请问监控注册表变化的api函数是什么?

2004-12-05 12:36:41 217 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

WINDOWS中Shell文件操作的监控（转载）一、利用WIN32API编制监视程序(哈尔滨赵晓辉)　　监视程序，这个名字听起来似乎很陌生。它的用途主要是在后台监视系统中关键信息的改变，比如注册表的改变及硬盘上由于文件操作引起的改变等等。　　也许有人会问了，编制这样的程序有什么价值呢？硬盘上文件改变了，我只要在资源管理器里点一点不就全都清楚了吗？问题当然不会这样简单，如今大家的硬盘都已经用G来做单位了，一块4.3G的硬盘中，大大小小的文件全都阅读详情

谢谢

...全文

注册表监控 /*@file RegNotify.h@author greenkugua@date 2008/05/28@version 1.0*/#pragma once #include #include #include #include using namespace std;//typedef enum RegType //{ // REGTYPE_DWORD, // REGTYPE_ST 阅读详情

manyaomm

VC/MFC 16,550 成员 421,606 内容

+ 关注 + 加入社区

切换为时间正序

pos0637 2005-01-27

打赏
举报

RegNotifyChangeKeyValue

The RegNotifyChangeKeyValue function notifies the caller about changes to the attributes or contents of a specified registry key. Note that the function does not notify the caller if the specified key is deleted.

LONG RegNotifyChangeKeyValue(

HKEY hKey, // handle of key to watch
BOOL bWatchSubtree, // flag for subkey notification
DWORD dwNotifyFilter, // changes to be reported
HANDLE hEvent, // handle of signaled event
BOOL fAsynchronous // flag for asynchronous reporting
);

Parameters

hKey

Identifies a currently open key or any of the following predefined reserved handle values:

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS

bWatchSubtree

Specifies a flag that indicates whether to report changes in the specified key and all of its subkeys or only in the specified key. If this parameter is TRUE, the function reports changes in the key and its subkeys. If the parameter is FALSE, the function reports changes only in the key.

dwNotifyFilter

Specifies a set of flags that control which changes should be reported. This parameter can be a combination of the following values:

Value Meaning
REG_NOTIFY_CHANGE_NAME Notify the caller if a subkey is added or deleted.
REG_NOTIFY_CHANGE_ATTRIBUTES Notify the caller of changes to the attributes of the key, such as the security descriptor information.
REG_NOTIFY_CHANGE_LAST_SET Notify the caller of changes to a value of the key. This can include adding or deleting a value, or changing an existing value.
REG_NOTIFY_CHANGE_SECURITY Notify the caller of changes to the security descriptor of the key.

hEvent

Identifies an event. If the fAsynchronous parameter is TRUE, the function returns immediately and changes are reported by signaling this event. If fAsynchronous is FALSE, hEvent is ignored.

fAsynchronous

Specifies a flag that indicates how the function reports changes. If this parameter is TRUE, the function returns immediately and reports changes by signaling the specified event. When this parameter is FALSE, the function does not return until a change has occurred.
If hEvent does not specify a valid event, the fAsynchronous parameter cannot be TRUE.

Return Values

If the function succeeds, the return value is ERROR_SUCCESS.
If the function fails, the return value is a nonzero error code defined in WINERROR.H. You can use the FormatMessage function with the FORMAT_MESSAGE_FROM_SYSTEM flag to get a generic description of the error.

Remarks

If the key identified by the hKey parameter is closed, the event is signaled. This means that an application should not depend on the key being open after returning from a wait operation on the event.
RegNotifyChangeKeyValue does not work with remote handles. If RegNotifyChangeKeyValue is called with an hKey value that is a remote handle, it returns ERROR_INVALID_HANDLE.

贴D的帮助,不能匿啊,ft

qrlvls 2005-01-27

打赏
举报

我想用hook来拦截对注册表的操作,可是不会
-------------------------------------------
用API钩子

qrlvls 2005-01-27

打赏
举报

RegNotifyChangeKeyValue

jun_01 2005-01-27

打赏
举报

我想用hook来拦截对注册表的操作,可是不会

请问监控注册表变化的api函数是什么?

相关推荐