注册表回调整体框架 

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)  
{  
    NTSTATUS ntStatus;  
    ntStatus = CmRegisterCallback(MyRegistryCallback, NULL,  &pCookie);  
      
    return ntStatus;  
}  
//see demo:  
//7eightl-minifilter\Demo\REG-hips  
  
  
  
  
  
  
NTSTATUS HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
{  
    NTSTATUS status = 0;  
    PUNICODE_STRING keyName;  
    UNICODE_STRING uTarget;  
  
  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyRegistryCallback(__in PVOID CallbackContext,__in_opt PVOID Argument1,            / / REG_NOTIFY_CLASS  __in_opt PVOID Argument2            //  KEY_INFORMATION ){  
            switch( (REG_NOTIFY_CLASS) Argument1)  
{  
         case RegNtPreDeleteKey :  
return HOOK_PreNtDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
          case RegNtPreRenameKey:  
return HOOK_PreNtRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
          case RegNtPreCreateKeyEx:  // pre 操作  
 return HOOK_PreNtCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
          case RegNtPostCreateKeyEx :    // post 操作  
return HOOK_PostNtCreateKeyEx((PRGG_POST_OPERATION_INFORMATION )}  
   }        
}                                                                                                                                  }  
  
  
  
  
main.c  
#include "precomp.h"  
  
  
#define     DEVICE_NAME                 L"\\device\\HipsRegDrv"  
#define     LINK_NAME                   L"\\dosDevices\\HipsRegDrv"  
  
  
  
  
// function to dispatch the IRPs  
NTSTATUS DispatchOK(PDEVICE_OBJECT DeviceObject, PIRP Irp)  
{  
   Irp->IoStatus.Status = STATUS_SUCCESS;  
   IoCompleteRequest(Irp,IO_NO_INCREMENT);  
   return STATUS_SUCCESS;  
}  
  
  
VOID DriverUnload (  
    IN PDRIVER_OBJECT   pDriverObject)   
{  
    UNICODE_STRING strLink;  
    RtlInitUnicodeString(&strLink, LINK_NAME);  
    stopRegMon();  
  
  
    IoDeleteSymbolicLink(&strLink);  
    IoDeleteDevice(pDriverObject->DeviceObject);  
  
  
    DbgPrint(" Unloaded\n");   
}  
  
  
  
  
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)  
{  
    UNICODE_STRING  DeviceName;  
    UNICODE_STRING  LinkName;    
    NTSTATUS        status;   
    PDEVICE_OBJECT  pDriverDeviceObject;    
    ULONG i;  
      
    //DbgPrint("Driver loaded.");  
    pDriverObject->DriverUnload = DriverUnload;     
      
    // init strings  
    RtlInitUnicodeString(&DeviceName, DEVICE_NAME);  
    RtlInitUnicodeString(&LinkName, LINK_NAME);  
      
    // to communicate with usermode, we need a device  
    status = IoCreateDevice(  
           pDriverObject,        // ptr to caller object  
           0,  // extension device allocated byte number  
           &DeviceName,         // device name   
           FILE_DEVICE_UNKNOWN,   
           0,                   // no special caracteristics  
           FALSE,               // we can open many handles in same time  
           &pDriverDeviceObject); // [OUT] ptr to the created object  
             
    if ( !NT_SUCCESS(status) )   
       return STATUS_NO_SUCH_DEVICE;  
      
    pDriverDeviceObject-> Flags |= DO_BUFFERED_IO;  
  
  
    // we also need a symbolic link  
    status = IoCreateSymbolicLink(&LinkName,&DeviceName);  
    if( !NT_SUCCESS(status) )   
    {  
        IoDeleteDevice( pDriverDeviceObject );  
        return STATUS_NO_SUCH_DEVICE;  
    }    
  
  
    for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)  
        pDriverObject->MajorFunction[i] = DispatchOK;   
      
  
  
    startRegMon(pDriverObject);  
    //Do other things...     
      
    return STATUS_SUCCESS;  
}  
  
  
precomp.h  
#ifndef _PRECOMP_H_  
#define _PRECOMP_H_  
#include <ntifs.h>  
#include <ntddk.h>  
#include <windef.h>  
#include "regmon.h"  
#endif  
  
  
regmon.c  
#include "precomp.h"  
  
  
GENERIC_MAPPING g_KeyMapping = {KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS};  
static WCHAR g_wszAltitude[] = L"370020";  
  
  
PGENERIC_MAPPING IoGetKeyGenericMapping( )  
{  
    return &g_KeyMapping;  
}  
  
  
BOOL MyObQueryObjectName(HANDLE hObjHandle, PUNICODE_STRING ustrObjectName, BOOL bNeedAllocateName)  
{  
    PVOID           pQueryBuffer        = NULL;  
    DWORD           dwReqSize           = 0;  
    NTSTATUS        ntStatus            = 0;  
    __try  
    {  
        dwReqSize = sizeof(OBJECT_NAME_INFORMATION) + (MAX_PATH + 32)*sizeof(WCHAR);  
          
        pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, 'RFLM');  
          
        if(pQueryBuffer == NULL)  
            return FALSE;  
          
        ntStatus = ZwQueryObject(hObjHandle,   
            ObjectNameInfo,  
            pQueryBuffer,  
            dwReqSize,  
            &dwReqSize);  
          
        if((ntStatus == STATUS_INFO_LENGTH_MISMATCH) ||  
            (ntStatus == STATUS_BUFFER_OVERFLOW) ||  
            (ntStatus == STATUS_BUFFER_TOO_SMALL))  
        {  
            ExFreePool(pQueryBuffer);  
            pQueryBuffer = NULL;  
              
            pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, 'RFLM');  
              
            if(pQueryBuffer == NULL)  
            {  
                return FALSE;  
            }  
              
            ntStatus = ZwQueryObject(hObjHandle,   
                ObjectNameInfo,  
                pQueryBuffer,  
                dwReqSize,  
                &dwReqSize);  
              
