注册表监控 驱动代码

该代码利用微软提供的注册表回调函数CmRegisterCallback, 无需任何SSDT hook
不仅能够进行注册表监控，还可以拦截。
驱动完整代码如下：
#define NTDDI_WINXPSP2                      0x05010200
#define OSVERSION_MASK      0xFFFF0000
#define SPVERSION_MASK      0x0000FF00
#define SUBVERSION_MASK     0x000000FF

//
// macros to extract various version fields from the NTDDI version
//
#define OSVER(Version)  ((Version) & OSVERSION_MASK)
#define SPVER(Version)  (((Version) & SPVERSION_MASK) >> 8)
#define SUBVER(Version) (((Version) & SUBVERSION_MASK) )
//#define NTDDI_VERSION   NTDDI_WINXPSP2
#include <ntifs.h>
#include <wdm.h>
#include <ntstrsafe.h>
#define FILE_DEVICE_UNKNOWN 0x00000022
#define IOCTL_UNKNOWN_BASE FILE_DEVICE_UNKNOWN
#define IOCTL_CAPTURE_GET_REGEVENTS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER,FILE_READ_DATA | FILE_WRITE_DATA)
#define USERSPACE_CONNECTION_TIMEOUT 10
#define REGISTRY_POOL_TAG 'pRE'
typedef unsigned int UINT;
typedef char* PCHAR;
typedef PVOID POBJECT;
/* Registry event */
typedef struct  _REGISTRY_EVENT
{
    REG_NOTIFY_CLASS eventType;
    TIME_FIELDS time;
    HANDLE processId;
    ULONG dataType;
    ULONG dataLengthB;
    ULONG registryPathLengthB;
    /* Contains path and optionally data */
    UCHAR registryData[];
} REGISTRY_EVENT, *PREGISTRY_EVENT;
/* Storage for registry event to be put into a linked list */
typedef struct  _REGISTRY_EVENT_PACKET
{
    LIST_ENTRY     Link;
    PREGISTRY_EVENT pRegistryEvent;
} REGISTRY_EVENT_PACKET, *PREGISTRY_EVENT_PACKET;
/* Context stuff */
typedef struct _CAPTURE_REGISTRY_MANAGER
{
    PDEVICE_OBJECT deviceObject;
    BOOLEAN bReady;
    LARGE_INTEGER  registryCallbackCookie;
    LIST_ENTRY lQueuedRegistryEvents;
    KTIMER connectionCheckerTimer;
    KDPC connectionCheckerFunction;
    KSPIN_LOCK lQueuedRegistryEventsSpinLock;
    ULONG lastContactTime;
} CAPTURE_REGISTRY_MANAGER, *PCAPTURE_REGISTRY_MANAGER;
/* Methods */
NTSTATUS KDispatchIoctl ( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp );
NTSTATUS KDispatchCreateClose ( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp );
VOID UnloadDriver ( PDRIVER_OBJECT DriverObject );
NTSTATUS RegistryCallback ( IN PVOID CallbackContext, IN PVOID  Argument1, IN PVOID  Argument2 );
//BOOLEAN GetRegistryObjectCompleteName(PREGISTRY_EVENT pRegistryEvent, PUNICODE_STRING pPartialObjectName, PVOID pRegistryObject);
//VOID QueueRegistryEvent(PREGISTRY_EVENT pRegistryEvent);
VOID UpdateLastContactTime();
ULONG GetCurrentTime();
NTSTATUS HandleIoctlGetRegEvents ( IN PDEVICE_OBJECT DeviceObject, PIRP Irp,
                                   PIO_STACK_LOCATION pIoStackIrp, UINT* pdwDataWritten );
VOID ConnectionChecker (
                IN struct _KDPC*  Dpc,
                IN PVOID  DeferredContext,
                IN PVOID  SystemArgument1,
                IN PVOID  SystemArgument2
);
/* Global values */
PDEVICE_OBJECT gpDeviceObject;

/* Main entry point into the driver, is called when the driver is loaded */
NTSTATUS DriverEntry (
                IN PDRIVER_OBJECT DriverObject,
                IN PUNICODE_STRING RegistryPath
)
{
    NTSTATUS status;
    UNICODE_STRING uszDriverString;
    UNICODE_STRING uszDeviceString;
    LARGE_INTEGER registryEventsTimeout;
    PDEVICE_OBJECT pDeviceObject;
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    // Point uszDriverString at the driver name
    RtlInitUnicodeString ( &uszDriverString, L"[url=file://\\Device\\RegistryMonitor]\\Device\\RegistryMonitor[/url]" );
    // Create and initialize device object
    status = IoCreateDevice (
                             DriverObject,
                             sizeof ( CAPTURE_REGISTRY_MANAGER ),
                             &uszDriverString,
                             FILE_DEVICE_UNKNOWN,
                             0,
                             FALSE,
                             &pDeviceObject
             );
    if ( !NT_SUCCESS ( status ) )
