reading registry at boot?

NTFSD
1

I have a mini-filter that loads at boot time and monitors every write. I
would like to read a .ini file or the registry before the first write comes
through. Is this possible? If so should I do this at DriverEntry or at
some later time?

2

Mark

You can read the registry under your DriverEntry RegiistryPath in
HKLM/CurrentControlSet/…; you might have less mleage with
HKLM/Software/…

Cheers
Lyndon

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
>I have a mini-filter that loads at boot time and monitors every write. I
>would like to read a .ini file or the registry before the first write comes
>through. Is this possible? If so should I do this at DriverEntry or at
>some later time?
>
>

3

Thanks… I guess I’ll just have to assume no writes have happened yet.

“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> Mark
>
> You can read the registry under your DriverEntry RegiistryPath in
> HKLM/CurrentControlSet/…; you might have less mleage with
> HKLM/Software/…
>
> Cheers
> Lyndon
>
> “Mark Hahn” wrote in message news:xxxxx@ntfsd…
>>I have a mini-filter that loads at boot time and monitors every write. I
>>would like to read a .ini file or the registry before the first write
>>comes through. Is this possible? If so should I do this at DriverEntry
>>or at some later time?
>>
>>
>
>
>