注册表回调整体框架

标签：max   demo   fun   with   cut   rtl   ++   i++   process   

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)  
{  
    NTSTATUS ntStatus;  
    ntStatus = CmRegisterCallback(MyRegistryCallback, NULL,  &pCookie);  
      
    return ntStatus;  
}  
//see demo:  
//7eightl-minifilter\Demo\REG-hips  
  
  
  
  
  
  
NTSTATUS HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
{  
    NTSTATUS status = 0;  
    PUNICODE_STRING keyName;  
    UNICODE_STRING uTarget;  
  
  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyRegistryCallback(__in PVOID CallbackContext,__in_opt PVOID Argument1,            / / REG_NOTIFY_CLASS  __in_opt PVOID Argument2            //  KEY_INFORMATION ){  
            switch( (REG_NOTIFY_CLASS) Argument1)  
{  
         case RegNtPreDeleteKey :  
return HOOK_PreNtDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
          case RegNtPreRenameKey:  
return HOOK_PreNtRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
          case RegNtPreCreateKeyEx:  // pre 操作  
 return HOOK_PreNtCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
          case RegNtPostCreateKeyEx :    // post 操作  
return HOOK_PostNtCreateKeyEx((PRGG_POST_OPERATION_INFORMATION )}  
   }        
}                                                                                                                                  }  
  
  
  
  
main.c  
#include "precomp.h"  
  
  
#define     DEVICE_NAME                 L"\\device\\HipsRegDrv"  
#define     LINK_NAME                   L"\\dosDevices\\HipsRegDrv"  
  
  
  
  
// function to dispatch the IRPs  
NTSTATUS DispatchOK(PDEVICE_OBJECT DeviceObject, PIRP Irp)  
{  
   Irp->IoStatus.Status = STATUS_SUCCESS;  
   IoCompleteRequest(Irp,IO_NO_INCREMENT);  
   return STATUS_SUCCESS;  
}  
  
  
VOID DriverUnload (  
    IN PDRIVER_OBJECT   pDriverObject)   
{  
    UNICODE_STRING strLink;  
    RtlInitUnicodeString(&strLink, LINK_NAME);  
    stopRegMon();  
  
  
    IoDeleteSymbolicLink(&strLink);  
    IoDeleteDevice(pDriverObject->DeviceObject);  
  
  
    DbgPrint(" Unloaded\n");   
}  
  
  
  
  
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)  
{  
    UNICODE_STRING  DeviceName;  
    UNICODE_STRING  LinkName;    
    NTSTATUS        status;   
    PDEVICE_OBJECT  pDriverDeviceObject;    
    ULONG i;  
      
    //DbgPrint("Driver loaded.");  
    pDriverObject->DriverUnload = DriverUnload;     
      
    // init strings  
    RtlInitUnicodeString(&DeviceName, DEVICE_NAME);  
    RtlInitUnicodeString(&LinkName, LINK_NAME);  
      
    // to communicate with usermode, we need a device  
    status = IoCreateDevice(  
           pDriverObject,        // ptr to caller object  
           0,  // extension device allocated byte number  
           &DeviceName,         // device name   
           FILE_DEVICE_UNKNOWN,   
           0,                   // no special caracteristics  
           FALSE,               // we can open many handles in same time  
           &pDriverDeviceObject); // [OUT] ptr to the created object  
             
    if ( !NT_SUCCESS(status) )   
       return STATUS_NO_SUCH_DEVICE;  
      
    pDriverDeviceObject-> Flags |= DO_BUFFERED_IO;  
  
  
    // we also need a symbolic link  
    status = IoCreateSymbolicLink(&LinkName,&DeviceName);  
    if( !NT_SUCCESS(status) )   
    {  
        IoDeleteDevice( pDriverDeviceObject );  
        return STATUS_NO_SUCH_DEVICE;  
    }    
  
  
    for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)  
        pDriverObject->MajorFunction[i] = DispatchOK;   
      
  
  
    startRegMon(pDriverObject);  
    //Do other things...     
      
    return STATUS_SUCCESS;  
}  
  
  
precomp.h  
#ifndef _PRECOMP_H_  
#define _PRECOMP_H_  
#include <ntifs.h>  
#include <ntddk.h>  
#include <windef.h>  
#include "regmon.h"  
#endif  
  
  
regmon.c  
#include "precomp.h"  
  
  
GENERIC_MAPPING g_KeyMapping = {KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS};  
static WCHAR g_wszAltitude[] = L"370020";  
  