        {
            DbgPrint ( "RegistryMonitor: ERROR IoCreateDevice ->  [url=file://\\Device\\RegistryMonitor]\\Device\\RegistryMonitor[/url] - %08x\n", status );
            return status;
        }
    /* Set global device object to newly created object */
    gpDeviceObject = pDeviceObject;
    /* Get the registr manager from the extension of the device */
    pRegistryManager = gpDeviceObject->DeviceExtension;
    pRegistryManager->bReady = FALSE;
    /* Point uszDeviceString at the device name */
    RtlInitUnicodeString ( &uszDeviceString, L"[url=file://\\DosDevices\\RegistryMonitor]\\DosDevices\\RegistryMonitor[/url]" );
    /* Create symbolic link to the user-visible name */
    status = IoCreateSymbolicLink ( &uszDeviceString, &uszDriverString );
    if ( !NT_SUCCESS ( status ) )
        {
            DbgPrint ( "RegistryMonitor: ERROR IoCreateSymbolicLink ->  [url=file://\\DosDevices\\RegistryMonitor]\\DosDevices\\RegistryMonitor[/url] - %08x\n",
                       status );
            IoDeleteDevice ( pDeviceObject );
            return status;
        }
    KeInitializeSpinLock ( &pRegistryManager->lQueuedRegistryEventsSpinLock );
    InitializeListHead ( &pRegistryManager->lQueuedRegistryEvents );
    // Load structure to point to IRP handlers
    DriverObject->DriverUnload = UnloadDriver;
    DriverObject->MajorFunction[IRP_MJ_CREATE] = KDispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = KDispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KDispatchIoctl;
    status = CmRegisterCallback ( RegistryCallback, pRegistryManager, &pRegistryManager->registryCallbackCookie );
    if ( !NT_SUCCESS ( status ) )
        {
            DbgPrint ( "RegistryMonitor: ERROR CmRegisterCallback - %08x\n", status );
            return status;
        }
    UpdateLastContactTime();
    /* Create a DPC routine so that it can be called periodically */
    KeInitializeDpc ( &pRegistryManager->connectionCheckerFunction,
                      ( PKDEFERRED_ROUTINE ) ConnectionChecker, pRegistryManager );
    KeInitializeTimer ( &pRegistryManager->connectionCheckerTimer );
    registryEventsTimeout.QuadPart = 0;
    /* Set the ConnectionChecker routine to be called every so often */
    KeSetTimerEx ( &pRegistryManager->connectionCheckerTimer,
                   registryEventsTimeout,
                   ( USERSPACE_CONNECTION_TIMEOUT + ( USERSPACE_CONNECTION_TIMEOUT / 2 ) ) * 1000,
                   &pRegistryManager->connectionCheckerFunction );
    pRegistryManager->bReady = TRUE;
    DbgPrint ( "RegistryMonitor: Successfully Loaded\n" );
    /* Return success */
    return STATUS_SUCCESS;
}
/*  Checks to see if the registry monitor has received an IOCTL from a userspace
    program in a while. If it hasn't then all old queued registry events are
    cleared. This is called periodically when the driver is loaded */
VOID ConnectionChecker (
                IN struct _KDPC*  Dpc,
                IN PVOID  DeferredContext,
                IN PVOID  SystemArgument1,
                IN PVOID  SystemArgument2
)
{
    PCAPTURE_REGISTRY_MANAGER pRegistryManager = ( PCAPTURE_REGISTRY_MANAGER ) DeferredContext;
    if ( ( GetCurrentTime() - pRegistryManager->lastContactTime ) > ( USERSPACE_CONNECTION_TIMEOUT + ( USERSPACE_CONNECTION_TIMEOUT / 2 ) ) )
        {
            DbgPrint ( "RegistryMonitor: WARNING Userspace IOCTL timeout, clearing old queued registry events\n" );
            while ( !IsListEmpty ( &pRegistryManager->lQueuedRegistryEvents ) )
                {
                    PLIST_ENTRY head = ExInterlockedRemoveHeadList ( &pRegistryManager->lQueuedRegistryEvents, &pRegistryManager->lQueuedRegistryEventsSpinLock );
                    PREGISTRY_EVENT_PACKET pRegistryEventPacket = CONTAINING_RECORD ( head, REGISTRY_EVENT_PACKET, Link );
                    ExFreePoolWithTag ( pRegistryEventPacket->pRegistryEvent, REGISTRY_POOL_TAG );