        }  
          
        if(NT_SUCCESS(ntStatus))  
        {   
            OBJECT_NAME_INFORMATION * pNameInfo = (OBJECT_NAME_INFORMATION *)pQueryBuffer;  
              
            if(bNeedAllocateName)  
            {  
                ustrObjectName->Buffer = ExAllocatePoolWithTag(PagedPool, pNameInfo->Name.Length + sizeof(WCHAR), 'RFLM');  
                  
                if(ustrObjectName->Buffer)  
                {  
                    RtlZeroMemory(ustrObjectName->Buffer, pNameInfo->Name.Length + sizeof(WCHAR));  
                    ustrObjectName->Length = 0;  
                    ustrObjectName->MaximumLength = pNameInfo->Name.Length;  
                    RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
                }  
                else  
                    ntStatus = STATUS_INSUFFICIENT_RESOURCES;  
                  
            }  
            else  
                RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
        }  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
        ntStatus = GetExceptionCode();  
    }  
      
    if(pQueryBuffer)  
    {  
        ExFreePool(pQueryBuffer);  
        pQueryBuffer = NULL;  
    }  
      
    return NT_SUCCESS(ntStatus);  
}  
  
  
  
  
LARGE_INTEGER g_RegCookie;  
  
  
#if (NTDDI_VERSION >= NTDDI_VISTA)  
NTSTATUS TlGetObjectNameOnVistaAndLater(PVOID Object, PUNICODE_STRING Name)  
{  
    PUNICODE_STRING         pKeyName = NULL;  
    NTSTATUS                ntStatus = 0;  
  
  
    if(Object == NULL || Name == NULL)  
        return STATUS_INVALID_PARAMETER;  
  
  
    ntStatus = CmCallbackGetKeyObjectID(&g_RegCookie,  
                                      Object,  
                                      NULL,  
                                     &pKeyName);  
  
  
    if(NT_SUCCESS(ntStatus) == FALSE)  
    {  
        return ntStatus;  
    }  
  
  
    Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
                            PagedPool,   
                            pKeyName->Length,  
                            'RFLM'  
                            );  
  
  
    if(Name->Buffer == NULL)  
    {  
        return STATUS_INSUFFICIENT_RESOURCES;  
    }  
  
  
    RtlZeroMemory(Name->Buffer, pKeyName->Length);  
  
  
    Name->Length = 0;  
    Name->MaximumLength = pKeyName->Length;  
  
  
    RtlCopyUnicodeString(Name, pKeyName);  
    return STATUS_SUCCESS;  
}  
#endif  
  
  
NTSTATUS TlGetObjectNameOnXP(PVOID Object, PUNICODE_STRING Name)  
{  
    UNICODE_STRING              ustrKeyName             = {0};  
    HANDLE                      ObjectHandle            = NULL;  
    NTSTATUS                    ntStatus                = 0;  
  
  
    if(Object == NULL || Name == NULL)  
        return STATUS_INVALID_PARAMETER;  
  
  
    ntStatus = ObOpenObjectByPointer(Object,  
                              OBJ_KERNEL_HANDLE ,  
                              0,  
                              0,  
                              NULL,  
                              KernelMode,  
                              &ObjectHandle);  
  
  
    if(NT_SUCCESS(ntStatus) == FALSE)  
    {  
        return ntStatus;  
    }  
  
  
    if(MyObQueryObjectName(ObjectHandle, &ustrKeyName, TRUE) == FALSE)  
    {  
        ZwClose(ObjectHandle);  
        return STATUS_INSUFFICIENT_RESOURCES;  
    }  
      
    ZwClose(ObjectHandle);  
  
  
    Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
                            PagedPool,   
                            ustrKeyName.Length,  
                            'RFLM'  
                            );  
  
  
    if(Name->Buffer == NULL)  
    {  
        return STATUS_INSUFFICIENT_RESOURCES;  
    }  
  
  
    RtlZeroMemory(Name->Buffer, ustrKeyName.Length);  
  
  
    Name->Length = 0;  
    Name->MaximumLength = ustrKeyName.Length;  
  
  
    RtlCopyUnicodeString(Name, &ustrKeyName);  
    ExFreePool(ustrKeyName.Buffer);  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS TlGetObjectFullName(PVOID Object, PUNICODE_STRING Name)  
{  
#if (NTDDI_VERSION >= NTDDI_LONGHORN)  
    return TlGetObjectNameOnVistaAndLater(Object, Name);  
#else  
    return TlGetObjectNameOnXP(Object, Name);  
#endif  
}  
  
  
  
  
NTSTATUS MyDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
{  
    NTSTATUS            ntStatus        = 0;  
    UNICODE_STRING      ustrKeyName     = {0};  
  