  
PGENERIC_MAPPING IoGetKeyGenericMapping( )  
{  
    return &g_KeyMapping;  
}  
  
  
BOOL MyObQueryObjectName(HANDLE hObjHandle, PUNICODE_STRING ustrObjectName, BOOL bNeedAllocateName)  
{  
    PVOID           pQueryBuffer        = NULL;  
    DWORD           dwReqSize           = 0;  
    NTSTATUS        ntStatus            = 0;  
    __try  
    {  
        dwReqSize = sizeof(OBJECT_NAME_INFORMATION) + (MAX_PATH + 32)*sizeof(WCHAR);  
          
        pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, ‘RFLM‘);  
          
        if(pQueryBuffer == NULL)  
            return FALSE;  
          
        ntStatus = ZwQueryObject(hObjHandle,   
            ObjectNameInfo,  
            pQueryBuffer,  
            dwReqSize,  
            &dwReqSize);  
          
        if((ntStatus == STATUS_INFO_LENGTH_MISMATCH) ||  
            (ntStatus == STATUS_BUFFER_OVERFLOW) ||  
            (ntStatus == STATUS_BUFFER_TOO_SMALL))  
        {  
            ExFreePool(pQueryBuffer);  
            pQueryBuffer = NULL;  
              
            pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, ‘RFLM‘);  
              
            if(pQueryBuffer == NULL)  
            {  
                return FALSE;  
            }  
              
            ntStatus = ZwQueryObject(hObjHandle,   
                ObjectNameInfo,  
                pQueryBuffer,  
                dwReqSize,  
                &dwReqSize);  
              
        }  
          
        if(NT_SUCCESS(ntStatus))  
        {   
            OBJECT_NAME_INFORMATION * pNameInfo = (OBJECT_NAME_INFORMATION *)pQueryBuffer;  
              
            if(bNeedAllocateName)  
            {  
                ustrObjectName->Buffer = ExAllocatePoolWithTag(PagedPool, pNameInfo->Name.Length + sizeof(WCHAR), ‘RFLM‘);  
                  
                if(ustrObjectName->Buffer)  
                {  
                    RtlZeroMemory(ustrObjectName->Buffer, pNameInfo->Name.Length + sizeof(WCHAR));  
                    ustrObjectName->Length = 0;  
                    ustrObjectName->MaximumLength = pNameInfo->Name.Length;  
                    RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
                }  
                else  
                    ntStatus = STATUS_INSUFFICIENT_RESOURCES;  
                  
            }  
            else  
                RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
        }  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
        ntStatus = GetExceptionCode();  
    }  
      
    if(pQueryBuffer)  
    {  
        ExFreePool(pQueryBuffer);  
        pQueryBuffer = NULL;  
    }  
      
    return NT_SUCCESS(ntStatus);  
}  
  
  
  
  
LARGE_INTEGER g_RegCookie;  
  
  
#if (NTDDI_VERSION >= NTDDI_VISTA)  
NTSTATUS TlGetObjectNameOnVistaAndLater(PVOID Object, PUNICODE_STRING Name)  
{  
    PUNICODE_STRING         pKeyName = NULL;  
    NTSTATUS                ntStatus = 0;  
  
  
    if(Object == NULL || Name == NULL)  
        return STATUS_INVALID_PARAMETER;  
  
  
    ntStatus = CmCallbackGetKeyObjectID(&g_RegCookie,  
                                      Object,  
                                      NULL,  
                                     &pKeyName);  
  
  
    if(NT_SUCCESS(ntStatus) == FALSE)  
    {  
        return ntStatus;  
    }  
  
  
    Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
                            PagedPool,   
                            pKeyName->Length,  
                            ‘RFLM‘  
                            );  
  
  
    if(Name->Buffer == NULL)  
    {  
        return STATUS_INSUFFICIENT_RESOURCES;  
    }  
  
  
    RtlZeroMemory(Name->Buffer, pKeyName->Length);  
  
  
    Name->Length = 0;  
    Name->MaximumLength = pKeyName->Length;  
  
  
    RtlCopyUnicodeString(Name, pKeyName);  
    return STATUS_SUCCESS;  
}  
#endif  
  
  
NTSTATUS TlGetObjectNameOnXP(PVOID Object, PUNICODE_STRING Name)  
{  
    UNICODE_STRING              ustrKeyName             = {0};  
    HANDLE                      ObjectHandle            = NULL;  
    NTSTATUS                    ntStatus                = 0;  
  
  
    if(Object == NULL || Name == NULL)  
        return STATUS_INVALID_PARAMETER;  
  
  
    ntStatus = ObOpenObjectByPointer(Object,  
                              OBJ_KERNEL_HANDLE ,  
                              0,  
                              0,  
                              NULL,  
                              KernelMode,  
                              &ObjectHandle);  
  
  
    if(NT_SUCCESS(ntStatus) == FALSE)  
    {  
        return ntStatus;  
    }  
  
  
    if(MyObQueryObjectName(ObjectHandle, &ustrKeyName, TRUE) == FALSE)  
    {  
        ZwClose(ObjectHandle);  
        return STATUS_INSUFFICIENT_RESOURCES;  
    }  
      
    ZwClose(ObjectHandle);  
  
  
    Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
                            PagedPool,   
                            ustrKeyName.Length,  
                            ‘RFLM‘  
                            );  
  
  
    if(Name->Buffer == NULL)  
    {  
        return STATUS_INSUFFICIENT_RESOURCES;  
    }  
  
