Are Pre and Post Registry callbacks ordered?

NTDEV
1

Hi,

I am writing a registry monitoring driver. The driver logs every request in the pre-callbcak. Since we get the status in the post callback, the status must be updated in the post callback. Is there any way(like context or something) to co-relate or associate pre and post callbacks of a request.

I also want to know whether THE PRE AND POST CALLBACKS ARE ORDERED?
i.e. pre-callback of a request will be immediately followed by its corresponding post-request. Or can the pre and post callbacks be interleaved?

Thanks in advance!!

Priyanka.

2

Pre and post callbacks are interleaved.
In W2K3/WXP you can try to use thread id to correlate.
In Vista the new callbacks allow you to associate per operation context
which you an use to correlate.

wrote in message news:xxxxx@ntdev…
> Hi,
>
> I am writing a registry monitoring driver. The driver logs every request
> in the pre-callbcak. Since we get the status in the post callback, the
> status must be updated in the post callback. Is there any way(like context
> or something) to co-relate or associate pre and post callbacks of a
> request.
>
> I also want to know whether THE PRE AND POST CALLBACKS ARE ORDERED?
> i.e. pre-callback of a request will be immediately followed by its
> corresponding post-request. Or can the pre and post callbacks be
> interleaved?
>
> Thanks in advance!!
>
> Priyanka.
>

3

Thanks for the quick reply :slight_smile:
You suggested to use thread id to correlate pre and post callbacks in WINXP/ WIN2K3, but the same thread can issue same registry request(for e.g. SetInformationKey or SetValueKey) on the same key(or value key) one after the another in quick succession.
For e.g. say a thread issues two SetValueKey requests on the same key. Now we get each of the two pre and post callbacks in different threads. And even if we get the requestor thread id, its the same for all 4 callbacks here!!
So how do i judge that which post-callback is associated with which pre-callback? since i want to log the status of the corresponding requests.

4

RTFM?

For Windows XP, the system only makes post-notification calls only when a
registry key is created or opened. For Microsoft Windows Server 2003 and
later operating systems, the system makes post-notification calls for every
registry operation.
[snip]

RegisterCallback executes at IRQL = PASSIVE_LEVEL and in the context of the
thread that is performing the registry operation.

wrote in message news:xxxxx@ntdev…
> Thanks for the quick reply :slight_smile:
> You suggested to use thread id to correlate pre and post callbacks in
> WINXP/ WIN2K3, but the same thread can issue same registry request(for
> e.g. SetInformationKey or SetValueKey) on the same key(or value key) one
> after the another in quick succession.
> For e.g. say a thread issues two SetValueKey requests on the same key. Now
> we get each of the two pre and post callbacks in different threads. And
> even if we get the requestor thread id, its the same for all 4 callbacks
> here!!
> So how do i judge that which post-callback is associated with which
> pre-callback? since i want to log the status of the corresponding
> requests.
>