  
    __try  
    {  
  
  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
            return STATUS_SUCCESS;  
        }  
        DbgPrint("DeleteKey Key:%wZ\n", &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MySetValueKey(PREG_SET_VALUE_KEY_INFORMATION Data)  
{  
    NTSTATUS                ntStatus                = 0;  
    UNICODE_STRING          ustrKeyName             = {0};  
    UNICODE_STRING          ustrTarget              = {0};  
    WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
  
  
    __try  
    {  
          
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
  
  
            return STATUS_SUCCESS;  
        }  
  
  
        ustrTarget.Buffer = wszKeyPath;  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  
  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
        if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1] != L'\\' )  
            RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  
  
        RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
        DbgPrint("SetValueKey Key:%wZ\n", &ustrTarget);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyDeleteValueKey(PREG_DELETE_VALUE_KEY_INFORMATION Data)  
{  
    NTSTATUS                ntStatus                = 0;  
    UNICODE_STRING          ustrKeyName             = {0};  
    UNICODE_STRING          ustrTarget              = {0};  
    WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
  
  
  
  
    __try  
    {  
  
  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        ustrTarget.Buffer = wszKeyPath;  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
        if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1]!=L'\\' )  
            RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  
  
        RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
        DbgPrint("DeleteValueKey Key:%wZ\n", &ustrTarget);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyRenameKey(PREG_RENAME_KEY_INFORMATION Data)  
{  
    NTSTATUS                ntStatus    = 0;  
    UNICODE_STRING          ustrKeyName = {0};  
      
    __try  
    {  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
        {  
            return STATUS_SUCCESS;  
        }  
  
  
        DbgPrint("RenameKey Key:%wZ\n", &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
  
  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyCreateKey(PREG_PRE_CREATE_KEY_INFORMATION Data)  
{  
    NTSTATUS            ntStatus                = 0;  
    UNICODE_STRING      ustrTarget              = {0};  
    WCHAR               wszKeyName[MAX_PATH]    = {0};  
  
  
    __try  
    {  
        if((ExGetPreviousMode() == KernelMode))  
        {  
            return STATUS_SUCCESS;  
        }  
          
        ustrTarget.Buffer = wszKeyName;  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, Data->CompleteName);  
        DbgPrint("CreateKey Key:%wZ\n", &ustrTarget);  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS MyCreateKeyEx(PREG_CREATE_KEY_INFORMATION Data)  
{  
    NTSTATUS            ntStatus    = 0;  
    UNICODE_STRING      ustrKeyName = {0};  
    UNICODE_STRING      ustrTarget  = {0};  
  
  
    __try  
    {  
        if((ExGetPreviousMode() == KernelMode))  
        {  
  
  
            return STATUS_SUCCESS;  
        }  
  
  
        if(NT_SUCCESS(TlGetObjectFullName(Data->RootObject, &ustrKeyName)) == FALSE)  
        {  
  
  
            return STATUS_SUCCESS;  
        }  
  
  
        ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
          
        RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  
  
        ExFreePool(ustrKeyName.Buffer);  
          
        if(Data->CompleteName)  
        {  
            RtlAppendUnicodeToString(&ustrTarget, L"\\");  
            RtlAppendUnicodeStringToString(&ustrTarget, Data->CompleteName);  
        }  
  
  
        DbgPrint("CreateKeyEx :%wZ\n", ustrTarget);  
  
  
    }  
    __except(EXCEPTION_EXECUTE_HANDLER)  
    {  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
  
  
NTSTATUS MyRegCallback  
(  
    PVOID CallbackContext,   
    PVOID Argument1,   
    PVOID Argument2  
)  
{  
    switch( (REG_NOTIFY_CLASS) Argument1)  
    {  
    case RegNtPreDeleteKey :  
        return MyDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
    case RegNtPreSetValueKey:  
        return MySetValueKey((PREG_SET_VALUE_KEY_INFORMATION) Argument2);  
    case RegNtPreDeleteValueKey:  
        return MyDeleteValueKey((PREG_DELETE_VALUE_KEY_INFORMATION) Argument2);  
    case RegNtPreRenameKey:  
        return MyRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
    case RegNtPreCreateKey:  
        return MyCreateKey((PREG_PRE_CREATE_KEY_INFORMATION) Argument2);      
    case RegNtPreCreateKeyEx:  
        return MyCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
  
  
    }  
  
  
    return STATUS_SUCCESS;  
}  
  
  
NTSTATUS startRegMon(PDRIVER_OBJECT driverObject)  
{  
#if (NTDDI_VERSION >= NTDDI_VISTA)  
    UNICODE_STRING uAltitude;  
  
  
    RtlInitUnicodeString(&uAltitude, g_wszAltitude);  
    return CmRegisterCallbackEx(MyRegCallback,  
                          &uAltitude,  
                          driverObject,  
                          NULL,  
                          &g_RegCookie,  
                          NULL);      
#else  
    return CmRegisterCallback(MyRegCallback,  
                              NULL,  
                             &g_RegCookie);  
  
  
#endif  
                            
}  
  
  
VOID stopRegMon( )  
{  
    CmUnRegisterCallback(g_RegCookie);  
}  
  
  
  