  
    RtlZeroMemory(Name->Buffer, ustrKeyName.Length);  
  
  
    Name->Length = 0;  
    Name->MaximumLength = ustrKeyName.Length;  
  
  
    RtlCopyUnicodeString(Name, &ustrKeyName);  
    ExFreePool(ustrKeyName.Buffer);  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS TlGetObjectFullName(PVOID Object, PUNICODE_STRING Name)  
{  
#if (NTDDI_VERSION >= NTDDI_LONGHORN)  
    return TlGetObjectNameOnVistaAndLater(Object, Name);  
#else  
    return TlGetObjectNameOnXP(Object, Name);  
#endif  
}  
  
  
  
  
NTSTATUS MyDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
{  
    NTSTATUS            ntStatus        = 0;  
    UNICODE_STRING      ustrKeyName     = {0};  
  
  
    __try  
    {  
  
  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
            return STATUS_SUCCESS;  
        }  
        DbgPrint("DeleteKey Key:%wZ\n", &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MySetValueKey(PREG_SET_VALUE_KEY_INFORMATION Data)  
{  
    NTSTATUS                ntStatus                = 0;  
    UNICODE_STRING          ustrKeyName             = {0};  
    UNICODE_STRING          ustrTarget              = {0};  
    WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
  
  
    __try  
    {  
          
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
  
  
            return STATUS_SUCCESS;  
        }  
  
  
        ustrTarget.Buffer = wszKeyPath;  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  
  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
        if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1] != L‘\\‘ )  
            RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  
  
        RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
        DbgPrint("SetValueKey Key:%wZ\n", &ustrTarget);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyDeleteValueKey(PREG_DELETE_VALUE_KEY_INFORMATION Data)  
{  
    NTSTATUS                ntStatus                = 0;  
    UNICODE_STRING          ustrKeyName             = {0};  
    UNICODE_STRING          ustrTarget              = {0};  
    WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
  
  
  
  
    __try  
    {  
  
  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        ustrTarget.Buffer = wszKeyPath;  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
        if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1]!=L‘\\‘ )  
            RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  
  
        RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
        DbgPrint("DeleteValueKey Key:%wZ\n", &ustrTarget);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyRenameKey(PREG_RENAME_KEY_INFORMATION Data)  
{  
    NTSTATUS                ntStatus    = 0;  
    UNICODE_STRING          ustrKeyName = {0};  
      
    __try  
    {  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        DbgPrint("RenameKey Key:%wZ\n", &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyCreateKey(PREG_PRE_CREATE_KEY_INFORMATION Data)  
{  
    NTSTATUS            ntStatus                = 0;  
    UNICODE_STRING      ustrTarget              = {0};  
    WCHAR               wszKeyName[MAX_PATH]    = {0};  
  
  
    __try  
    {  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
          
        ustrTarget.Buffer = wszKeyName;  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, Data->CompleteName);  
        DbgPrint("CreateKey Key:%wZ\n", &ustrTarget);  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyCreateKeyEx(PREG_CREATE_KEY_INFORMATION Data)  
{  
    NTSTATUS            ntStatus    = 0;  
    UNICODE_STRING      ustrKeyName = {0};  
    UNICODE_STRING      ustrTarget  = {0};  
  
  
    __try  
    {  
        if((ExGetPreviousMode() == KernelMode))  
        {  
  
  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->RootObject, &ustrKeyName)) == FALSE)  
        {  
  
  
            return STATUS_SUCCESS;  
        }  
  
  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
          
        if(Data->CompleteName)  
        {  
            RtlAppendUnicodeToString(&ustrTarget, L"\\");  
            RtlAppendUnicodeStringToString(&ustrTarget, Data->CompleteName);  
        }  
  
  
        DbgPrint("CreateKeyEx :%wZ\n", ustrTarget);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
  
  
NTSTATUS MyRegCallback  
(  
    PVOID CallbackContext,   
    PVOID Argument1,   
    PVOID Argument2  
)  
{  
    switch( (REG_NOTIFY_CLASS) Argument1)  
    {  
    case RegNtPreDeleteKey :  
        return MyDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
    case RegNtPreSetValueKey:  
        return MySetValueKey((PREG_SET_VALUE_KEY_INFORMATION) Argument2);  
    case RegNtPreDeleteValueKey:  
        return MyDeleteValueKey((PREG_DELETE_VALUE_KEY_INFORMATION) Argument2);  
    case RegNtPreRenameKey:  
        return MyRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
    case RegNtPreCreateKey:  
        return MyCreateKey((PREG_PRE_CREATE_KEY_INFORMATION) Argument2);      
    case RegNtPreCreateKeyEx:  
        return MyCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS startRegMon(PDRIVER_OBJECT driverObject)  
{  
#if (NTDDI_VERSION >= NTDDI_VISTA)  
    UNICODE_STRING uAltitude;  
  