                    ExFreePoolWithTag ( pRegistryEventPacket, REGISTRY_POOL_TAG );
                }
        }
}

NTSTATUS KDispatchCreateClose ( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest ( Irp, IO_NO_INCREMENT );
    return STATUS_SUCCESS;
}
NTSTATUS HandleIoctlGetRegEvents ( IN PDEVICE_OBJECT DeviceObject, PIRP Irp,
                                   PIO_STACK_LOCATION pIoStackIrp, UINT* pdwDataWritten )
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PCHAR pOutputBuffer = Irp->UserBuffer;
    UINT dwOutputBufferSize = pIoStackIrp->Parameters.DeviceIoControl.OutputBufferLength;
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    /* Get the registry manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
    *pdwDataWritten = 0;
    /* Check we are allowed to write into the buffer passed from the user space program */
    if ( pOutputBuffer )
        {
            try
                {
                    ProbeForWrite ( pOutputBuffer,
                                    pIoStackIrp->Parameters.DeviceIoControl.OutputBufferLength,
                                    __alignof ( REGISTRY_EVENT ) );
                    if ( pIoStackIrp->Parameters.DeviceIoControl.OutputBufferLength >= sizeof ( REGISTRY_EVENT ) )
                        {
                            PLIST_ENTRY pRegistryListHead;
                            PREGISTRY_EVENT_PACKET pRegistryPacket;
                            UINT bufferSpace = dwOutputBufferSize;
                            UINT bufferSpaceUsed = 0;
                            /* Fill the buffer passed from userspace with registry events */
                            while ( !IsListEmpty ( &pRegistryManager->lQueuedRegistryEvents ) &&
                                    ( bufferSpaceUsed < bufferSpace ) &&
                                    ( ( bufferSpace - bufferSpaceUsed ) >= sizeof ( REGISTRY_EVENT ) ) )
                                {
                                    UINT registryEventSize = 0;
                                    pRegistryListHead = ExInterlockedRemoveHeadList ( &pRegistryManager->lQueuedRegistryEvents, &pRegistryManager->lQueuedRegistryEventsSpinLock );
                                    pRegistryPacket = CONTAINING_RECORD ( pRegistryListHead, REGISTRY_EVENT_PACKET, Link );
                                    registryEventSize = sizeof ( REGISTRY_EVENT ) + pRegistryPacket->pRegistryEvent->registryPathLengthB + pRegistryPacket->pRegistryEvent->dataLengthB;
                                    if ( ( bufferSpace - bufferSpaceUsed ) >= registryEventSize )
                                        {
                                            //DbgPrint("Sending-%i: %ls\n",bufferSpaceUsed, pRegistryPacket->pRegistryEvent->registryPath);
                                            RtlCopyMemory ( pOutputBuffer + bufferSpaceUsed, pRegistryPacket->pRegistryEvent, registryEventSize );
                                            bufferSpaceUsed += registryEventSize;
                                            ExFreePoolWithTag ( pRegistryPacket->pRegistryEvent, REGISTRY_POOL_TAG );
                                            ExFreePoolWithTag ( pRegistryPacket, REGISTRY_POOL_TAG );
                                        }
                                    else
                                        {
                                            ExInterlockedInsertHeadList ( &pRegistryManager->lQueuedRegistryEvents, &pRegistryPacket->Link, &pRegistryManager->lQueuedRegistryEventsSpinLock );
                                            break;
                                        }
                                }
                            /* Return the amount of space that is occupied with registry events */
                            *pdwDataWritten = bufferSpaceUsed;
                            status = STATUS_SUCCESS;
                        }