  
  
  
regmon.c  
#ifndef __REGMON_H__  
#define __REGMON_H__  
  
  
typedef enum _OBJECT_INFO_CLASS {  
    ObjectBasicInfo,  
        ObjectNameInfo,  
        ObjectTypeInfo,  
        ObjectAllTypesInfo,  
        ObjectProtectionInfo  
} OBJECT_INFO_CLASS;  
  
  
  
  
PGENERIC_MAPPING IoGetKeyGenericMapping( );  
  
  
NTSTATUS   
MyRegCallback  
(  
    PVOID CallbackContext,   
    PVOID Argument1,   
    PVOID Argument2  
);  
  
  
  
  
NTSTATUS startRegMon(PDRIVER_OBJECT driverObject);  
VOID stopRegMon( );  
  
  
  
  
#endif

 

  1. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)  
  2. {  
  3.     NTSTATUS ntStatus;  
  4.     ntStatus = CmRegisterCallback(MyRegistryCallback, NULL,  &pCookie);  
  5.       
  6.     return ntStatus;  
  7. }  
  8. //see demo:  
  9. //7eightl-minifilter\Demo\REG-hips  
  10.   
  11.   
  12.   
  13.   
  14.   
  15.   
  16. NTSTATUS HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
  17. {  
  18.     NTSTATUS status = 0;  
  19.     PUNICODE_STRING keyName;  
  20.     UNICODE_STRING uTarget;  
  21.   
  22.   
  23.   
  24.   
  25.     return STATUS_SUCCESS;  
  26. }  
  27.   
  28.   
  29. NTSTATUS  MyRegistryCallback( __in PVOID CallbackContext, __in_opt PVOID Argument1,            / / REG_NOTIFY_CLASS   __in_opt PVOID Argument2            //  KEY_INFORMATION  ) {  
  30.             switch( (REG_NOTIFY_CLASS) Argument1)  
  31. {  
  32.          case RegNtPreDeleteKey :  
  33. return HOOK_PreNtDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
  34.           case RegNtPreRenameKey:  
  35. return HOOK_PreNtRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
  36.           case RegNtPreCreateKeyEx:  // pre 操作  
  37.  return HOOK_PreNtCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
  38.           case RegNtPostCreateKeyEx :    // post 操作  
  39. return HOOK_PostNtCreateKeyEx((PRGG_POST_OPERATION_INFORMATION )}  
  40.    }        
  41. }                                                                                                                                  }  
  42.   
  43.   
  44.   
  45.   
  46. main.c  
  47. #include "precomp.h"  
  48.   
  49.   
  50. #define     DEVICE_NAME                 L"\\device\\HipsRegDrv"  
  51. #define     LINK_NAME                   L"\\dosDevices\\HipsRegDrv"  
  52.   
  53.   
  54.   
  55.   
  56. // function to dispatch the IRPs  
  57. NTSTATUS DispatchOK(PDEVICE_OBJECT DeviceObject, PIRP Irp)  
  58. {  
  59.    Irp->IoStatus.Status = STATUS_SUCCESS;  
  60.    IoCompleteRequest(Irp,IO_NO_INCREMENT);  
  61.    return STATUS_SUCCESS;  
  62. }  
  63.   
  64.   
  65. VOID DriverUnload (  
  66.     IN PDRIVER_OBJECT   pDriverObject)   
  67. {  
  68.     UNICODE_STRING strLink;  
  69.     RtlInitUnicodeString(&strLink, LINK_NAME);  
  70.     stopRegMon();  
  71.   
  72.   
  73.     IoDeleteSymbolicLink(&strLink);  
  74.     IoDeleteDevice(pDriverObject->DeviceObject);  
  75.   
  76.   
  77.     DbgPrint(" Unloaded\n");   
  78. }  
  79.   
  80.   
  81.   
  82.   
  83. NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)  
  84. {  
  85.     UNICODE_STRING  DeviceName;  
  86.     UNICODE_STRING  LinkName;    
  87.     NTSTATUS        status;   
  88.     PDEVICE_OBJECT  pDriverDeviceObject;    
  89.     ULONG i;  
  90.       
  91.     //DbgPrint("Driver loaded.");  
  92.     pDriverObject->DriverUnload = DriverUnload;     
  93.       
  94.     // init strings  
  95.     RtlInitUnicodeString(&DeviceName, DEVICE_NAME);  
  96.     RtlInitUnicodeString(&LinkName, LINK_NAME);  
  97.       
  98.     // to communicate with usermode, we need a device  
  99.     status = IoCreateDevice(  
  100.            pDriverObject,        // ptr to caller object  
  101.            0,  // extension device allocated byte number  
  102.            &DeviceName,         // device name   
  103.            FILE_DEVICE_UNKNOWN,   
  104.            0,                   // no special caracteristics  
  105.            FALSE,               // we can open many handles in same time  
  106.            &pDriverDeviceObject); // [OUT] ptr to the created object  
  107.              
  108.     if ( !NT_SUCCESS(status) )   
  109.        return STATUS_NO_SUCH_DEVICE;  
  110.       
  111.     pDriverDeviceObject-> Flags |= DO_BUFFERED_IO;  
  112.   
  113.   
  114.     // we also need a symbolic link  
  115.     status = IoCreateSymbolicLink(&LinkName,&DeviceName);  
  116.     if( !NT_SUCCESS(status) )   
  117.     {  
  118.         IoDeleteDevice( pDriverDeviceObject );  