  
    RtlInitUnicodeString(&uAltitude, g_wszAltitude);  
    return CmRegisterCallbackEx(MyRegCallback,  
                          &uAltitude,  
                          driverObject,  
                          NULL,  
                          &g_RegCookie,  
                          NULL);      
#else  
    return CmRegisterCallback(MyRegCallback,  
                              NULL,  
                             &g_RegCookie);  
  
  
#endif  
                            
}  
  
  
VOID stopRegMon( )  
{  
    CmUnRegisterCallback(g_RegCookie);  
}  
  
  
  
  
  
  
regmon.c  
#ifndef __REGMON_H__  
#define __REGMON_H__  
  
  
typedef enum _OBJECT_INFO_CLASS {  
    ObjectBasicInfo,  
        ObjectNameInfo,  
        ObjectTypeInfo,  
        ObjectAllTypesInfo,  
        ObjectProtectionInfo  
} OBJECT_INFO_CLASS;  
  
  
  
  
PGENERIC_MAPPING IoGetKeyGenericMapping( );  
  
  
NTSTATUS   
MyRegCallback  
(  
    PVOID CallbackContext,   
    PVOID Argument1,   
    PVOID Argument2  
);  
  
  
  
  
NTSTATUS startRegMon(PDRIVER_OBJECT driverObject);  
VOID stopRegMon( );  
  
  
  
