VC++实现注册表监控

[cpp] view plaincopyprint?

1. //监视HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run项 
2.  
3. #include <windows.h> 
4.  
5. //定义一个监视注册表启动项的函数 
6. int reg() 
7. { 
8.    HANDLE hNotify; 
9.    HKEY hKeyx; 
10.    //DWORD dwRes; 
11.  
12.    hNotify = CreateEvent(NULL, //不使用SECURITY_ATTRIBUTES结构 
13.          FALSE, //不自动重置 
14.          TRUE,   //设置初始状态 
15.          "RegistryNotify"//事件对象的名称 
16.          ); 
17.  
18.    if (hNotify == 0) 
19.    { 
20.      MessageBox(NULL,"CreateEvent failed"," ",MB_OK); 
21.      ExitProcess(0); 
22.    } 
23.  
24.    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE,//根键 
25.          "Software\\Microsoft\\Windows\\CurrentVersion\\Run",//子键 
26.          0, //reserved 
27.          KEY_NOTIFY, //监视用 
28.          &hKeyx //保存句柄 
29.          ) != ERROR_SUCCESS) 
30.    { 
31.      CloseHandle(hNotify); 
32.      MessageBox(NULL,"RegOpenKeyEx failed"," ",MB_OK); 
33.      ExitProcess(0); 
34.    } 
35.  
36.    if (RegNotifyChangeKeyValue(hKeyx,//监视子键句柄 
37.          TRUE, //监视此项的子键 
38.          REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, //监视增加或删除了子键，监视键值发生是否改变 
39.          hNotify, //接受注册表变化事件的事件对象句柄 
40.          TRUE //注册表变化前报告 
41.          ) != ERROR_SUCCESS) 
42.    { 
43.      CloseHandle(hNotify); 
44.      RegCloseKey(hKeyx); 
45.      MessageBox(NULL,"RegNotifyChangeKeyValue failed"," ", MB_OK); 
46.      ExitProcess(0); 
47.    } 
48.  
49.    if (WaitForSingleObject(hNotify, INFINITE) != WAIT_FAILED) 
50.    { 
51.      MessageBox(NULL,"注册表有改动"," ",MB_OK); 
52.    } 
53.  
54.    CloseHandle(hNotify); 
55.    RegCloseKey(hKeyx); 
56.  
57.    return 0; 
58.  
59. } 
60.  
61. void main() 
62. { 
63. // DWORD ID; 
64.  
65. // CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)reg, NULL, 0, &ID);   //创建线程 
66.  
67. // printf("ok\n"); 
68.  
69.     reg(); 
70.  
71. }

原文地址：http://blog.csdn.net/yincheng01/article/details/8107304