                    else
                        {
                            *pdwDataWritten = sizeof ( REGISTRY_EVENT );
                            status = STATUS_BUFFER_TOO_SMALL;
                        }
                }
            except ( EXCEPTION_EXECUTE_HANDLER )
            {
                status = GetExceptionCode();
                DbgPrint ( "RegistryMonitor: EXCEPTION IOCTL_CAPTURE_GET_REGEVENTS - %i\n", status );
            }
        }
    return status;
}
NTSTATUS KDispatchIoctl ( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation ( Irp );
    UINT dwDataWritten = 0;
    switch ( irpStack->Parameters.DeviceIoControl.IoControlCode )
        {
        case IOCTL_CAPTURE_GET_REGEVENTS:
            UpdateLastContactTime();
            status = HandleIoctlGetRegEvents ( DeviceObject, Irp, irpStack, &dwDataWritten );
            break;
        default:
            break;
        }
    Irp->IoStatus.Status = status;
    // Set # of bytes to copy back to user-mode...
    if ( NT_SUCCESS ( status ) )
        Irp->IoStatus.Information = dwDataWritten;
    else
        Irp->IoStatus.Information = 0;
    IoCompleteRequest ( Irp, IO_NO_INCREMENT );
    return status;
}
VOID UpdateLastContactTime()
{
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    /* Get the process manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
    pRegistryManager->lastContactTime = GetCurrentTime();
}
ULONG GetCurrentTime()
{
    LARGE_INTEGER currentSystemTime;
    LARGE_INTEGER currentLocalTime;
    ULONG time;
    KeQuerySystemTime ( &currentSystemTime );
    ExSystemTimeToLocalTime ( &currentSystemTime, &currentLocalTime );
    RtlTimeToSecondsSince1970 ( &currentLocalTime, &time );
    return time;
}
BOOLEAN GetRegistryObjectCompleteName ( PUNICODE_STRING pRegistryPath, PUNICODE_STRING pPartialRegistryPath, PVOID pRegistryObject )
{
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    BOOLEAN foundCompleteName = FALSE;
    BOOLEAN partial = FALSE;
    /* Get the process manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
    /* Check to see if everything is valid */
    /*  We sometimes see a partial registry object name which is actually complete
        however if fails one of these checks for some reason. Not sure whether to report
        this registry event */
    if ( ( !MmIsAddressValid ( pRegistryObject ) ) ||
            ( pRegistryObject == NULL ) )
        {
            return FALSE;
        }
    /* Check to see if the partial name is really the complete name */
    if ( pPartialRegistryPath != NULL )
        {
            if ( ( ( ( pPartialRegistryPath->Buffer[0] == '\\' ) || ( pPartialRegistryPath->Buffer[0] == '%' ) ) ||
                    ( ( pPartialRegistryPath->Buffer[0] == 'T' ) && ( pPartialRegistryPath->Buffer[1] == 'R' ) && ( pPartialRegistryPath->Buffer[2] == 'Y' )
                      && ( pPartialRegistryPath->Buffer[3] == '\\' ) ) ) )
                {
                    RtlUnicodeStringCopy ( pRegistryPath, pPartialRegistryPath );
                    partial = TRUE;
                    foundCompleteName = TRUE;
                }
        }
    if ( !foundCompleteName )
        {
            /* Query the object manager in the kernel for the complete name */
            NTSTATUS status;
            ULONG returnedLength;
            PUNICODE_STRING pObjectName = NULL;
            status = ObQueryNameString ( pRegistryObject, ( POBJECT_NAME_INFORMATION ) pObjectName, 0, &returnedLength );
            if ( status == STATUS_INFO_LENGTH_MISMATCH )
                {
                    pObjectName = ExAllocatePoolWithTag ( NonPagedPool, returnedLength, REGISTRY_POOL_TAG );
                    status = ObQueryNameString ( pRegistryObject, ( POBJECT_NAME_INFORMATION ) pObjectName, returnedLength, &returnedLength );
                    if ( NT_SUCCESS ( status ) )
                        {
