
{
CString logmsg;
HANDLE mWatchReg;

logmsg.Format("线程创建成功!准备监控注册表!");
::SendMessage(AfxGetViewHand(),BRIDGE_ADDLOG,(WPARAM)(LPCTSTR)logmsg,0);

// create event
mWatchReg = CreateEvent(NULL,TRUE,TRUE,"");
if (!mWatchReg)
{
//add log
logmsg.Format("创建Event失败! 代码: %ld",GetLastError());
::SendMessage(AfxGetViewHand(),BRIDGE_ADDLOG,(WPARAM)(LPCTSTR)logmsg,0);
return -1;
}

HKEY hreg;
DWORD ret;
CString subkey;
subkey.LoadString (IDS_REG_RUN);
ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE,subkey,0,KEY_NOTIFY,&hreg);
if (ret !=ERROR_SUCCESS)
{
//add log
logmsg.Format("打开注册表失败! 代码: %ld",GetLastError());
::SendMessage(AfxGetViewHand(),BRIDGE_ADDLOG,(WPARAM)(LPCTSTR)logmsg,0);
return -1;
}
ret = RegNotifyChangeKeyValue(hreg,
TRUE,
REG_NOTIFY_CHANGE_LAST_SET,
mWatchReg,
TRUE);
if (ret!=ERROR_SUCCESS)
{
// add log
logmsg.Format("打开注册表监视器失败! 代码: %ld",GetLastError());
::SendMessage(AfxGetViewHand(),BRIDGE_ADDLOG,(WPARAM)(LPCTSTR)logmsg,0);
RegCloseKey(hreg);
return -1;
}
while(1)
{
ret = WaitForSingleObject(mWatchReg,5*1000);
if (ret == WAIT_OBJECT_0)
{
// addlog
ResetEvent(mWatchReg);
::SendMessage(AfxGetViewHand(),BRIDGE_REGCHANGED,0,0);
}
else if (ret==WAIT_TIMEOUT)
{
//add log
logmsg.Format("本次注册表监控时间到,进入下一轮监控期!",GetLastError());
::SendMessage(AfxGetViewHand(),BRIDGE_ADDLOG,(WPARAM)(LPCTSTR)logmsg,0);
}
}
ret = RegCloseKey(hreg);
return 1;
}


如果上面这种方法不好，或者行不同，大家有什么想法，可以随意!

[bridge]

i am appreciated for any advice!

[silver]

出现这样的情况,可以检查一下代码是否有资源没有释放

[bridge]

我在CODEGURU上有人给了答复。

This is an excerpt from RegNotifyChangeKeyValue documentation:

"When the event is signaled, RegNotifyChangeKeyValue ends its
monitoring of the key value. If you want to monitor further
changes in the value of the key, call RegNotifyChangeKeyValue
again".

This means you should call RegNotifyChangeKeyValue <b>inside</b>
the loop.

Also take a look at following KB article:
<A HREF="http://support.microsoft.com/support/kb/articles/Q236/5/70.ASP">http://support.microsoft.com/support/kb/articles/Q236/5/70.ASP</A>