mirror of
https://github.com/weixu8/RegMon
synced 2026-06-08 18:14:19 +00:00
Last version.
This commit is contained in:
Wanderley Caloni
@@ -0,0 +1,22 @@
|
||||
# Auto detect text files and perform LF normalization
|
||||
* text=auto
|
||||
|
||||
# Custom for Visual Studio
|
||||
*.cs diff=csharp
|
||||
*.sln merge=union
|
||||
*.csproj merge=union
|
||||
*.vbproj merge=union
|
||||
*.fsproj merge=union
|
||||
*.dbproj merge=union
|
||||
|
||||
# Standard to msysgit
|
||||
*.doc diff=astextplain
|
||||
*.DOC diff=astextplain
|
||||
*.docx diff=astextplain
|
||||
*.DOCX diff=astextplain
|
||||
*.dot diff=astextplain
|
||||
*.DOT diff=astextplain
|
||||
*.pdf diff=astextplain
|
||||
*.PDF diff=astextplain
|
||||
*.rtf diff=astextplain
|
||||
*.RTF diff=astextplain
|
||||
+163
@@ -0,0 +1,163 @@
|
||||
#################
|
||||
## Eclipse
|
||||
#################
|
||||
|
||||
*.pydevproject
|
||||
.project
|
||||
.metadata
|
||||
bin/
|
||||
tmp/
|
||||
*.tmp
|
||||
*.bak
|
||||
*.swp
|
||||
*~.nib
|
||||
local.properties
|
||||
.classpath
|
||||
.settings/
|
||||
.loadpath
|
||||
|
||||
# External tool builders
|
||||
.externalToolBuilders/
|
||||
|
||||
# Locally stored "Eclipse launch configurations"
|
||||
*.launch
|
||||
|
||||
# CDT-specific
|
||||
.cproject
|
||||
|
||||
# PDT-specific
|
||||
.buildpath
|
||||
|
||||
|
||||
#################
|
||||
## Visual Studio
|
||||
#################
|
||||
|
||||
## Ignore Visual Studio temporary files, build results, and
|
||||
## files generated by popular Visual Studio add-ons.
|
||||
|
||||
# User-specific files
|
||||
*.suo
|
||||
*.user
|
||||
*.sln.docstates
|
||||
|
||||
# Build results
|
||||
[Dd]ebug/
|
||||
[Rr]elease/
|
||||
*_i.c
|
||||
*_p.c
|
||||
*.ilk
|
||||
*.meta
|
||||
*.obj
|
||||
*.pch
|
||||
*.pdb
|
||||
*.pgc
|
||||
*.pgd
|
||||
*.rsp
|
||||
*.sbr
|
||||
*.tlb
|
||||
*.tli
|
||||
*.tlh
|
||||
*.tmp
|
||||
*.vspscc
|
||||
.builds
|
||||
*.dotCover
|
||||
|
||||
## TODO: If you have NuGet Package Restore enabled, uncomment this
|
||||
#packages/
|
||||
|
||||
# Visual C++ cache files
|
||||
ipch/
|
||||
*.aps
|
||||
*.ncb
|
||||
*.opensdf
|
||||
*.sdf
|
||||
|
||||
# Visual Studio profiler
|
||||
*.psess
|
||||
*.vsp
|
||||
|
||||
# ReSharper is a .NET coding add-in
|
||||
_ReSharper*
|
||||
|
||||
# Installshield output folder
|
||||
[Ee]xpress
|
||||
|
||||
# DocProject is a documentation generator add-in
|
||||
DocProject/buildhelp/
|
||||
DocProject/Help/*.HxT
|
||||
DocProject/Help/*.HxC
|
||||
DocProject/Help/*.hhc
|
||||
DocProject/Help/*.hhk
|
||||
DocProject/Help/*.hhp
|
||||
DocProject/Help/Html2
|
||||
DocProject/Help/html
|
||||
|
||||
# Click-Once directory
|
||||
publish
|
||||
|
||||
# Others
|
||||
[Bb]in
|
||||
[Oo]bj
|
||||
sql
|
||||
TestResults
|
||||
*.Cache
|
||||
ClientBin
|
||||
stylecop.*
|
||||
~$*
|
||||
*.dbmdl
|
||||
Generated_Code #added for RIA/Silverlight projects
|
||||
|
||||
# Backup & report files from converting an old project file to a newer
|
||||
# Visual Studio version. Backup files are not needed, because we have git ;-)
|
||||
_UpgradeReport_Files/
|
||||
Backup*/
|
||||
UpgradeLog*.XML
|
||||
|
||||
|
||||
|
||||
############
|
||||
## Windows
|
||||
############
|
||||
|
||||
# Windows image file caches
|
||||
Thumbs.db
|
||||
|
||||
# Folder config file
|
||||
Desktop.ini
|
||||
|
||||
|
||||
#############
|
||||
## Python
|
||||
#############
|
||||
|
||||
*.py[co]
|
||||
|
||||
# Packages
|
||||
*.egg
|
||||
*.egg-info
|
||||
dist
|
||||
build
|
||||
eggs
|
||||
parts
|
||||
bin
|
||||
var
|
||||
sdist
|
||||
develop-eggs
|
||||
.installed.cfg
|
||||
|
||||
# Installer logs
|
||||
pip-log.txt
|
||||
|
||||
# Unit test / coverage reports
|
||||
.coverage
|
||||
.tox
|
||||
|
||||
#Translations
|
||||
*.mo
|
||||
|
||||
#Mr Developer
|
||||
.mr.developer.cfg
|
||||
|
||||
# Mac crap
|
||||
.DS_Store
|
||||
@@ -0,0 +1,5 @@
|
||||
copy %BASEDIR%\lib\%CPU%\Checked\regsys.sys .
|
||||
copy %BASEDIR%\lib\%CPU%\Checked\regsys.sys ..\gui\.
|
||||
copy %BASEDIR%\lib\%CPU%\Checked\regsys.sys ..\gui\release\.
|
||||
copy %BASEDIR%\lib\%CPU%\Checked\regsys.sys ..\gui\debug\.