                            RtlUnicodeStringCopy ( pRegistryPath, pObjectName );
                            foundCompleteName = TRUE;
                        }
                    ExFreePoolWithTag ( pObjectName, REGISTRY_POOL_TAG );
                }
        }
    //ASSERT(foundCompleteName == TRUE);
    return foundCompleteName;
}
BOOLEAN QueueRegistryEvent ( PREGISTRY_EVENT pRegistryEvent )
{
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    /* Get the registry manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
    /* Check the last contact time of the user space program before queuing */
    if ( ( GetCurrentTime() - pRegistryManager->lastContactTime ) <= USERSPACE_CONNECTION_TIMEOUT )
        {
            PREGISTRY_EVENT_PACKET pRegistryEventPacket = ExAllocatePoolWithTag ( NonPagedPool, sizeof ( REGISTRY_EVENT_PACKET ), REGISTRY_POOL_TAG );
            pRegistryEventPacket->pRegistryEvent = pRegistryEvent;
            /* Queue registry event */
            ExInterlockedInsertTailList ( &pRegistryManager->lQueuedRegistryEvents, &pRegistryEventPacket->Link,
                                          &pRegistryManager->lQueuedRegistryEventsSpinLock );
            return TRUE;
        }
    return FALSE;
}
NTSTATUS RegistryCallback ( IN PVOID CallbackContext,
                            IN PVOID  Argument1,
                            IN PVOID  Argument2 )
{
    //REGISTRY_EVENT registryEvent;
    BOOLEAN registryEventIsValid = FALSE;
    BOOLEAN exception = FALSE;
    LARGE_INTEGER CurrentSystemTime;
    LARGE_INTEGER CurrentLocalTime;
    TIME_FIELDS TimeFields;
    int type;
    UNICODE_STRING registryPath;
    UCHAR* registryData = NULL;
    ULONG registryDataLength = 0;
    ULONG registryDataType = 0;
    /* Allocate a large 64kb string ... maximum path name allowed in windows */
    registryPath.Length = 0;
    registryPath.MaximumLength = NTSTRSAFE_UNICODE_STRING_MAX_CCH * sizeof ( WCHAR );
    registryPath.Buffer = ExAllocatePoolWithTag ( NonPagedPool, registryPath.MaximumLength, REGISTRY_POOL_TAG );
    if ( registryPath.Buffer == NULL )
        {
            return STATUS_SUCCESS;
        }
    /* Put the time this event occured into the registry event */
    KeQuerySystemTime ( &CurrentSystemTime );
    ExSystemTimeToLocalTime ( &CurrentSystemTime, &CurrentLocalTime );
    //registryEvent.processId = PsGetCurrentProcessId();
    //registryEvent.eventType = (REG_NOTIFY_CLASS)Argument1;
    type = ( REG_NOTIFY_CLASS ) Argument1;
    try
        {
            /* Large switch statement for all registry events ... fairly easy to understand */
            switch ( type )
                {
                case RegNtPostCreateKey:
                {
                    PREG_POST_CREATE_KEY_INFORMATION createKey = ( PREG_POST_CREATE_KEY_INFORMATION ) Argument2;
                    if ( NT_SUCCESS ( createKey->Status ) )
                        {
                            PVOID* registryObject = createKey->Object;
                            registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, createKey->CompleteName, *registryObject );
                        }
                    break;
                }
                case RegNtPostOpenKey:
                {
                    PREG_POST_OPEN_KEY_INFORMATION openKey = ( PREG_POST_OPEN_KEY_INFORMATION ) Argument2;
                    if ( NT_SUCCESS ( openKey->Status ) )
                        {
                            PVOID* registryObject = openKey->Object;
                            registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, openKey->CompleteName, *registryObject );
                        }
                    break;
                }
                case RegNtPreDeleteKey:
                {
                    PREG_DELETE_KEY_INFORMATION deleteKey = ( PREG_DELETE_KEY_INFORMATION ) Argument2;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, deleteKey->Object );