  
#endif  

1. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)  
2. {  
3.     NTSTATUS ntStatus;  
4.     ntStatus = CmRegisterCallback(MyRegistryCallback, NULL,  &pCookie);  
5.       
6.     return ntStatus;  
7. }  
8. //see demo:  
9. //7eightl-minifilter\Demo\REG-hips  
10.   
11.   
12.   
13.   
14.   
15.   
16. NTSTATUS HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
17. {  
18.     NTSTATUS status = 0;  
19.     PUNICODE_STRING keyName;  
20.     UNICODE_STRING uTarget;  
21.   
22.   
23.   
24.   
25.     return STATUS_SUCCESS;  
26. }  
27.   
28.   
29. NTSTATUS MyRegistryCallback(__in PVOID CallbackContext,__in_opt PVOID Argument1,            / / REG_NOTIFY_CLASS  __in_opt PVOID Argument2            //  KEY_INFORMATION ){  
30.             switch( (REG_NOTIFY_CLASS) Argument1)  
31. {  
32.          case RegNtPreDeleteKey :  
33. return HOOK_PreNtDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
34.           case RegNtPreRenameKey:  
35. return HOOK_PreNtRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
36.           case RegNtPreCreateKeyEx:  // pre 操作  
37.  return HOOK_PreNtCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
38.           case RegNtPostCreateKeyEx :    // post 操作  
39. return HOOK_PostNtCreateKeyEx((PRGG_POST_OPERATION_INFORMATION )}  
40.    }        
41. }                                                                                                                                  }  
42.   
43.   
44.   
45.   
46. main.c  
47. #include "precomp.h"  
48.   
49.   
50. #define     DEVICE_NAME                 L"\\device\\HipsRegDrv"  
51. #define     LINK_NAME                   L"\\dosDevices\\HipsRegDrv"  
52.   
53.   
54.   
55.   
56. // function to dispatch the IRPs  
57. NTSTATUS DispatchOK(PDEVICE_OBJECT DeviceObject, PIRP Irp)  
58. {  
59.    Irp->IoStatus.Status = STATUS_SUCCESS;  
60.    IoCompleteRequest(Irp,IO_NO_INCREMENT);  
61.    return STATUS_SUCCESS;  
62. }  
63.   
64.   
65. VOID DriverUnload (  
66.     IN PDRIVER_OBJECT   pDriverObject)   
67. {  
68.     UNICODE_STRING strLink;  
69.     RtlInitUnicodeString(&strLink, LINK_NAME);  
70.     stopRegMon();  
71.   
72.   
73.     IoDeleteSymbolicLink(&strLink);  
74.     IoDeleteDevice(pDriverObject->DeviceObject);  
75.   
76.   
77.     DbgPrint(" Unloaded\n");   
78. }  
79.   
80.   
81.   
82.   
83. NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)  
84. {  
85.     UNICODE_STRING  DeviceName;  
86.     UNICODE_STRING  LinkName;    
87.     NTSTATUS        status;   
88.     PDEVICE_OBJECT  pDriverDeviceObject;    
89.     ULONG i;  
90.       
91.     //DbgPrint("Driver loaded.");  
92.     pDriverObject->DriverUnload = DriverUnload;     
93.       
94.     // init strings  
95.     RtlInitUnicodeString(&DeviceName, DEVICE_NAME);  
96.     RtlInitUnicodeString(&LinkName, LINK_NAME);  
97.       
98.     // to communicate with usermode, we need a device  
99.     status = IoCreateDevice(  
100.            pDriverObject,        // ptr to caller object  
101.            0,  // extension device allocated byte number  
102.            &DeviceName,         // device name   
103.            FILE_DEVICE_UNKNOWN,   
104.            0,                   // no special caracteristics  
105.            FALSE,               // we can open many handles in same time  
106.            &pDriverDeviceObject); // [OUT] ptr to the created object  
107.              
108.     if ( !NT_SUCCESS(status) )   
109.        return STATUS_NO_SUCH_DEVICE;  
110.       
111.     pDriverDeviceObject-> Flags |= DO_BUFFERED_IO;  
112.   
113.   
114.     // we also need a symbolic link  
115.     status = IoCreateSymbolicLink(&LinkName,&DeviceName);  
116.     if( !NT_SUCCESS(status) )   
117.     {  
118.         IoDeleteDevice( pDriverDeviceObject );  
119.         return STATUS_NO_SUCH_DEVICE;  
120.     }    
121.   
122.   
123.     for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)  
124.         pDriverObject->MajorFunction[i] = DispatchOK;   
125.       
126.   
127.   
128.     startRegMon(pDriverObject);  
129.     //Do other things...     
130.       
131.     return STATUS_SUCCESS;  
132. }  
133.   
134.   
135. precomp.h  
136. #ifndef _PRECOMP_H_  
137. #define _PRECOMP_H_  
138. #include <ntifs.h>  
139. #include <ntddk.h>  
140. #include <windef.h>  
141. #include "regmon.h"  
142. #endif  
143.   
144.   
145. regmon.c  
146. #include "precomp.h"  
147.   
148.   
149. GENERIC_MAPPING g_KeyMapping = {KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS};  
150. static WCHAR g_wszAltitude[] = L"370020";  
151.   
152.   
153. PGENERIC_MAPPING IoGetKeyGenericMapping( )  
154. {  
155.     return &g_KeyMapping;  
156. }  
157.   
158.   
159. BOOL MyObQueryObjectName(HANDLE hObjHandle, PUNICODE_STRING ustrObjectName, BOOL bNeedAllocateName)  
160. {  
161.     PVOID           pQueryBuffer        = NULL;  
162.     DWORD           dwReqSize           = 0;  
163.     NTSTATUS        ntStatus            = 0;  
164.     __try  
165.     {  
166.         dwReqSize = sizeof(OBJECT_NAME_INFORMATION) + (MAX_PATH + 32)*sizeof(WCHAR);  
167.           
168.         pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, ‘RFLM‘);  