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
copy %BASEDIR%\lib\%CPU%\free\regsys.sys .
|
||||
copy %BASEDIR%\lib\%CPU%\free\regsys.sys ..\gui\.
|
||||
copy %BASEDIR%\lib\%CPU%\free\regsys.sys ..\gui\release\.
|
||||
copy %BASEDIR%\lib\%CPU%\free\regsys.sys ..\gui\debug\.
|
||||
rmdir /s /q obj
|
||||
del *.log
|
||||
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
#
|
||||
# DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source
|
||||
# file to this component. This file merely indirects to the real make file
|
||||
# that is shared by all the driver components of the Windows NT DDK
|
||||
#
|
||||
|
||||
!INCLUDE $(NTMAKEENV)\makefile.def
|
||||
+2613
File diff suppressed because it is too large
Load Diff
+153
@@ -0,0 +1,153 @@
|
||||
//======================================================================
|
||||
//
|
||||
// Regmon.h
|
||||
//
|
||||
// Copyright (C) 1996, 1997 Mark Russinovich and Bryce Cogswell
|
||||
//
|
||||
// Typedefs and defines.
|
||||
//
|
||||
//======================================================================
|
||||
|
||||
//
|
||||
// Basic types
|
||||
//
|
||||
typedef unsigned int UINT;
|
||||
typedef char CHAR;
|
||||
typedef char * PCHAR;
|
||||
typedef PVOID POBJECT;
|
||||
|
||||
//
|
||||
// The maximum length of Registry values that will be copied
|
||||
//
|
||||
#define MAXVALLEN 256
|
||||
|
||||
//
|
||||
// Maximum seperate filter components
|
||||
//
|
||||
#define MAXFILTERS 64
|
||||
|
||||
//
|
||||
// The maximum registry path length that will be copied
|
||||
//
|
||||
#define MAXPATHLEN 1024
|
||||
|
||||
//
|
||||
// Maximum length of data that will be copied to the "other" field in the display
|
||||
//
|
||||
#define MAXDATALEN 32
|
||||
|
||||
//
|
||||
// Length of process name buffer. Process names are at most 16 characters so
|
||||
// we take into account a trailing NULL.
|
||||
//
|
||||
#define MAXPROCNAMELEN 20
|
||||
|
||||
//
|
||||
// Maximum length of root keys that we will produce abbreviations for
|
||||
//
|
||||
#define MAXROOTLEN 128
|
||||
|
||||
//
|
||||
// Maximum amount of memory that will be grabbed
|
||||
//
|
||||
#define MAXMEM 1000000
|
||||
|
||||
//
|
||||
// Invalid handle
|
||||
//
|
||||
#define INVALID_HANDLE_VALUE ((HANDLE) -1)
|
||||
|
||||
//
|
||||
// Convenient mutex macros
|
||||
//
|
||||
#define MUTEX_INIT(v) KeInitializeMutex( &v, 0 )
|
||||
#define MUTEX_WAIT(v) KeWaitForMutexObject( &v, Executive, KernelMode, FALSE, NULL )
|
||||
#define MUTEX_RELEASE(v) KeReleaseMutex( &v, FALSE )
|
||||
|
||||
//
|
||||
// Definition for system call service table
|
||||
//
|
||||
typedef struct _SRVTABLE {
|
||||
PVOID *ServiceTable;
|
||||
ULONG LowCall;
|
||||
ULONG HiCall;
|
||||
PVOID *ArgTable;
|
||||
} SRVTABLE, *PSRVTABLE;
|
||||
|
||||
//
|
||||
// Structure for our name hash table
|
||||
//
|
||||
typedef struct _nameentry {
|
||||
POBJECT Object;
|
||||
PCHAR FullPathName;
|
||||
struct _nameentry *Next;
|
||||
} HASH_ENTRY, *PHASH_ENTRY;
|
||||
|
||||
//
|
||||
// Structure for keeping linked lists of output buffers
|
||||
//
|
||||
typedef struct _store {
|
||||
ULONG Len;
|
||||
struct _store * Next;
|
||||
char Data[ MAX_STORE ];
|
||||
} STORE_BUF, *PSTORE_BUF;
|
||||
|
||||
//
|
||||
// Rootkey name translation structure
|
||||
//
|
||||
typedef struct _rootkey {
|
||||
CHAR RootName[256];
|
||||
CHAR RootShort[32];
|
||||
ULONG RootNameLen;
|
||||
} ROOTKEY, *PROOTKEY;
|
||||
|
||||
//
|
||||
// Number of hash buckets
|
||||
//
|
||||
#define NUMHASH 0x100
|
||||
#define HASHOBJECT(_regobject) (((ULONG)_regobject)>>2)%NUMHASH
|
||||
|
||||
//
|
||||
// Definition for ZwDeleteValueKey call
|
||||
//
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI ZwDeleteValueKey( IN HANDLE, IN PUNICODE_STRING );
|
||||
|
||||
//
|
||||
// Definition for ObQueryNameString call
|
||||
//
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI ObQueryNameString( POBJECT Object, PUNICODE_STRING Name, ULONG MaximumLength, PULONG ActualLength );
|
||||
|
||||
//
|
||||
// For displaying messages to the Blue Screen
|
||||
//
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI ZwDisplayString( PUNICODE_STRING Text );
|
||||
|
||||
//
|
||||
// Undocumented ntoskrnl function for checking user buffer validity
|
||||
//
|
||||
VOID NTAPI ProbeForWrite(PVOID Address,
|
||||
ULONG Length,
|
||||
ULONG Alignment );
|
||||
|
||||
|
||||
//
|
||||
// Pointer to the image of the system service table
|
||||
//
|
||||
extern PSRVTABLE KeServiceDescriptorTable;
|
||||
|
||||
|
||||
//
|
||||
// Extract transfer type
|
||||
//
|
||||
#define IOCTL_TRANSFER_TYPE( _iocontrol) (_iocontrol & 0x3)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
#include <windows.h>
|
||||
|
||||
#define VER_DEBUG 0
|
||||
#define VER_PRERELEASE 0
|
||||
#define VER_FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
|
||||
#define VER_FILEOS VOS_NT_WINDOWS32
|
||||
#define VER_FILEFLAGS (VER_PRERELEASE|VER_DEBUG)
|
||||
|
||||
#define VER_FILETYPE VFT_DRV
|
||||
#define VER_FILESUBTYPE VFT2_DRV_SYSTEM
|
||||
|
||||
#define VER_COMPANYNAME_STR "Systems Internals"
|
||||
#define VER_PRODUCTNAME_STR "Regmon for Windows NT"
|
||||
#define VER_LEGALCOPYRIGHT_YEARS "1996-1999"
|
||||
#define VER_LEGALCOPYRIGHT_STR "Copyright (C) M. Russinovich and B. Cogswell " VER_LEGALCOPYRIGHT_YEARS
|
||||
#define VER_LEGALTRADEMARKS_STR "Copyright (C) 1996-1999 Mark Russinovich and Bryce Cogswell"
|
||||
|
||||
#define VER_PRODUCTVERSION 4,022,00,00
|
||||
#define VER_PRODUCTVERSION_STR "4.022"
|
||||
#define VER_PRODUCTVERSION_W (0x04022)
|
||||
#define VER_PRODUCTVERSION_DW (0x04022)
|
||||
#define VER_FILEDESCRIPTION_STR "Windows NT Registry Monitor"
|
||||
#define VER_INTERNALNAME_STR "regmon.sys"
|
||||
#define VER_ORIGINALFILENAME_STR "regmon.Sys"
|
||||
|
||||
#include "common.ver"
|
||||
|
||||
Binary file not shown.