                    break;
                }
                case RegNtDeleteValueKey:
                {
                    PREG_DELETE_VALUE_KEY_INFORMATION deleteValueKey = ( PREG_DELETE_VALUE_KEY_INFORMATION ) Argument2;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, deleteValueKey->Object );
                    if ( ( registryEventIsValid ) && ( deleteValueKey->ValueName->Length > 0 ) )
                        {
                            RtlUnicodeStringCatString ( &registryPath, L"\\" );
                            RtlUnicodeStringCat ( &registryPath, deleteValueKey->ValueName );
                        }
                    break;
                }
                case RegNtPreSetValueKey:
                {
                    PREG_SET_VALUE_KEY_INFORMATION setValueKey = ( PREG_SET_VALUE_KEY_INFORMATION ) Argument2;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, setValueKey->Object );
                    if ( ( registryEventIsValid ) && ( setValueKey->ValueName->Length > 0 ) )
                        {
                            registryDataType = setValueKey->Type;
                            registryDataLength = setValueKey->DataSize;
                            registryData = ExAllocatePoolWithTag ( NonPagedPool, registryDataLength, REGISTRY_POOL_TAG );
                            if ( registryData != NULL )
                                {
                                    RtlCopyBytes ( registryData, setValueKey->Data, setValueKey->DataSize );
                                }
                            else
                                {
                                    DbgPrint ( "RegistryMonitor: ERROR can't allocate memory for setvalue data\n" );
                                }
                            RtlUnicodeStringCatString ( &registryPath, L"\\" );
                            RtlUnicodeStringCat ( &registryPath, setValueKey->ValueName );
                        }
                    break;
                }
                case RegNtEnumerateKey:
                {
                    PREG_ENUMERATE_KEY_INFORMATION enumerateKey = ( PREG_ENUMERATE_KEY_INFORMATION ) Argument2;
                    registryDataType = enumerateKey->KeyInformationClass;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, enumerateKey->Object );
                    break;
                }
                case RegNtEnumerateValueKey:
                {
                    PREG_ENUMERATE_VALUE_KEY_INFORMATION enumerateValueKey = ( PREG_ENUMERATE_VALUE_KEY_INFORMATION ) Argument2;
                    registryDataType = enumerateValueKey->KeyValueInformationClass;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, enumerateValueKey->Object );
                    break;
                }
                case RegNtQueryKey:
                {
                    PREG_QUERY_KEY_INFORMATION queryKey = ( PREG_QUERY_KEY_INFORMATION ) Argument2;
                    registryDataType = queryKey->KeyInformationClass;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, queryKey->Object );
                    break;
                }
                case RegNtQueryValueKey:
                {
                    PREG_QUERY_VALUE_KEY_INFORMATION queryValueKey = ( PREG_QUERY_VALUE_KEY_INFORMATION ) Argument2;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, queryValueKey->Object );
                    if ( ( registryEventIsValid ) && ( queryValueKey->ValueName->Length > 0 ) )
                        {
                            registryDataType = queryValueKey->KeyValueInformationClass;
                            RtlUnicodeStringCatString ( &registryPath, L"\\" );
                            RtlUnicodeStringCat ( &registryPath, queryValueKey->ValueName );
                        }
                    break;
                }
                case RegNtKeyHandleClose:
                {