169.           
170.         if(pQueryBuffer == NULL)  
171.             return FALSE;  
172.           
173.         ntStatus = ZwQueryObject(hObjHandle,   
174.             ObjectNameInfo,  
175.             pQueryBuffer,  
176.             dwReqSize,  
177.             &dwReqSize);  
178.           
179.         if((ntStatus == STATUS_INFO_LENGTH_MISMATCH) ||  
180.             (ntStatus == STATUS_BUFFER_OVERFLOW) ||  
181.             (ntStatus == STATUS_BUFFER_TOO_SMALL))  
182.         {  
183.             ExFreePool(pQueryBuffer);  
184.             pQueryBuffer = NULL;  
185.               
186.             pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, ‘RFLM‘);  
187.               
188.             if(pQueryBuffer == NULL)  
189.             {  
190.                 return FALSE;  
191.             }  
192.               
193.             ntStatus = ZwQueryObject(hObjHandle,   
194.                 ObjectNameInfo,  
195.                 pQueryBuffer,  
196.                 dwReqSize,  
197.                 &dwReqSize);  
198.               
199.         }  
200.           
201.         if(NT_SUCCESS(ntStatus))  
202.         {   
203.             OBJECT_NAME_INFORMATION * pNameInfo = (OBJECT_NAME_INFORMATION *)pQueryBuffer;  
204.               
205.             if(bNeedAllocateName)  
206.             {  
207.                 ustrObjectName->Buffer = ExAllocatePoolWithTag(PagedPool, pNameInfo->Name.Length + sizeof(WCHAR), ‘RFLM‘);  
208.                   
209.                 if(ustrObjectName->Buffer)  
210.                 {  
211.                     RtlZeroMemory(ustrObjectName->Buffer, pNameInfo->Name.Length + sizeof(WCHAR));  
212.                     ustrObjectName->Length = 0;  
213.                     ustrObjectName->MaximumLength = pNameInfo->Name.Length;  
214.                     RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
215.                 }  
216.                 else  
217.                     ntStatus = STATUS_INSUFFICIENT_RESOURCES;  
218.                   
219.             }  
220.             else  
221.                 RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
222.         }  
223.     }  
224.     __except(EXCEPTION_EXECUTE_HANDLER)  
225.     {  
226.         ntStatus = GetExceptionCode();  
227.     }  
228.       
229.     if(pQueryBuffer)  
230.     {  
231.         ExFreePool(pQueryBuffer);  
232.         pQueryBuffer = NULL;  
233.     }  
234.       
235.     return NT_SUCCESS(ntStatus);  
236. }  
237.   
238.   
239.   
240.   
241. LARGE_INTEGER g_RegCookie;  
242.   
243.   
244. #if (NTDDI_VERSION >= NTDDI_VISTA)  
245. NTSTATUS TlGetObjectNameOnVistaAndLater(PVOID Object, PUNICODE_STRING Name)  
246. {  
247.     PUNICODE_STRING         pKeyName = NULL;  
248.     NTSTATUS                ntStatus = 0;  
249.   
250.   
251.     if(Object == NULL || Name == NULL)  
252.         return STATUS_INVALID_PARAMETER;  
253.   
254.   
255.     ntStatus = CmCallbackGetKeyObjectID(&g_RegCookie,  
256.                                       Object,  
257.                                       NULL,  
258.                                      &pKeyName);  
259.   
260.   
261.     if(NT_SUCCESS(ntStatus) == FALSE)  
262.     {  
263.         return ntStatus;  
264.     }  
265.   
266.   
267.     Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
268.                             PagedPool,   
269.                             pKeyName->Length,  
270.                             ‘RFLM‘  
271.                             );  
272.   
273.   
274.     if(Name->Buffer == NULL)  
275.     {  
276.         return STATUS_INSUFFICIENT_RESOURCES;  
277.     }  
278.   
279.   
280.     RtlZeroMemory(Name->Buffer, pKeyName->Length);  
281.   
282.   
283.     Name->Length = 0;  
284.     Name->MaximumLength = pKeyName->Length;  
285.   
286.   
287.     RtlCopyUnicodeString(Name, pKeyName);  
288.     return STATUS_SUCCESS;  
289. }  
290. #endif  
291.   
292.   
293. NTSTATUS TlGetObjectNameOnXP(PVOID Object, PUNICODE_STRING Name)  
294. {  
295.     UNICODE_STRING              ustrKeyName             = {0};  
296.     HANDLE                      ObjectHandle            = NULL;  
297.     NTSTATUS                    ntStatus                = 0;  
298.   
299.   
300.     if(Object == NULL || Name == NULL)  
301.         return STATUS_INVALID_PARAMETER;  
302.   
303.   
304.     ntStatus = ObOpenObjectByPointer(Object,  
305.                               OBJ_KERNEL_HANDLE ,  
306.                               0,  
307.                               0,  
308.                               NULL,  
309.                               KernelMode,  
310.                               &ObjectHandle);  
311.   
312.   
313.     if(NT_SUCCESS(ntStatus) == FALSE)  
314.     {  
315.         return ntStatus;  
316.     }  
317.   
318.   
319.     if(MyObQueryObjectName(ObjectHandle, &ustrKeyName, TRUE) == FALSE)  
320.     {  
321.         ZwClose(ObjectHandle);  
322.         return STATUS_INSUFFICIENT_RESOURCES;  
323.     }  
324.       
325.     ZwClose(ObjectHandle);  
326.   
327.   
328.     Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
329.                             PagedPool,   