@@ -0,0 +1,5 @@
|
||||
TARGETNAME=regsys
|
||||
TARGETPATH=$(BASEDIR)\lib
|
||||
TARGETTYPE=DRIVER
|
||||
|
||||
SOURCES=regsys.c regsys.rc
|
||||
@@ -0,0 +1,53 @@
|
||||
|
||||
Regmon for Windows NT/9x
|
||||
Copyright (C) 1996-1999 Mark Russinovich and Bryce Cogswell
|
||||
http://www.sysinternals.com
|
||||
|
||||
Using Regmon
|
||||
------------
|
||||
|
||||
Start Regmon.exe from its home directory. Complete usage
|
||||
instructions are available in the on-line help file.
|
||||
|
||||
Building Regmon
|
||||
----------------
|
||||
|
||||
Regmon consists of a device driver and a GUI. The NT driver was built with
|
||||
the Windows NT DDK Build environment and the GUI was compiled with
|
||||
Microsoft Visual C++ 6.0. The VxD was built using Vireo Software's
|
||||
(now NuMega Labs) VtoolsD 2.0.
|
||||
|
||||
The help was entered with Microsoft Word 97 and Help Workshop
|
||||
for Word 97.
|
||||
|
||||
To install, copy Regmon.exe, Regvxd.vxd and regsys.sys to the same
|
||||
directory.
|
||||
|
||||
Terms of Use
|
||||
------------
|
||||
|
||||
This software is provided "as is", without any guarantee made
|
||||
as to its suitability or fitness for any particular use. It may
|
||||
contain bugs, so use of this tool is at your own risk. We take
|
||||
no responsilbity for any damage that may unintentionally be caused
|
||||
through its use.
|
||||
|
||||
You may use the source in commercial applications without fee, however
|
||||
any software distributed based on Regmon must have significant added
|
||||
value in functionality over what is present here. For example, you
|
||||
cannot distribute or sell a Registry monitor based on this code, though
|
||||
you can distribute and sell a product that uses Registry monitoring
|
||||
to capture changes made during a software installation in order
|
||||
to perform an automatic uninstall.
|
||||
|
||||
You may not distribute Regmon in any form without express written
|
||||
permission of Mark Russinovich or Bryce Cogswell.
|
||||
|
||||
Reporting Problems
|
||||
------------------
|
||||
|
||||
If you encounter problems, please visit http://www.sysinternals.com
|
||||
and download the latest version to see if the issue has been resolved.
|
||||
If not, please send a bug report to:
|
||||
|
||||
mark@sysinternals.com and cogswell@winternals.com
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 1.1 KiB |
@@ -0,0 +1,11 @@
|
||||
@echo off
|
||||
del alpharel\*.idb
|
||||
del alpharel\*.obj
|
||||
del alpharel\*.res
|
||||
del release\*.idb
|
||||
del release\*.obj
|
||||
del release\*.res
|
||||
echo Cleaned
|
||||
echo
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 1.1 KiB |
+251
@@ -0,0 +1,251 @@
|
||||
/******************************************************************************
|
||||
*
|
||||
* Regmon - Registry Monitor for Windows NT and Windows 9x
|
||||
*
|
||||
* Copyright (c) 1996 - 1998 Mark Russinovich and Bryce Cogswell
|
||||
*
|
||||
* See readme.txt for terms and conditions.
|
||||
*
|
||||
* FILE: Instdrv.c
|
||||
*
|
||||
* PURPOSE: Loads and unloads device drivers. This code
|
||||
* is taken from the instdrv example in the NT DDK.
|
||||
*
|
||||
******************************************************************************/
|
||||
#include <windows.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "regmon.h"
|
||||
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: InstallDriver( IN SC_HANDLE, IN LPCTSTR, IN LPCTSTR)
|
||||
*
|
||||
* PURPOSE: Creates a driver service.
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL InstallDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName, IN LPCTSTR ServiceExe )
|
||||
{
|
||||
SC_HANDLE schService;
|
||||
|
||||
//
|
||||
// NOTE: This creates an entry for a standalone driver. If this
|
||||
// is modified for use with a driver that requires a Tag,
|
||||
// Group, and/or Dependencies, it may be necessary to
|
||||
// query the registry for existing driver information
|
||||
// (in order to determine a unique Tag, etc.).
|
||||
//
|
||||
|
||||
schService = CreateService( SchSCManager, // SCManager database
|
||||
DriverName, // name of service
|
||||
DriverName, // name to display
|
||||
SERVICE_ALL_ACCESS, // desired access
|
||||
SERVICE_KERNEL_DRIVER, // service type
|
||||
SERVICE_DEMAND_START, // start type
|
||||
SERVICE_ERROR_NORMAL, // error control type
|
||||
ServiceExe, // service's binary
|
||||
NULL, // no load ordering group
|
||||
NULL, // no tag identifier
|
||||
NULL, // no dependencies
|
||||
NULL, // LocalSystem account
|
||||
NULL // no password
|
||||
);
|
||||
if ( schService == NULL )
|
||||
return FALSE;
|
||||
|
||||
CloseServiceHandle( schService );
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: StartDriver( IN SC_HANDLE, IN LPCTSTR)
|
||||
*
|
||||
* PURPOSE: Starts the driver service.
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL StartDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName )
|
||||
{
|
||||
SC_HANDLE schService;
|
||||
BOOL ret;
|
||||
|
||||
schService = OpenService( SchSCManager,
|
||||
DriverName,
|
||||
SERVICE_ALL_ACCESS
|
||||
);
|
||||
if ( schService == NULL )
|
||||
return FALSE;
|
||||
|
||||
ret = StartService( schService, 0, NULL )
|
||||
|| GetLastError() == ERROR_SERVICE_ALREADY_RUNNING;
|
||||
|
||||
CloseServiceHandle( schService );
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: OpenDevice( IN LPCTSTR, HANDLE *)
|
||||
*
|
||||
* PURPOSE: Opens the device and returns a handle if desired.