  119.         return STATUS_NO_SUCH_DEVICE;  
  120.     }    
  121.   
  122.   
  123.     for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)  
  124.         pDriverObject->MajorFunction[i] = DispatchOK;   
  125.       
  126.   
  127.   
  128.     startRegMon(pDriverObject);  
  129.     //Do other things...     
  130.       
  131.     return STATUS_SUCCESS;  
  132. }  
  133.   
  134.   
  135. precomp.h  
  136. #ifndef _PRECOMP_H_  
  137. #define _PRECOMP_H_  
  138. #include <ntifs.h>  
  139. #include <ntddk.h>  
  140. #include <windef.h>  
  141. #include "regmon.h"  
  142. #endif  
  143.   
  144.   
  145. regmon.c  
  146. #include "precomp.h"  
  147.   
  148.   
  149. GENERIC_MAPPING g_KeyMapping = {KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS};  
  150. static WCHAR g_wszAltitude[] = L"370020";  
  151.   
  152.   
  153. PGENERIC_MAPPING IoGetKeyGenericMapping( )  
  154. {  
  155.     return &g_KeyMapping;  
  156. }  
  157.   
  158.   
  159. BOOL MyObQueryObjectName(HANDLE hObjHandle, PUNICODE_STRING ustrObjectName, BOOL bNeedAllocateName)  
  160. {  
  161.     PVOID           pQueryBuffer        = NULL;  
  162.     DWORD           dwReqSize           = 0;  
  163.     NTSTATUS        ntStatus            = 0;  
  164.     __try  
  165.     {  
  166.         dwReqSize = sizeof(OBJECT_NAME_INFORMATION) + (MAX_PATH + 32)*sizeof(WCHAR);  
  167.           
  168.         pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, 'RFLM');  
  169.           
  170.         if(pQueryBuffer == NULL)  
  171.             return FALSE;  
  172.           
  173.         ntStatus = ZwQueryObject(hObjHandle,   
  174.             ObjectNameInfo,  
  175.             pQueryBuffer,  
  176.             dwReqSize,  
  177.             &dwReqSize);  
  178.           
  179.         if((ntStatus == STATUS_INFO_LENGTH_MISMATCH) ||  
  180.             (ntStatus == STATUS_BUFFER_OVERFLOW) ||  
  181.             (ntStatus == STATUS_BUFFER_TOO_SMALL))  
  182.         {  
  183.             ExFreePool(pQueryBuffer);  
  184.             pQueryBuffer = NULL;  
  185.               
  186.             pQueryBuffer = ExAllocatePoolWithTag(PagedPool, dwReqSize, 'RFLM');  
  187.               
  188.             if(pQueryBuffer == NULL)  
  189.             {  
  190.                 return FALSE;  
  191.             }  
  192.               
  193.             ntStatus = ZwQueryObject(hObjHandle,   
  194.                 ObjectNameInfo,  
  195.                 pQueryBuffer,  
  196.                 dwReqSize,  
  197.                 &dwReqSize);  
  198.               
  199.         }  
  200.           
  201.         if(NT_SUCCESS(ntStatus))  
  202.         {   
  203.             OBJECT_NAME_INFORMATION * pNameInfo = (OBJECT_NAME_INFORMATION *)pQueryBuffer;  
  204.               
  205.             if(bNeedAllocateName)  
  206.             {  
  207.                 ustrObjectName->Buffer = ExAllocatePoolWithTag(PagedPool, pNameInfo->Name.Length + sizeof(WCHAR), 'RFLM');  
  208.                   
  209.                 if(ustrObjectName->Buffer)  
  210.                 {  
  211.                     RtlZeroMemory(ustrObjectName->Buffer, pNameInfo->Name.Length + sizeof(WCHAR));  
  212.                     ustrObjectName->Length = 0;  
  213.                     ustrObjectName->MaximumLength = pNameInfo->Name.Length;  
  214.                     RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
  215.                 }  
  216.                 else  
  217.                     ntStatus = STATUS_INSUFFICIENT_RESOURCES;  
  218.                   
  219.             }  
  220.             else  
  221.                 RtlCopyUnicodeString(ustrObjectName, &pNameInfo->Name);  
  222.         }  
  223.     }  
  224.     __except(EXCEPTION_EXECUTE_HANDLER)  
  225.     {  
  226.         ntStatus = GetExceptionCode();  
  227.     }  
  228.       
  229.     if(pQueryBuffer)  
  230.     {  
  231.         ExFreePool(pQueryBuffer);  
  232.         pQueryBuffer = NULL;  
  233.     }  
  234.       
  235.     return NT_SUCCESS(ntStatus);  
  236. }  
  237.   
  238.   
  239.   
  240.   
  241. LARGE_INTEGER g_RegCookie;  
  242.   
  243.   
  244. #if (NTDDI_VERSION >= NTDDI_VISTA)  
  245. NTSTATUS TlGetObjectNameOnVistaAndLater(PVOID Object, PUNICODE_STRING Name)  
  246. {  
  247.     PUNICODE_STRING         pKeyName = NULL;  
  248.     NTSTATUS                ntStatus = 0;  
  249.   
  250.   
  251.     if(Object == NULL || Name == NULL)  