                    PREG_KEY_HANDLE_CLOSE_INFORMATION closeKey = ( PREG_KEY_HANDLE_CLOSE_INFORMATION ) Argument2;
                    registryEventIsValid = GetRegistryObjectCompleteName ( &registryPath, NULL, closeKey->Object );
                    break;
                }
                default:
                    break;
                }
        }
    except ( EXCEPTION_EXECUTE_HANDLER )
    {
        /* Do nothing if an exception occured ... event won't be queued */
        registryEventIsValid = FALSE;
        exception = TRUE;
    }
    if ( registryEventIsValid )
        {
            PREGISTRY_EVENT pRegistryEvent;
            UINT eventSize = sizeof ( REGISTRY_EVENT ) + registryPath.Length + ( sizeof ( WCHAR ) ) + registryDataLength;
            pRegistryEvent = ExAllocatePoolWithTag ( NonPagedPool, eventSize, REGISTRY_POOL_TAG );
            if ( pRegistryEvent != NULL )
                {
                    pRegistryEvent->registryPathLengthB = registryPath.Length + sizeof ( WCHAR );
                    pRegistryEvent->dataType = registryDataType;
                    pRegistryEvent->dataLengthB = registryDataLength;
                    //RtlStringCbCopyUnicodeString(pRegistryEvent->registryPath, pRegistryEvent->registryPathLength, &registryPath);
                    RtlCopyBytes ( pRegistryEvent->registryData, registryPath.Buffer, registryPath.Length );
                    pRegistryEvent->registryData[registryPath.Length] = '\0';
                    pRegistryEvent->registryData[registryPath.Length + 1] = '\0';
                    RtlCopyBytes ( pRegistryEvent->registryData + pRegistryEvent->registryPathLengthB, registryData, registryDataLength );
                    if ( registryData != NULL )
                        {
                            ExFreePoolWithTag ( registryData, REGISTRY_POOL_TAG );
                        }
                    pRegistryEvent->processId = PsGetCurrentProcessId();
                    RtlTimeToTimeFields ( &CurrentLocalTime, &pRegistryEvent->time );
                    pRegistryEvent->eventType = ( REG_NOTIFY_CLASS ) Argument1;
                    if ( !QueueRegistryEvent ( pRegistryEvent ) )
                        {
                            ExFreePoolWithTag ( pRegistryEvent, REGISTRY_POOL_TAG );
                        }
                }
        }
    if ( registryPath.Buffer != NULL )
        {
            ExFreePoolWithTag ( registryPath.Buffer, REGISTRY_POOL_TAG );
        }
    /* Always return a success ... we aren't doing any filtering, just monitoring */
    return STATUS_SUCCESS;
}
void UnloadDriver ( IN PDRIVER_OBJECT DriverObject )
{
    UNICODE_STRING  uszDeviceString;
    NTSTATUS        ntStatus;
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    /* Get the registry manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
    if ( pRegistryManager->bReady == TRUE )
        {
            KeCancelTimer ( &pRegistryManager->connectionCheckerTimer );
            CmUnRegisterCallback ( pRegistryManager->registryCallbackCookie );
            pRegistryManager->bReady = FALSE;
        }
    while ( !IsListEmpty ( &pRegistryManager->lQueuedRegistryEvents ) )
        {
            PLIST_ENTRY head = ExInterlockedRemoveHeadList ( &pRegistryManager->lQueuedRegistryEvents, &pRegistryManager->lQueuedRegistryEventsSpinLock );
            PREGISTRY_EVENT_PACKET pRegistryEventPacket = CONTAINING_RECORD ( head, REGISTRY_EVENT_PACKET, Link );
            ExFreePoolWithTag ( pRegistryEventPacket->pRegistryEvent, REGISTRY_POOL_TAG );
            ExFreePoolWithTag ( pRegistryEventPacket, REGISTRY_POOL_TAG );
        }
    RtlInitUnicodeString ( &uszDeviceString, L"[url=file://\\DosDevices\\RegistryMonitor]\\DosDevices\\RegistryMonitor[/url]" );
    IoDeleteSymbolicLink ( &uszDeviceString );
    if ( DriverObject->DeviceObject != NULL )
        {
            IoDeleteDevice ( DriverObject->DeviceObject );
        }
}