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL OpenDevice( IN LPCTSTR DriverName, HANDLE * lphDevice )
|
||||
{
|
||||
TCHAR completeDeviceName[64];
|
||||
HANDLE hDevice;
|
||||
|
||||
//
|
||||
// Create a \\.\XXX device name that CreateFile can use
|
||||
//
|
||||
// NOTE: We're making an assumption here that the driver
|
||||
// has created a symbolic link using it's own name
|
||||
// (i.e. if the driver has the name "XXX" we assume
|
||||
// that it used IoCreateSymbolicLink to create a
|
||||
// symbolic link "\DosDevices\XXX". Usually, there
|
||||
// is this understanding between related apps/drivers.
|
||||
//
|
||||
// An application might also peruse the DEVICEMAP
|
||||
// section of the registry, or use the QueryDosDevice
|
||||
// API to enumerate the existing symbolic links in the
|
||||
// system.
|
||||
//
|
||||
|
||||
wsprintf( completeDeviceName, TEXT("\\\\.\\%s"), DriverName );
|
||||
|
||||
hDevice = CreateFile( completeDeviceName,
|
||||
GENERIC_READ | GENERIC_WRITE,
|
||||
0,
|
||||
NULL,
|
||||
OPEN_EXISTING,
|
||||
FILE_ATTRIBUTE_NORMAL,
|
||||
NULL
|
||||
);
|
||||
if ( hDevice == ((HANDLE)-1) )
|
||||
return FALSE;
|
||||
|
||||
// If user wants handle, give it to them. Otherwise, just close it.
|
||||
if ( lphDevice )
|
||||
*lphDevice = hDevice;
|
||||
else
|
||||
CloseHandle( hDevice );
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: StopDriver( IN SC_HANDLE, IN LPCTSTR)
|
||||
*
|
||||
* PURPOSE: Has the configuration manager stop the driver (unload it)
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL StopDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName )
|
||||
{
|
||||
SC_HANDLE schService;
|
||||
BOOL ret;
|
||||
SERVICE_STATUS serviceStatus;
|
||||
|
||||
schService = OpenService( SchSCManager, DriverName, SERVICE_ALL_ACCESS );
|
||||
if ( schService == NULL )
|
||||
return FALSE;
|
||||
|
||||
ret = ControlService( schService, SERVICE_CONTROL_STOP, &serviceStatus );
|
||||
|
||||
CloseServiceHandle( schService );
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: RemoveDriver( IN SC_HANDLE, IN LPCTSTR)
|
||||
*
|
||||
* PURPOSE: Deletes the driver service.
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL RemoveDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName )
|
||||
{
|
||||
SC_HANDLE schService;
|
||||
BOOL ret;
|
||||
|
||||
schService = OpenService( SchSCManager,
|
||||
DriverName,
|
||||
SERVICE_ALL_ACCESS
|
||||
);
|
||||
|
||||
if ( schService == NULL )
|
||||
return FALSE;
|
||||
|
||||
ret = DeleteService( schService );
|
||||
|
||||
CloseServiceHandle( schService );
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: UnloadDeviceDriver( const TCHAR *)
|
||||
*
|
||||
* PURPOSE: Stops the driver and has the configuration manager unload it.
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL UnloadDeviceDriver( const TCHAR * Name )
|
||||
{
|
||||
SC_HANDLE schSCManager;
|
||||
|
||||
schSCManager = OpenSCManager( NULL, // machine (NULL == local)
|
||||
NULL, // database (NULL == default)
|
||||
SC_MANAGER_ALL_ACCESS // access required
|
||||
);
|
||||
|
||||
StopDriver( schSCManager, Name );
|
||||
RemoveDriver( schSCManager, Name );
|
||||
|
||||
CloseServiceHandle( schSCManager );
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
/****************************************************************************
|
||||
*
|
||||
* FUNCTION: LoadDeviceDriver( const TCHAR, const TCHAR, HANDLE *)
|
||||
*
|
||||
* PURPOSE: Registers a driver with the system configuration manager
|
||||
* and then loads it.
|
||||
*
|
||||
****************************************************************************/
|
||||
BOOL LoadDeviceDriver( const TCHAR * Name, const TCHAR * Path, HANDLE * lphDevice )
|
||||
{
|
||||
SC_HANDLE schSCManager;
|
||||
BOOL okay;
|
||||
|
||||
schSCManager = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
|
||||
|
||||
// Remove old instances
|
||||
RemoveDriver( schSCManager, Name );
|
||||
|
||||
// Ignore success of installation: it may already be installed.
|
||||
InstallDriver( schSCManager, Name, Path );
|
||||
|
||||
// Ignore success of start: it may already be started.
|
||||
StartDriver( schSCManager, Name );
|
||||
|
||||
// Do make sure we can open it.
|
||||
okay = OpenDevice( Name, lphDevice );
|
||||
|
||||
CloseServiceHandle( schSCManager );
|
||||
|
||||
return okay;
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
//======================================================================
|
||||
//
|
||||
// Ioctlcmd.h
|
||||
//
|
||||
// Copyright (C) 1996, 1997 Mark Russinovich and Bryce Cogswell
|
||||
//
|
||||
// Common header file for device driver and GUI. Contains common
|
||||
// data structure definitions and IOCTL command codes.
|
||||
//
|
||||
//======================================================================
|
||||
|
||||
//
|
||||
// Define the various device type values. Note that values used by Microsoft
|
||||
// Corporation are in the range 0-32767, and 32768-65535 are reserved for use
|
||||
// by customers.
|
||||
//
|
||||
#define FILE_DEVICE_REGMON 0x00008305
|
||||
|
||||
//
|
||||
// Version #
|
||||
//
|
||||
#define REGMONVERSION 360
|
||||
|
||||
|
||||
//
|
||||
// Commands that the GUI can send the device driver
|
||||
//
|
||||
#define REGMON_hook (ULONG) CTL_CODE( FILE_DEVICE_REGMON, 0x00, METHOD_BUFFERED, FILE_ANY_ACCESS )
|
||||
#define REGMON_unhook (ULONG) CTL_CODE( FILE_DEVICE_REGMON, 0x01, METHOD_BUFFERED, FILE_ANY_ACCESS )
|
||||
#define REGMON_zerostats (ULONG) CTL_CODE( FILE_DEVICE_REGMON, 0x02, METHOD_BUFFERED, FILE_ANY_ACCESS )
|
||||
#define REGMON_getstats (ULONG) CTL_CODE( FILE_DEVICE_REGMON, 0x03, METHOD_NEITHER, FILE_ANY_ACCESS )
|
||||
#define REGMON_setfilter (ULONG) CTL_CODE( FILE_DEVICE_REGMON, 0x04, METHOD_BUFFERED, FILE_ANY_ACCESS )
|
||||
#define REGMON_version (ULONG) CTL_CODE( FILE_DEVICE_REGMON, 0x05, METHOD_BUFFERED, FILE_ANY_ACCESS )
|
||||
|
||||
//
|
||||
// Format of an output buffer entry
|
||||
//
|
||||
typedef struct {
|
||||
ULONG seq;
|
||||
char text[0];
|
||||
} ENTRY, *PENTRY;
|
||||
|
||||
//
|
||||
// Length of a filter definition string
|
||||
//
|
||||
#define MAXFILTERLEN 256
|
||||
|
||||
//
|
||||
// Filter definition
|
||||
//
|
||||
typedef struct {
|
||||
char processfilter[MAXFILTERLEN];
|
||||
char processexclude[MAXFILTERLEN];
|
||||
char pathfilter[MAXFILTERLEN];
|
||||
char excludefilter[MAXFILTERLEN];
|
||||
BOOLEAN logsuccess;
|
||||
BOOLEAN logerror;
|
||||
BOOLEAN logreads;
|
||||
BOOLEAN logwrites;
|
||||
} FILTER, *PFILTER;
|
||||
|
||||
|
||||
//
|
||||
// Define page size for use by GUI
|
||||
//
|
||||
#ifndef PAGE_SIZE
|
||||
#if defined(_ALPHA_)
|
||||
#define PAGE_SIZE 0x2000 // 8K
|
||||
#else
|
||||
#define PAGE_SIZE 0x1000 // 4K
|
||||
#endif
|
||||
#endif
|
||||
|
||||
//
|
||||
// An allocation unit size
|
||||
//
|
||||
#define MAX_STORE (PAGE_SIZE*16 - 8)
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 694 B |
+137
@@ -0,0 +1,137 @@
|
||||
# Microsoft Developer Studio Project File - Name="regaxp" - Package Owner=<4>
|
||||
# Microsoft Developer Studio Generated Build File, Format Version 6.00
|
||||
# ** DO NOT EDIT **
|
||||
|
||||
# TARGTYPE "Win32 (ALPHA) Application" 0x0601
|
||||
|
||||
CFG=regaxp - Win32 Debug
|
||||
!MESSAGE This is not a valid makefile. To build this project using NMAKE,
|
||||
!MESSAGE use the Export Makefile command and run
|
||||
!MESSAGE
|
||||
!MESSAGE NMAKE /f "regaxp.mak".
