why I failed in hook registry functions like regmon does on Windows XP?

NTFSD
1

I use the same way to hook registry operation in my filter driver,
but it fails on Windows XP, on windows 2000 everything is ok,
why?

I based my code on regmon 4.0 for NT, maybe XP doesn’t allow being hooked,
but as far as I know, regmon 6.0 can work on XP, how does it do that? I have
no source code of regmon 6.0, so everything maintains mysterious for me.

please help and thanks!

2

Holk wrote:

> I use the same way to hook registry operation in my filter driver,
> but it fails on Windows XP, on windows 2000 everything is ok,
> why?

The system service descriptors are write-protected, you have to
unprotect them before replacing.

Tobias

3

Hooking is a really bad idea, as has been discussed on NTDEV multiple times,
it should never be used in a commercial product. Windows XP has functions
for getting callback for registry calls, they are supposed to be documented
soon.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Holk” wrote in message news:xxxxx@ntfsd…
> I use the same way to hook registry operation in my filter driver,
> but it fails on Windows XP, on windows 2000 everything is ok,
> why?
>
> I based my code on regmon 4.0 for NT, maybe XP doesn’t allow being hooked,
> but as far as I know, regmon 6.0 can work on XP, how does it do that? I
have
> no source code of regmon 6.0, so everything maintains mysterious for me.
>
> please help and thanks!
>
>
>
>

4

Search For RegistryCallbacksSpec.pdf in Google, you would find the
document which talks about the registry callbacks.

-Srin.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Holk
Sent: Tuesday, May 11, 2004 9:03 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] why I failed in hook registry functions like
regmon does on Windows XP?

I use the same way to hook registry operation in my filter
driver, but it fails on Windows XP, on windows 2000
everything is ok, why?

I based my code on regmon 4.0 for NT, maybe XP doesn’t allow
being hooked, but as far as I know, regmon 6.0 can work on
XP, how does it do that? I have no source code of regmon 6.0,
so everything maintains mysterious for me.

please help and thanks!

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@nai.com
To unsubscribe send a blank email to xxxxx@lists.osr.com