  252.         return STATUS_INVALID_PARAMETER;  
  253.   
  254.   
  255.     ntStatus = CmCallbackGetKeyObjectID(&g_RegCookie,  
  256.                                       Object,  
  257.                                       NULL,  
  258.                                      &pKeyName);  
  259.   
  260.   
  261.     if(NT_SUCCESS(ntStatus) == FALSE)  
  262.     {  
  263.         return ntStatus;  
  264.     }  
  265.   
  266.   
  267.     Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
  268.                             PagedPool,   
  269.                             pKeyName->Length,  
  270.                             'RFLM'  
  271.                             );  
  272.   
  273.   
  274.     if(Name->Buffer == NULL)  
  275.     {  
  276.         return STATUS_INSUFFICIENT_RESOURCES;  
  277.     }  
  278.   
  279.   
  280.     RtlZeroMemory(Name->Buffer, pKeyName->Length);  
  281.   
  282.   
  283.     Name->Length = 0;  
  284.     Name->MaximumLength = pKeyName->Length;  
  285.   
  286.   
  287.     RtlCopyUnicodeString(Name, pKeyName);  
  288.     return STATUS_SUCCESS;  
  289. }  
  290. #endif  
  291.   
  292.   
  293. NTSTATUS TlGetObjectNameOnXP(PVOID Object, PUNICODE_STRING Name)  
  294. {  
  295.     UNICODE_STRING              ustrKeyName             = {0};  
  296.     HANDLE                      ObjectHandle            = NULL;  
  297.     NTSTATUS                    ntStatus                = 0;  
  298.   
  299.   
  300.     if(Object == NULL || Name == NULL)  
  301.         return STATUS_INVALID_PARAMETER;  
  302.   
  303.   
  304.     ntStatus = ObOpenObjectByPointer(Object,  
  305.                               OBJ_KERNEL_HANDLE ,  
  306.                               0,  
  307.                               0,  
  308.                               NULL,  
  309.                               KernelMode,  
  310.                               &ObjectHandle);  
  311.   
  312.   
  313.     if(NT_SUCCESS(ntStatus) == FALSE)  
  314.     {  
  315.         return ntStatus;  
  316.     }  
  317.   
  318.   
  319.     if(MyObQueryObjectName(ObjectHandle, &ustrKeyName, TRUE) == FALSE)  
  320.     {  
  321.         ZwClose(ObjectHandle);  
  322.         return STATUS_INSUFFICIENT_RESOURCES;  
  323.     }  
  324.       
  325.     ZwClose(ObjectHandle);  
  326.   
  327.   
  328.     Name->Buffer = ( PWCHAR )ExAllocatePoolWithTag(   
  329.                             PagedPool,   
  330.                             ustrKeyName.Length,  
  331.                             'RFLM'  
  332.                             );  
  333.   
  334.   
  335.     if(Name->Buffer == NULL)  
  336.     {  
  337.         return STATUS_INSUFFICIENT_RESOURCES;  
  338.     }  
  339.   
  340.   
  341.     RtlZeroMemory(Name->Buffer, ustrKeyName.Length);  
  342.   
  343.   
  344.     Name->Length = 0;  
  345.     Name->MaximumLength = ustrKeyName.Length;  
  346.   
  347.   
  348.     RtlCopyUnicodeString(Name, &ustrKeyName);  
  349.     ExFreePool(ustrKeyName.Buffer);  
  350.   
  351.   
  352.     return STATUS_SUCCESS;  
  353. }  
  354.   
  355.   
  356. NTSTATUS TlGetObjectFullName(PVOID Object, PUNICODE_STRING Name)  
  357. {  
  358. #if (NTDDI_VERSION >= NTDDI_LONGHORN)  
  359.     return TlGetObjectNameOnVistaAndLater(Object, Name);  
  360. #else  
  361.     return TlGetObjectNameOnXP(Object, Name);  
  362. #endif  
  363. }  
  364.   
  365.   
  366.   
  367.   
  368. NTSTATUS MyDeleteKey(PREG_DELETE_KEY_INFORMATION Data)  
  369. {  
  370.     NTSTATUS            ntStatus        = 0;  
  371.     UNICODE_STRING      ustrKeyName     = {0};  
  372.   
  373.   
  374.     __try  
  375.     {  
  376.   
  377.   
  378.         if((ExGetPreviousMode() == KernelMode))  
  379.         {  
  380.             return STATUS_SUCCESS;  
  381.         }  
  382.   
  383.   
  384.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
  385.         {  
  386.             return STATUS_SUCCESS;  
  387.         }  
  388.         DbgPrint("DeleteKey Key:%wZ\n", &ustrKeyName);  
  389.   
  390.   
  391.         ExFreePool(ustrKeyName.Buffer);  
  392.   
  393.   
  394.     }  
  395.     __except(EXCEPTION_EXECUTE_HANDLER)  
  396.     {  
  397.     }  
  398.   
  399.   
  400.     return STATUS_SUCCESS;  
  401. }  
  402.   
  403.   
  404. NTSTATUS MySetValueKey(PREG_SET_VALUE_KEY_INFORMATION Data)  
  405. {  
  406.     NTSTATUS                ntStatus                = 0;  
  407.     UNICODE_STRING          ustrKeyName             = {0};  