|
||||
!MESSAGE
|
||||
!MESSAGE You can specify a configuration when running NMAKE
|
||||
!MESSAGE by defining the macro CFG on the command line. For example:
|
||||
!MESSAGE
|
||||
!MESSAGE NMAKE /f "regaxp.mak" CFG="regaxp - Win32 Debug"
|
||||
!MESSAGE
|
||||
!MESSAGE Possible choices for configuration are:
|
||||
!MESSAGE
|
||||
!MESSAGE "regaxp - Win32 Release" (based on "Win32 (ALPHA) Application")
|
||||
!MESSAGE "regaxp - Win32 Debug" (based on "Win32 (ALPHA) Application")
|
||||
!MESSAGE
|
||||
|
||||
# Begin Project
|
||||
# PROP AllowPerConfigDependencies 0
|
||||
# PROP Scc_ProjName ""
|
||||
# PROP Scc_LocalPath ""
|
||||
MTL=midl.exe
|
||||
RSC=rc.exe
|
||||
|
||||
!IF "$(CFG)" == "regaxp - Win32 Release"
|
||||
|
||||
# PROP BASE Use_MFC 0
|
||||
# PROP BASE Use_Debug_Libraries 0
|
||||
# PROP BASE Output_Dir "AlphaRel"
|
||||
# PROP BASE Intermediate_Dir "AlphaRel"
|
||||
# PROP BASE Target_Dir ""
|
||||
# PROP Use_MFC 0
|
||||
# PROP Use_Debug_Libraries 0
|
||||
# PROP Output_Dir "AlphaRel"
|
||||
# PROP Intermediate_Dir "AlphaRel"
|
||||
# PROP Ignore_Export_Lib 0
|
||||
# PROP Target_Dir ""
|
||||
CPP=cl.exe
|
||||
# ADD BASE CPP /nologo /Gt0 /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /YX /FD /c
|
||||
# ADD CPP /nologo /Gt0 /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /FD /c
|
||||
# SUBTRACT CPP /YX
|
||||
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /o "NUL" /win32
|
||||
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /o "NUL" /win32
|
||||
# ADD BASE RSC /l 0x409 /d "NDEBUG"
|
||||
# ADD RSC /l 0x409 /d "NDEBUG"
|
||||
BSC32=bscmake.exe
|
||||
# ADD BASE BSC32 /nologo
|
||||
# ADD BSC32 /nologo
|
||||
LINK32=link.exe
|
||||
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib /nologo /subsystem:windows /machine:ALPHA
|
||||
# ADD LINK32 kernel32.lib user32.lib gdi32.lib comctl32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib /nologo /subsystem:windows /machine:ALPHA /out:"AlphaRel/regmon.exe"
|
||||
|
||||
!ELSEIF "$(CFG)" == "regaxp - Win32 Debug"
|
||||
|
||||
# PROP BASE Use_MFC 0
|
||||
# PROP BASE Use_Debug_Libraries 1
|
||||
# PROP BASE Output_Dir "AlphaDbg"
|
||||
# PROP BASE Intermediate_Dir "AlphaDbg"
|
||||
# PROP BASE Target_Dir ""
|
||||
# PROP Use_MFC 0
|
||||
# PROP Use_Debug_Libraries 1
|
||||
# PROP Output_Dir "AlphaDbg"
|
||||
# PROP Intermediate_Dir "AlphaDbg"
|
||||
# PROP Ignore_Export_Lib 0
|
||||
# PROP Target_Dir ""
|
||||
CPP=cl.exe
|
||||
# ADD BASE CPP /nologo /Gt0 /W3 /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /YX /FD /c
|
||||
# ADD CPP /nologo /Gt0 /W3 /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /FD /c
|
||||
# SUBTRACT CPP /YX
|
||||
# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /o "NUL" /win32
|
||||
# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /o "NUL" /win32
|
||||
# ADD BASE RSC /l 0x409 /d "_DEBUG"
|
||||
# ADD RSC /l 0x409 /d "_DEBUG"
|
||||
BSC32=bscmake.exe
|
||||
# ADD BASE BSC32 /nologo
|
||||
# ADD BSC32 /nologo
|
||||
LINK32=link.exe
|
||||
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib /nologo /subsystem:windows /debug /machine:ALPHA
|
||||
# ADD LINK32 kernel32.lib user32.lib gdi32.lib comctl32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib /nologo /subsystem:windows /debug /machine:ALPHA /out:"AlphaDbg/regmon.exe"
|
||||
|
||||
!ENDIF
|
||||
|
||||
# Begin Target
|
||||
|
||||
# Name "regaxp - Win32 Release"
|
||||
# Name "regaxp - Win32 Debug"
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\APPICON.ICO
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\icon.ico
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\INSTDRV.C
|
||||
DEP_CPP_INSTD=\
|
||||
".\REGMON.H"\
|
||||
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\IOCTLCMD.H
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.C
|
||||
DEP_CPP_REGMO=\
|
||||
".\IOCTLCMD.H"\
|
||||
".\REGMON.H"\
|
||||
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.H
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\regmon.RC
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\RESOURCE.H
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\toolbar1.bmp
|
||||
# End Source File
|
||||
# End Target
|
||||
# End Project
|
||||
+2142
File diff suppressed because it is too large
Load Diff
+133
@@ -0,0 +1,133 @@
|
||||
# Microsoft Developer Studio Project File - Name="regmon" - Package Owner=<4>
|
||||
# Microsoft Developer Studio Generated Build File, Format Version 6.00
|
||||
# ** DO NOT EDIT **
|
||||
|
||||
# TARGTYPE "Win32 (x86) Application" 0x0101
|
||||
|
||||
CFG=regmon - Win32 Release
|
||||
!MESSAGE This is not a valid makefile. To build this project using NMAKE,
|
||||
!MESSAGE use the Export Makefile command and run
|
||||
!MESSAGE
|
||||
!MESSAGE NMAKE /f "Regmon.mak".