330.                             ustrKeyName.Length,  
331.                             ‘RFLM‘  
332.                             );  
333.   
334.   
335.     if(Name->Buffer == NULL)  
336.     {  
337.         return STATUS_INSUFFICIENT_RESOURCES;  
338.     }  
339.   
340.   
341.     RtlZeroMemory(Name->Buffer, ustrKeyName.Length);  
342.   
343.   
344.     Name->Length = 0;  
345.     Name->MaximumLength = ustrKeyName.Length;  
346.   
347.   
348.     RtlCopyUnicodeString(Name, &ustrKeyName);  
349.     ExFreePool(ustrKeyName.Buffer);  
350.   
351.   
352.     return STATUS_SUCCESS;  
353. }  
354.   
355.   
356. NTSTATUS TlGetObjectFullName(PVOID Object, PUNICODE_STRING Name)  
357. {  
358. #if (NTDDI_VERSION >= NTDDI_LONGHORN)  
359.     return TlGetObjectNameOnVistaAndLater(Object, Name);  
360. #else  
361.     return TlGetObjectNameOnXP(Object, Name);  
362. #endif  
363. }  
364.   
365.   
366.   
367.   
368. NTSTATUS MyDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
369. {  
370.     NTSTATUS            ntStatus        = 0;  
371.     UNICODE_STRING      ustrKeyName     = {0};  
372.   
373.   
374.     __try  
375.     {  
376.   
377.   
378.         if((ExGetPreviousMode() == KernelMode))  
379.         {  
380.             return STATUS_SUCCESS;  
381.         }  
382.   
383.   
384.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
385.         {  
386.             return STATUS_SUCCESS;  
387.         }  
388.         DbgPrint("DeleteKey Key:%wZ\n", &ustrKeyName);  
389.   
390.   
391.         ExFreePool(ustrKeyName.Buffer);  
392.   
393.   
394.     }  
395.     __except(EXCEPTION_EXECUTE_HANDLER)  
396.     {  
397.     }  
398.   
399.   
400.     return STATUS_SUCCESS;  
401. }  
402.   
403.   
404. NTSTATUS MySetValueKey(PREG_SET_VALUE_KEY_INFORMATION Data)  
405. {  
406.     NTSTATUS                ntStatus                = 0;  
407.     UNICODE_STRING          ustrKeyName             = {0};  
408.     UNICODE_STRING          ustrTarget              = {0};  
409.     WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
410.   
411.   
412.     __try  
413.     {  
414.           
415.         if((ExGetPreviousMode() == KernelMode))  
416.         {  
417.             return STATUS_SUCCESS;  
418.         }  
419.   
420.   
421.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
422.         {  
423.   
424.   
425.             return STATUS_SUCCESS;  
426.         }  
427.   
428.   
429.         ustrTarget.Buffer = wszKeyPath;  
430.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
431.           
432.         RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
433.   
434.   
435.   
436.   
437.         ExFreePool(ustrKeyName.Buffer);  
438.   
439.   
440.         if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1] != L‘\\‘ )  
441.             RtlAppendUnicodeToString(&ustrTarget, L"\\");  
442.   
443.   
444.         RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
445.         DbgPrint("SetValueKey Key:%wZ\n", &ustrTarget);  
446.   
447.   
448.     }  
449.     __except(EXCEPTION_EXECUTE_HANDLER)  
450.     {  
451.   
452.   
453.     }  
454.   
455.   
456.     return STATUS_SUCCESS;  
457. }  
458.   
459.   
460. NTSTATUS MyDeleteValueKey(PREG_DELETE_VALUE_KEY_INFORMATION Data)  
461. {  
462.     NTSTATUS                ntStatus                = 0;  
463.     UNICODE_STRING          ustrKeyName             = {0};  
464.     UNICODE_STRING          ustrTarget              = {0};  
465.     WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
466.   
467.   
468.   
469.   
470.     __try  
471.     {  
472.   
473.   
474.         if((ExGetPreviousMode() == KernelMode))  
475.         {  
476.             return STATUS_SUCCESS;  
477.         }  
478.   
479.   
480.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
481.         {  
482.             return STATUS_SUCCESS;  
483.         }  
484.   
485.   
486.         ustrTarget.Buffer = wszKeyPath;  
487.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
488.           
489.         RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
490.   
491.   
492.         ExFreePool(ustrKeyName.Buffer);  
493.   
494.   
495.         if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1]!=L‘\\‘ )  
496.             RtlAppendUnicodeToString(&ustrTarget, L"\\");  
497.   
498.   
499.         RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
500.         DbgPrint("DeleteValueKey Key:%wZ\n", &ustrTarget);  
501.   
502.   
503.     }  
504.     __except(EXCEPTION_EXECUTE_HANDLER)  
505.     {  
506.   
507.   
508.     }  
509.   
510.   
511.     return STATUS_SUCCESS;  
512. }  
513.   
514.   
515. NTSTATUS MyRenameKey(PREG_RENAME_KEY_INFORMATION Data)  
516. {  
517.     NTSTATUS                ntStatus    = 0;  
518.     UNICODE_STRING          ustrKeyName = {0};  
519.       
520.     __try  
521.     {  
522.         if((ExGetPreviousMode() == KernelMode))  
523.         {  
524.             return STATUS_SUCCESS;  
525.         }  
526.   
527.   
528.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
529.         {  
530.             return STATUS_SUCCESS;  
531.         }  
532.   
533.   
534.         DbgPrint("RenameKey Key:%wZ\n", &ustrKeyName);  