  408.     UNICODE_STRING          ustrTarget              = {0};  
  409.     WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
  410.   
  411.   
  412.     __try  
  413.     {  
  414.           
  415.         if((ExGetPreviousMode() == KernelMode))  
  416.         {  
  417.             return STATUS_SUCCESS;  
  418.         }  
  419.   
  420.   
  421.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
  422.         {  
  423.   
  424.   
  425.             return STATUS_SUCCESS;  
  426.         }  
  427.   
  428.   
  429.         ustrTarget.Buffer = wszKeyPath;  
  430.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
  431.           
  432.         RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  433.   
  434.   
  435.   
  436.   
  437.         ExFreePool(ustrKeyName.Buffer);  
  438.   
  439.   
  440.         if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1] != L'\\' )  
  441.             RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  442.   
  443.   
  444.         RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
  445.         DbgPrint("SetValueKey Key:%wZ\n", &ustrTarget);  
  446.   
  447.   
  448.     }  
  449.     __except(EXCEPTION_EXECUTE_HANDLER)  
  450.     {  
  451.   
  452.   
  453.     }  
  454.   
  455.   
  456.     return STATUS_SUCCESS;  
  457. }  
  458.   
  459.   
  460. NTSTATUS MyDeleteValueKey(PREG_DELETE_VALUE_KEY_INFORMATION Data)  
  461. {  
  462.     NTSTATUS                ntStatus                = 0;  
  463.     UNICODE_STRING          ustrKeyName             = {0};  
  464.     UNICODE_STRING          ustrTarget              = {0};  
  465.     WCHAR                   wszKeyPath[MAX_PATH]    = {0};  
  466.   
  467.   
  468.   
  469.   
  470.     __try  
  471.     {  
  472.   
  473.   
  474.         if((ExGetPreviousMode() == KernelMode))  
  475.         {  
  476.             return STATUS_SUCCESS;  
  477.         }  
  478.   
  479.   
  480.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
  481.         {  
  482.             return STATUS_SUCCESS;  
  483.         }  
  484.   
  485.   
  486.         ustrTarget.Buffer = wszKeyPath;  
  487.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
  488.           
  489.         RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  490.   
  491.   
  492.         ExFreePool(ustrKeyName.Buffer);  
  493.   
  494.   
  495.         if (ustrTarget.Buffer[ustrTarget.Length/sizeof(WCHAR) - 1]!=L'\\' )  
  496.             RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  497.   
  498.   
  499.         RtlAppendUnicodeStringToString(&ustrTarget, Data->ValueName);  
  500.         DbgPrint("DeleteValueKey Key:%wZ\n", &ustrTarget);  
  501.   
  502.   
  503.     }  
  504.     __except(EXCEPTION_EXECUTE_HANDLER)  
  505.     {  
  506.   
  507.   
  508.     }  
  509.   
  510.   
  511.     return STATUS_SUCCESS;  
  512. }  
  513.   
  514.   
  515. NTSTATUS MyRenameKey(PREG_RENAME_KEY_INFORMATION Data)  
  516. {  
  517.     NTSTATUS                ntStatus    = 0;  
  518.     UNICODE_STRING          ustrKeyName = {0};  
  519.       
  520.     __try  
  521.     {  
  522.         if((ExGetPreviousMode() == KernelMode))  
  523.         {  
  524.             return STATUS_SUCCESS;  
  525.         }  
  526.   
  527.   
  528.         if(NT_SUCCESS(TlGetObjectFullName(Data->Object, &ustrKeyName)) == FALSE)  
  529.         {  
  530.             return STATUS_SUCCESS;  
  531.         }  
  532.   
  533.   
  534.         DbgPrint("RenameKey Key:%wZ\n", &ustrKeyName);  
  535.   
  536.   
  537.         ExFreePool(ustrKeyName.Buffer);  
  538.   
  539.   
  540.   
  541.   
  542.     }  
  543.     __except(EXCEPTION_EXECUTE_HANDLER)  
  544.     {  
  545.   
  546.   
  547.     }  
  548.   
  549.   
  550.     return STATUS_SUCCESS;  
  551. }  
  552.   
  553.   
  554. NTSTATUS MyCreateKey(PREG_PRE_CREATE_KEY_INFORMATION Data)  
  555. {  
  556.     NTSTATUS            ntStatus                = 0;  
  557.     UNICODE_STRING      ustrTarget              = {0};  
  558.     WCHAR               wszKeyName[MAX_PATH]    = {0};  
  559.   
  560.   
  561.     __try  
  562.     {  
  563.         if((ExGetPreviousMode() == KernelMode))  
  564.         {  
  565.             return STATUS_SUCCESS;  
  566.         }  
  567.           
  568.         ustrTarget.Buffer = wszKeyName;  
  569.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
  570.           
  571.         RtlCopyUnicodeString(&ustrTarget, Data->CompleteName);  