|
||||
!MESSAGE
|
||||
!MESSAGE You can specify a configuration when running NMAKE
|
||||
!MESSAGE by defining the macro CFG on the command line. For example:
|
||||
!MESSAGE
|
||||
!MESSAGE NMAKE /f "Regmon.mak" CFG="regmon - Win32 Release"
|
||||
!MESSAGE
|
||||
!MESSAGE Possible choices for configuration are:
|
||||
!MESSAGE
|
||||
!MESSAGE "regmon - Win32 Release" (based on "Win32 (x86) Application")
|
||||
!MESSAGE "regmon - Win32 Debug" (based on "Win32 (x86) Application")
|
||||
!MESSAGE
|
||||
|
||||
# Begin Project
|
||||
# PROP AllowPerConfigDependencies 0
|
||||
# PROP Scc_ProjName ""
|
||||
# PROP Scc_LocalPath ""
|
||||
CPP=cl.exe
|
||||
MTL=midl.exe
|
||||
RSC=rc.exe
|
||||
|
||||
!IF "$(CFG)" == "regmon - Win32 Release"
|
||||
|
||||
# PROP BASE Use_MFC 0
|
||||
# PROP BASE Use_Debug_Libraries 0
|
||||
# PROP BASE Output_Dir ".\Release"
|
||||
# PROP BASE Intermediate_Dir ".\Release"
|
||||
# PROP BASE Target_Dir ""
|
||||
# PROP Use_MFC 0
|
||||
# PROP Use_Debug_Libraries 0
|
||||
# PROP Output_Dir ".\Release"
|
||||
# PROP Intermediate_Dir ".\Release"
|
||||
# PROP Ignore_Export_Lib 0
|
||||
# PROP Target_Dir ""
|
||||
# ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /YX /c
|
||||
# ADD CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /FD /c
|
||||
# SUBTRACT CPP /YX
|
||||
# ADD BASE MTL /nologo /D "NDEBUG" /win32
|
||||
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
|
||||
# ADD BASE RSC /l 0x409 /d "NDEBUG"
|
||||
# ADD RSC /l 0x409 /d "NDEBUG"
|
||||
BSC32=bscmake.exe
|
||||
# ADD BASE BSC32 /nologo
|
||||
# ADD BSC32 /nologo
|
||||
LINK32=link.exe
|
||||
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:windows /machine:I386
|
||||
# ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib comctl32.lib /nologo /subsystem:windows /machine:I386
|
||||
|
||||
!ELSEIF "$(CFG)" == "regmon - Win32 Debug"
|
||||
|
||||
# PROP BASE Use_MFC 0
|
||||
# PROP BASE Use_Debug_Libraries 1
|
||||
# PROP BASE Output_Dir ".\Debug"
|
||||
# PROP BASE Intermediate_Dir ".\Debug"
|
||||
# PROP BASE Target_Dir ""
|
||||
# PROP Use_MFC 0
|
||||
# PROP Use_Debug_Libraries 1
|
||||
# PROP Output_Dir ".\Debug"
|
||||
# PROP Intermediate_Dir ".\Debug"
|
||||
# PROP Ignore_Export_Lib 0
|
||||
# PROP Target_Dir ""
|
||||
# ADD BASE CPP /nologo /W3 /Gm /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /YX /c
|
||||
# ADD CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /FD /c
|
||||
# SUBTRACT CPP /YX
|
||||
# ADD BASE MTL /nologo /D "_DEBUG" /win32
|
||||
# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
|
||||
# ADD BASE RSC /l 0x409 /d "_DEBUG"
|
||||
# ADD RSC /l 0x409 /d "_DEBUG"
|
||||
BSC32=bscmake.exe
|
||||
# ADD BASE BSC32 /nologo
|
||||
# ADD BSC32 /nologo
|
||||
LINK32=link.exe
|
||||
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:windows /debug /machine:I386
|
||||
# ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib comctl32.lib /nologo /subsystem:windows /debug /machine:I386
|
||||
|
||||
!ENDIF
|
||||
|
||||
# Begin Target
|
||||
|
||||
# Name "regmon - Win32 Release"
|
||||
# Name "regmon - Win32 Debug"
|
||||
# Begin Group "Source Files"
|
||||
|
||||
# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;hpj;bat;for;f90"
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\INSTDRV.C
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.C
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.H
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.RC
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\RESOURCE.H
|
||||
# End Source File
|
||||
# End Group
|
||||
# Begin Group "Header Files"
|
||||
|
||||
# PROP Default_Filter "h;hpp;hxx;hm;inl;fi;fd"
|
||||
# End Group
|
||||
# Begin Group "Resource Files"
|
||||
|
||||
# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;cnt;rtf;gif;jpg;jpeg;jpe"
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\APPICON.ICO
|
||||
# End Source File
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\toolbar1.bmp
|
||||
# End Source File
|
||||
# End Group
|
||||
# End Target
|
||||
# End Project
|
||||
@@ -0,0 +1,41 @@
|
||||
Microsoft Developer Studio Workspace File, Format Version 6.00
|
||||
# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
|
||||
|
||||
###############################################################################
|
||||
|
||||
Project: "regaxp"=.\regaxp.dsp - Package Owner=<4>
|
||||
|
||||
Package=<5>
|
||||
{{{
|
||||
}}}
|
||||
|
||||
Package=<4>
|
||||
{{{
|
||||
}}}
|
||||
|
||||
###############################################################################
|
||||
|
||||
Project: "regmon"=.\Regmon.dsp - Package Owner=<4>
|
||||
|
||||
Package=<5>
|
||||
{{{
|
||||
}}}
|
||||
|
||||
Package=<4>
|
||||
{{{
|
||||
}}}
|
||||
|
||||
###############################################################################
|
||||
|
||||
Global:
|
||||
|
||||
Package=<5>
|
||||
{{{
|
||||
}}}
|
||||
|
||||
Package=<3>
|
||||
{{{
|
||||
}}}
|
||||
|
||||
###############################################################################
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
BOOL LoadDeviceDriver( const char * Name, const char * Path, HANDLE * lphDevice );
|
||||
BOOL UnloadDeviceDriver( const char * Name );
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
; This file is maintained by HCW. Do not modify this file directly.
