getting the process that is accessing registry

NTFSD
1

Hi everyone,

i am looking into CmRegisterCallback in order to monitor certain registry keys. can any one throw some light about how to get the process that is accessing particular registry key.

regards,
venu

2

PsGetCurrentProcess(), because parameters are usually in the user mode
address space if the previous mode is UserMode.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> Hi everyone,
>
> i am looking into CmRegisterCallback in order to monitor certain registry
> keys. can any one throw some light about how to get the process that is
> accessing particular registry key.
>
> regards,
> venu
>