  572.         DbgPrint("CreateKey Key:%wZ\n", &ustrTarget);  
  573.     }  
  574.     __except(EXCEPTION_EXECUTE_HANDLER)  
  575.     {  
  576.     }  
  577.   
  578.   
  579.     return STATUS_SUCCESS;  
  580. }  
  581.   
  582.   
  583. NTSTATUS MyCreateKeyEx(PREG_CREATE_KEY_INFORMATION Data)  
  584. {  
  585.     NTSTATUS            ntStatus    = 0;  
  586.     UNICODE_STRING      ustrKeyName = {0};  
  587.     UNICODE_STRING      ustrTarget  = {0};  
  588.   
  589.   
  590.     __try  
  591.     {  
  592.         if((ExGetPreviousMode() == KernelMode))  
  593.         {  
  594.   
  595.   
  596.             return STATUS_SUCCESS;  
  597.         }  
  598.   
  599.   
  600.         if(NT_SUCCESS(TlGetObjectFullName(Data->RootObject, &ustrKeyName)) == FALSE)  
  601.         {  
  602.   
  603.   
  604.             return STATUS_SUCCESS;  
  605.         }  
  606.   
  607.   
  608.         ustrTarget.MaximumLength = MAX_PATH * sizeof(WCHAR);  
  609.           
  610.         RtlCopyUnicodeString(&ustrTarget, &ustrKeyName);  
  611.   
  612.   
  613.         ExFreePool(ustrKeyName.Buffer);  
  614.           
  615.         if(Data->CompleteName)  
  616.         {  
  617.             RtlAppendUnicodeToString(&ustrTarget, L"\\");  
  618.             RtlAppendUnicodeStringToString(&ustrTarget, Data->CompleteName);  
  619.         }  
  620.   
  621.   
  622.         DbgPrint("CreateKeyEx :%wZ\n", ustrTarget);  
  623.   
  624.   
  625.     }  
  626.     __except(EXCEPTION_EXECUTE_HANDLER)  
  627.     {  
  628.   
  629.   
  630.     }  
  631.   
  632.   
  633.     return STATUS_SUCCESS;  
  634. }  
  635.   
  636.   
  637.   
  638.   
  639. NTSTATUS MyRegCallback  
  640. (  
  641.     PVOID CallbackContext,   
  642.     PVOID Argument1,   
  643.     PVOID Argument2  
  644. )  
  645. {  
  646.     switch( (REG_NOTIFY_CLASS) Argument1)  
  647.     {  
  648.     case RegNtPreDeleteKey :  
  649.         return MyDeleteKey((PREG_DELETE_KEY_INFORMATION) Argument2);  
  650.     case RegNtPreSetValueKey:  
  651.         return MySetValueKey((PREG_SET_VALUE_KEY_INFORMATION) Argument2);  
  652.     case RegNtPreDeleteValueKey:  
  653.         return MyDeleteValueKey((PREG_DELETE_VALUE_KEY_INFORMATION) Argument2);  
  654.     case RegNtPreRenameKey:  
  655.         return MyRenameKey((PREG_RENAME_KEY_INFORMATION) Argument2);  
  656.     case RegNtPreCreateKey:  
  657.         return MyCreateKey((PREG_PRE_CREATE_KEY_INFORMATION) Argument2);      
  658.     case RegNtPreCreateKeyEx:  
  659.         return MyCreateKeyEx((PREG_CREATE_KEY_INFORMATION) Argument2);  
  660.   
  661.   
  662.     }  
  663.   
  664.   
  665.     return STATUS_SUCCESS;  
  666. }  
  667.   
  668.   
  669. NTSTATUS startRegMon(PDRIVER_OBJECT driverObject)  
  670. {  
  671. #if (NTDDI_VERSION >= NTDDI_VISTA)  
  672.     UNICODE_STRING uAltitude;  
  673.   
  674.   
  675.     RtlInitUnicodeString(&uAltitude, g_wszAltitude);  
  676.     return CmRegisterCallbackEx(MyRegCallback,  
  677.                           &uAltitude,  
  678.                           driverObject,  
  679.                           NULL,  
  680.                           &g_RegCookie,  
  681.                           NULL);      
  682. #else  
  683.     return CmRegisterCallback(MyRegCallback,  
  684.                               NULL,  
  685.                              &g_RegCookie);  
  686.   
  687.   
  688. #endif  
  689.                             
  690. }  
  691.   
  692.   
  693. VOID stopRegMon( )  
  694. {  
  695.     CmUnRegisterCallback(g_RegCookie);  
  696. }  
  697.   
  698.   
  699.   
  700.   
  701.   
  702.   
  703. regmon.c  
  704. #ifndef __REGMON_H__  
  705. #define __REGMON_H__  
  706.   
  707.   
  708. typedef enum _OBJECT_INFO_CLASS {  
  709.     ObjectBasicInfo,  
  710.         ObjectNameInfo,  
  711.         ObjectTypeInfo,  
  712.         ObjectAllTypesInfo,  
  713.         ObjectProtectionInfo  
  714. } OBJECT_INFO_CLASS;  
  715.   
  716.   
  717.   
  718.   
  719. PGENERIC_MAPPING IoGetKeyGenericMapping( );  
  720.   
  721.   
  722. NTSTATUS   
  723. MyRegCallback  
  724. (  
  725.     PVOID CallbackContext,   
  726.     PVOID Argument1,   
  727.     PVOID Argument2  
  728. );  
  729.   
  730.   
  731.   
  732.   
  733. NTSTATUS startRegMon(PDRIVER_OBJECT driverObject);  
  734. VOID stopRegMon( );  
  735.   
  736.   
  737.   
  738.   
  739. #endif  

posted on 2017-10-20 20:24  wongnel  阅读(736)  评论(0)    收藏  举报

导航