|
||||
|
||||
[OPTIONS]
|
||||
LCID=0x409 0x0 0x0 ; English (United States)
|
||||
REPORT=Yes
|
||||
CONTENTS=INTRO
|
||||
TITLE=Regmon for Windows NT/9x
|
||||
COPYRIGHT=Copyright \251 1997-1998 Mark Russinovich and Bryce Cogswell
|
||||
HLP=.\release\regmon.hlp
|
||||
|
||||
[FILES]
|
||||
regmon.rtf
|
||||
+262
@@ -0,0 +1,262 @@
|
||||
# Microsoft Developer Studio Generated NMAKE File, Format Version 4.00
|
||||
# ** DO NOT EDIT **
|
||||
|
||||
# TARGTYPE "Win32 (x86) Application" 0x0101
|
||||
|
||||
!IF "$(CFG)" == ""
|
||||
CFG=regmon - Win32 Debug
|
||||
!MESSAGE No configuration specified. Defaulting to regmon - Win32 Debug.
|
||||
!ENDIF
|
||||
|
||||
!IF "$(CFG)" != "regmon - Win32 Release" && "$(CFG)" != "regmon - Win32 Debug"
|
||||
!MESSAGE Invalid configuration "$(CFG)" specified.
|
||||
!MESSAGE You can specify a configuration when running NMAKE on this makefile
|
||||
!MESSAGE by defining the macro CFG on the command line. For example:
|
||||
!MESSAGE
|
||||
!MESSAGE NMAKE /f "Regmon.mak" CFG="regmon - Win32 Debug"
|
||||
!MESSAGE
|
||||
!MESSAGE Possible choices for configuration are:
|
||||
!MESSAGE
|
||||
!MESSAGE "regmon - Win32 Release" (based on "Win32 (x86) Application")
|
||||
!MESSAGE "regmon - Win32 Debug" (based on "Win32 (x86) Application")
|
||||
!MESSAGE
|
||||
!ERROR An invalid configuration is specified.
|
||||
!ENDIF
|
||||
|
||||
!IF "$(OS)" == "Windows_NT"
|
||||
NULL=
|
||||
!ELSE
|
||||
NULL=nul
|
||||
!ENDIF
|
||||
################################################################################
|
||||
# Begin Project
|
||||
# PROP Target_Last_Scanned "regmon - Win32 Debug"
|
||||
RSC=rc.exe
|
||||
MTL=mktyplib.exe
|
||||
CPP=cl.exe
|
||||
|
||||
!IF "$(CFG)" == "regmon - Win32 Release"
|
||||
|
||||
# PROP BASE Use_MFC 0
|
||||
# PROP BASE Use_Debug_Libraries 0
|
||||
# PROP BASE Output_Dir "Release"
|
||||
# PROP BASE Intermediate_Dir "Release"
|
||||
# PROP BASE Target_Dir ""
|
||||
# PROP Use_MFC 0
|
||||
# PROP Use_Debug_Libraries 0
|
||||
# PROP Output_Dir "Release"
|
||||
# PROP Intermediate_Dir "Release"
|
||||
# PROP Target_Dir ""
|
||||
OUTDIR=.\Release
|
||||
INTDIR=.\Release
|
||||
|
||||
ALL : "$(OUTDIR)\NTREGMON.exe"
|
||||
|
||||
CLEAN :
|
||||
-@erase ".\Release\NTREGMON.exe"
|
||||
-@erase ".\Release\REGMON.OBJ"
|
||||
-@erase ".\Release\INSTDRV.OBJ"
|
||||
-@erase ".\Release\REGMON.res"
|
||||
|
||||
"$(OUTDIR)" :
|
||||
if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
|
||||
|
||||
# ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /YX /c
|
||||
# ADD CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /c
|
||||
# SUBTRACT CPP /YX
|
||||
CPP_PROJ=/nologo /ML /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS"\
|
||||
/Fo"$(INTDIR)/" /c
|
||||
CPP_OBJS=.\Release/
|
||||
CPP_SBRS=
|
||||
# ADD BASE MTL /nologo /D "NDEBUG" /win32
|
||||
# ADD MTL /nologo /D "NDEBUG" /win32
|
||||
MTL_PROJ=/nologo /D "NDEBUG" /win32
|
||||
# ADD BASE RSC /l 0x409 /d "NDEBUG"
|
||||
# ADD RSC /l 0x409 /d "NDEBUG"
|
||||
RSC_PROJ=/l 0x409 /fo"$(INTDIR)/REGMON.res" /d "NDEBUG"
|
||||
BSC32=bscmake.exe
|
||||
# ADD BASE BSC32 /nologo
|
||||
# ADD BSC32 /nologo
|
||||
BSC32_FLAGS=/nologo /o"$(OUTDIR)/Regmon.bsc"
|
||||
BSC32_SBRS=
|
||||
LINK32=link.exe
|
||||
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:windows /machine:I386
|
||||
# ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib comctl32.lib /nologo /subsystem:windows /machine:I386 /out:"Release/NTREGMON.exe"
|
||||
LINK32_FLAGS=kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib\
|
||||
advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib\
|
||||
odbccp32.lib comctl32.lib /nologo /subsystem:windows /incremental:no\
|
||||
/pdb:"$(OUTDIR)/NTREGMON.pdb" /machine:I386 /out:"$(OUTDIR)/NTREGMON.exe"
|
||||
LINK32_OBJS= \
|
||||
"$(INTDIR)/REGMON.OBJ" \
|
||||
"$(INTDIR)/INSTDRV.OBJ" \
|
||||
"$(INTDIR)/REGMON.res"
|
||||
|
||||
"$(OUTDIR)\NTREGMON.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
|
||||
$(LINK32) @<<
|
||||
$(LINK32_FLAGS) $(LINK32_OBJS)
|
||||
<<
|
||||
|
||||
!ELSEIF "$(CFG)" == "regmon - Win32 Debug"
|
||||
|
||||
# PROP BASE Use_MFC 0
|
||||
# PROP BASE Use_Debug_Libraries 1
|
||||
# PROP BASE Output_Dir "Debug"
|
||||
# PROP BASE Intermediate_Dir "Debug"
|
||||
# PROP BASE Target_Dir ""
|
||||
# PROP Use_MFC 0
|
||||
# PROP Use_Debug_Libraries 1
|
||||
# PROP Output_Dir "Debug"
|
||||
# PROP Intermediate_Dir "Debug"
|
||||
# PROP Target_Dir ""
|
||||
OUTDIR=.\Debug
|
||||
INTDIR=.\Debug
|
||||
|
||||
ALL : "$(OUTDIR)\NTREGMON.exe"
|
||||
|
||||
CLEAN :
|
||||
-@erase ".\Debug\vc40.pdb"
|
||||
-@erase ".\Debug\vc40.idb"
|
||||
-@erase ".\Debug\NTREGMON.exe"
|
||||
-@erase ".\Debug\INSTDRV.OBJ"
|
||||
-@erase ".\Debug\REGMON.OBJ"
|
||||
-@erase ".\Debug\REGMON.res"
|
||||
-@erase ".\Debug\NTREGMON.ilk"
|
||||
-@erase ".\Debug\NTREGMON.pdb"
|
||||
|
||||
"$(OUTDIR)" :
|
||||
if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
|
||||
|
||||
# ADD BASE CPP /nologo /W3 /Gm /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /YX /c
|
||||
# ADD CPP /nologo /W3 /Gm /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /c
|
