is it safe to assume registry operations are synchronous ?

NTDEV
1

in my registry monitor i need to get some logging information in
post-callback from pre-callback.

pre_set_value_callback()
{
report_information* log_info = new report_information(…);

log_info->current_thread = PsGetCurrentThread();

fill_info_for_post_callback(log_info);

insert_log_info_into_global_log_info_list(log_info);
}

post_set_value_callback()
{
report_information* log_info_from_pre_callback =
find_log_info_in_global_list_by_thread(PsGetCurrentThread());
}

is that a valid model ?

is it safe to assume that no other registry operation can happen in current
thread until my post_callback returns ?

i have no such problem for w2k/xp (ssdt hook and everything happens in one
function) and for vista+ i can use PreInformation member of
REG_POST_OPERATION_INFORMATION
structure

2

>is that a valid model ?

is it safe to assume that no other registry operation can happen in current thread until my post_callback returns ?

Registry operations are all synchronous so that sounds very reasonable. However I see no reason why you should need to strongly rely on that assumption.

//Daniel

3

Thanks Daniel !
that’s what i thought, but it’s nice to have confirmation from more
experienced guys.

i think that’s pretty much the only model i can use for w2k3

for example i need to log set value operation - report contains old value,
new value and result status.

in precallback i can query old value and have new value in Data member but
don’t have result status yet.

in post callback i only have key object, and not even name for value, so it
is impossible to query new content for value, and there are no way to get
old value

On Thu, May 23, 2013 at 5:05 AM, wrote:

> >is that a valid model ?
> >is it safe to assume that no other registry operation can happen in
> current thread until my post_callback returns ?
>
> Registry operations are all synchronous so that sounds very reasonable.
> However I see no reason why you should need to strongly rely on that
> assumption.
>
> //Daniel
>
>
> —
> NTDEV is sponsored by OSR
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>