Question

I m trying to use RegNotifyChangeKeyValue to monitor changes of a 64-bit registry key. To open this key from a 32-bit application, we must add the access flag KEY_WOW64_64KEY.

不幸的是,我似乎无法监测这一关键因素的变化,只有32比方。

I m 包括一个白天项目以及用于实施登记处监测的Im单元。 http://www.mediafire.com/?w001t11xlthlrkc”rel=“nofollow”

Steps to reproduce the problem:

方案汇编。担任行政长官。 Click thestart button.
开放式管制和航行

KongEY_LOCAL_MACHINESOFTWAREMicrosoftCurrentVersionRun
Add a new value there. RegMonitor will not detect any change.
进口

KongEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftCurrentVersersionRun
增加新的价值。登记员将发现这一变化。

我在开放登记处时添加了KEY_WOW64_64KEY准入旗号,但它仍未通知任何修改,以纠正钥匙,即只纠正Wow6432Node。

如果有可能使用“登记” 改变KeyValue来监测这些关键因素?

Answer 1

以下最低实例显示,从32个轨道程序来看,登记处64个轨道观点的变化。我不知道你的方案有何不同,但这一法典证明,32个比照方案确实能够发现两种观点的变化。

我知道这并没有解决你的问题,但我希望它有助于指导你正确方向。

program RegMonitor;

{$APPTYPE CONSOLE}

uses
  SysUtils, Windows;

procedure Main;
const
  dwFilter: DWORD =
    REG_NOTIFY_CHANGE_NAME or
    REG_NOTIFY_CHANGE_ATTRIBUTES or
    REG_NOTIFY_CHANGE_LAST_SET or
    REG_NOTIFY_CHANGE_SECURITY;
var
  Error: Integer;
  key: HKEY;
begin
  Error := RegOpenKeyEx(
    HKEY_LOCAL_MACHINE,
     SoftwareMicrosoftWindowsCurrentVersionRunOnce ,
    0,
    KEY_NOTIFY or KEY_WOW64_64KEY,
    key
  );
  if Error<>ERROR_SUCCESS then
    RaiseLastOSError(Error);
  try
    Error := RegNotifyChangeKeyValue(
      key,
      True,
      dwFilter,
      0,
      False
    );
    if Error<>ERROR_SUCCESS then
      RaiseLastOSError(Error);
    Writeln( Change detected );
    Readln;
  finally
    RegCloseKey(key);
  end;
end;

begin
  Main;
end.

现在,就你们的方案而言,它似乎有很多问题。但是,根本问题,即不通知你变化,是你的活动是不正确的。为此,请:

CreateEvent(Nil, True, False,  RegistryChangeMonitorEvent )

but you need to create it like this

CreateEvent(nil, True, False, nil)

I ve not delved into what the requirements are for this event, the documentation does not offer any clues. All I did was look for differences between your code and the code in the MSDN example.

改变事件的产生,并有足够的时间开始收到通知。然而,当我作出这一改动时,你的方案仍然没有奏效,也没有失败。你们的目标之一是没有制造的。然而,我认为,这些只是你可以 yourself的常规 b。

I wonder why you are using KEY_ALL_ACCESS. Why don t you use KEY_NOTIFY when you open the key to be passed to RegNotifyChangeKeyValue? And when you try to build a report of what has changed in a key, why don t you use KEY_READ? Since you are not attempting to write ever, KEY_ALL_ACCESS is not appropriate. If you make these changes then you won t need to run as admin.

友情链接