535.   
536.   
537.         ExFreePool(ustrKeyName.Buffer);  
538.   
539.   
540.   
541.   
542.     }  
543.     __except(EXCEPTION_EXECUTE_HANDLER)  
544.     {  
545.   
546.   
547.     }  
548.   
549.   
550.     return STATUS_SUCCESS;  
551. }  
552.   
553.   
554. NTSTATUS MyCreateKey(PREG_PRE_CREATE_KEY_INFORMATION Data)  
555. {  
556.     NTSTATUS            ntStatus                = 0;  
557.     UNICODE_STRING      ustrTarget              = {0};  
558.     WCHAR               wszKeyName[MAX_PATH]    = {0};  
559.   
560.   
561.     __try  
562.     {  
563.         if((ExGetPreviousMode() == KernelMode))  
564.         {  
565.             return STATUS_SUCCESS;  
566.         }  
567.           
568.         ustrTarget.Buffer = wszKeyName;  
569.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
570.           
571.         RtlCopyUnicodeString(&ustrTarget, Data->CompleteName);  
572.         DbgPrint("CreateKey Key:%wZ\n", &ustrTarget);  
573.     }  
574.     __except(EXCEPTION_EXECUTE_HANDLER)  
575.     {  
576.     }  
577.   
578.   
579.     return STATUS_SUCCESS;  
580. }  
581.   
582.   
583. NTSTATUS MyCreateKeyEx(PREG_CREATE_KEY_INFORMATION Data)  
584. {  
585.     NTSTATUS            ntStatus    = 0;  
586.     UNICODE_STRING      ustrKeyName = {0};  
587.     UNICODE_STRING      ustrTarget  = {0};  
588.   
589.   
590.     __try  
591.     {  
592.         if((ExGetPreviousMode() == KernelMode))  
593.         {  
594.   
595.   
596.             return STATUS_SUCCESS;  
597.         }  
598.   
599.   
600.         if(NT_SUCCESS(TlGetObjectFullName(Data->RootObject, &ustrKeyName)) == FALSE)  
601.         {  
602.   
603.   
604.             return STATUS_SUCCESS;  
605.         }  
606.   
607.   
608.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
609.           
610.         RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
611.   
612.   
613.         ExFreePool(ustrKeyName.Buffer);  
614.           
615.         if(Data->CompleteName)  
616.         {  
617.             RtlAppendUnicodeToString(&ustrTarget, L"\\");  
618.             RtlAppendUnicodeStringToString(&ustrTarget, Data->CompleteName);  
619.         }  
620.   
621.   
622.         DbgPrint("CreateKeyEx :%wZ\n", ustrTarget);  
623.   
624.   
625.     }  
626.     __except(EXCEPTION_EXECUTE_HANDLER)  
627.     {  
628.   
629.   
630.     }  
631.   
632.   
633.     return STATUS_SUCCESS;  
634. }  
635.   
636.   
637.   
638.   
639. NTSTATUS MyRegCallback  
640. (  
641.     PVOID CallbackContext,   
642.     PVOID Argument1,   
643.     PVOID Argument2  
644. )  
645. {  
646.     switch( (REG_NOTIFY_CLASS) Argument1)  
647.     {  
648.     case RegNtPreDeleteKey :  
649.         return MyDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
650.     case RegNtPreSetValueKey:  
651.         return MySetValueKey((PREG_SET_VALUE_KEY_INFORMATION) Argument2);  
652.     case RegNtPreDeleteValueKey:  
653.         return MyDeleteValueKey((PREG_DELETE_VALUE_KEY_INFORMATION) Argument2);  
654.     case RegNtPreRenameKey:  
655.         return MyRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
656.     case RegNtPreCreateKey:  
657.         return MyCreateKey((PREG_PRE_CREATE_KEY_INFORMATION) Argument2);      
658.     case RegNtPreCreateKeyEx:  
659.         return MyCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
660.   
661.   
662.     }  
663.   
664.   
665.     return STATUS_SUCCESS;  
666. }  
667.   
668.   
669. NTSTATUS startRegMon(PDRIVER_OBJECT driverObject)  
670. {  
671. #if (NTDDI_VERSION >= NTDDI_VISTA)  
672.     UNICODE_STRING uAltitude;  
673.   
674.   
675.     RtlInitUnicodeString(&uAltitude, g_wszAltitude);  
676.     return CmRegisterCallbackEx(MyRegCallback,  
677.                           &uAltitude,  
678.                           driverObject,  
679.                           NULL,  
680.                           &g_RegCookie,  
681.                           NULL);      
682. #else  
683.     return CmRegisterCallback(MyRegCallback,  
684.                               NULL,  
685.                              &g_RegCookie);  
686.   
687.   
688. #endif  
689.                             
690. }  
691.   
692.   
693. VOID stopRegMon( )  
694. {  
695.     CmUnRegisterCallback(g_RegCookie);  
696. }  
697.   
698.   
699.   
700.   
701.   
702.   
703. regmon.c  
704. #ifndef __REGMON_H__  
705. #define __REGMON_H__  
706.   
707.   
708. typedef enum _OBJECT_INFO_CLASS {  
709.     ObjectBasicInfo,  
710.         ObjectNameInfo,  
711.         ObjectTypeInfo,  
712.         ObjectAllTypesInfo,  
713.         ObjectProtectionInfo  
714. } OBJECT_INFO_CLASS;  
715.   
716.   
717.   
718.   
719. PGENERIC_MAPPING IoGetKeyGenericMapping( );  
720.   
721.   
722. NTSTATUS   
723. MyRegCallback  
724. (  
725.     PVOID CallbackContext,   
726.     PVOID Argument1,   
727.     PVOID Argument2  
728. );  
729.   
730.   
731.   
732.   
733. NTSTATUS startRegMon(PDRIVER_OBJECT driverObject);  
734. VOID stopRegMon( );  
735.   
736.   
737.   
738.   
739. #endif  

注册表回调整体框架

标签：max   demo   fun   with   cut   rtl   ++   i++   process   

原文地址：http://www.cnblogs.com/wongnel/p/7701367.html