||||
# SUBTRACT CPP /YX
|
||||
CPP_PROJ=/nologo /MLd /W3 /Gm /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS"\
|
||||
/Fo"$(INTDIR)/" /Fd"$(INTDIR)/" /c
|
||||
CPP_OBJS=.\Debug/
|
||||
CPP_SBRS=
|
||||
# ADD BASE MTL /nologo /D "_DEBUG" /win32
|
||||
# ADD MTL /nologo /D "_DEBUG" /win32
|
||||
MTL_PROJ=/nologo /D "_DEBUG" /win32
|
||||
# ADD BASE RSC /l 0x409 /d "_DEBUG"
|
||||
# ADD RSC /l 0x409 /d "_DEBUG"
|
||||
RSC_PROJ=/l 0x409 /fo"$(INTDIR)/REGMON.res" /d "_DEBUG"
|
||||
BSC32=bscmake.exe
|
||||
# ADD BASE BSC32 /nologo
|
||||
# ADD BSC32 /nologo
|
||||
BSC32_FLAGS=/nologo /o"$(OUTDIR)/Regmon.bsc"
|
||||
BSC32_SBRS=
|
||||
LINK32=link.exe
|
||||
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:windows /debug /machine:I386
|
||||
# ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib comctl32.lib /nologo /subsystem:windows /debug /machine:I386 /out:"Debug/NTREGMON.exe"
|
||||
LINK32_FLAGS=kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib\
|
||||
advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib\
|
||||
odbccp32.lib comctl32.lib /nologo /subsystem:windows /incremental:yes\
|
||||
/pdb:"$(OUTDIR)/NTREGMON.pdb" /debug /machine:I386\
|
||||
/out:"$(OUTDIR)/NTREGMON.exe"
|
||||
LINK32_OBJS= \
|
||||
"$(INTDIR)/INSTDRV.OBJ" \
|
||||
"$(INTDIR)/REGMON.OBJ" \
|
||||
"$(INTDIR)/REGMON.res"
|
||||
|
||||
"$(OUTDIR)\NTREGMON.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
|
||||
$(LINK32) @<<
|
||||
$(LINK32_FLAGS) $(LINK32_OBJS)
|
||||
<<
|
||||
|
||||
!ENDIF
|
||||
|
||||
.c{$(CPP_OBJS)}.obj:
|
||||
$(CPP) $(CPP_PROJ) $<
|
||||
|
||||
.cpp{$(CPP_OBJS)}.obj:
|
||||
$(CPP) $(CPP_PROJ) $<
|
||||
|
||||
.cxx{$(CPP_OBJS)}.obj:
|
||||
$(CPP) $(CPP_PROJ) $<
|
||||
|
||||
.c{$(CPP_SBRS)}.sbr:
|
||||
$(CPP) $(CPP_PROJ) $<
|
||||
|
||||
.cpp{$(CPP_SBRS)}.sbr:
|
||||
$(CPP) $(CPP_PROJ) $<
|
||||
|
||||
.cxx{$(CPP_SBRS)}.sbr:
|
||||
$(CPP) $(CPP_PROJ) $<
|
||||
|
||||
################################################################################
|
||||
# Begin Target
|
||||
|
||||
# Name "regmon - Win32 Release"
|
||||
# Name "regmon - Win32 Debug"
|
||||
|
||||
!IF "$(CFG)" == "regmon - Win32 Release"
|
||||
|
||||
!ELSEIF "$(CFG)" == "regmon - Win32 Debug"
|
||||
|
||||
!ENDIF
|
||||
|
||||
################################################################################
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\RESOURCE.H
|
||||
|
||||
!IF "$(CFG)" == "regmon - Win32 Release"
|
||||
|
||||
!ELSEIF "$(CFG)" == "regmon - Win32 Debug"
|
||||
|
||||
!ENDIF
|
||||
|
||||
# End Source File
|
||||
################################################################################
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.C
|
||||
DEP_CPP_REGMO=\
|
||||
".\ioctlcmd.h"\
|
||||
".\REGMON.H"\
|
||||
|
||||
|
||||
"$(INTDIR)\REGMON.OBJ" : $(SOURCE) $(DEP_CPP_REGMO) "$(INTDIR)"
|
||||
|
||||
|
||||
# End Source File
|
||||
################################################################################
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.H
|
||||
|
||||
!IF "$(CFG)" == "regmon - Win32 Release"
|
||||
|
||||
!ELSEIF "$(CFG)" == "regmon - Win32 Debug"
|
||||
|
||||
!ENDIF
|
||||
|
||||
# End Source File
|
||||
################################################################################
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\REGMON.RC
|
||||
DEP_RSC_REGMON=\
|
||||
".\logo.bmp"\
|
||||
".\toolbar1.bmp"\
|
||||
|
||||
|
||||
"$(INTDIR)\REGMON.res" : $(SOURCE) $(DEP_RSC_REGMON) "$(INTDIR)"
|
||||
$(RSC) $(RSC_PROJ) $(SOURCE)
|
||||
|
||||
|
||||
# End Source File
|
||||
################################################################################
|
||||
# Begin Source File
|
||||
|
||||
SOURCE=.\INSTDRV.C
|
||||
DEP_CPP_INSTD=\
|
||||
".\REGMON.H"\
|
||||
|
||||
|
||||
"$(INTDIR)\INSTDRV.OBJ" : $(SOURCE) $(DEP_CPP_INSTD) "$(INTDIR)"
|
||||
|
||||
|
||||
# End Source File
|
||||
# End Target
|
||||
# End Project
|
||||
################################################################################
|
||||
Binary file not shown.
+313
@@ -0,0 +1,313 @@
|
||||
//Microsoft Developer Studio generated resource script.
|
||||
//
|
||||
#include "resource.h"
|
||||
|
||||
#define APSTUDIO_READONLY_SYMBOLS
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Generated from the TEXTINCLUDE 2 resource.
|
||||
//
|
||||
#define APSTUDIO_HIDDEN_SYMBOLS
|
||||
#include "windows.h"
|
||||
#undef APSTUDIO_HIDDEN_SYMBOLS
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
#undef APSTUDIO_READONLY_SYMBOLS
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
// English (U.S.) resources
|
||||
|
||||
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
|
||||
#ifdef _WIN32
|
||||
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
|
||||
#pragma code_page(1252)
|
||||
#endif //_WIN32
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Menu
|
||||
//
|
||||
|
||||
LISTMENU MENU DISCARDABLE
|
||||
BEGIN
|
||||
POPUP "&File"
|
||||
BEGIN
|
||||
MENUITEM "&Save\tCtrl+S", IDM_SAVE
|
||||
MENUITEM "Save &As...", IDM_SAVEAS
|
||||
MENUITEM SEPARATOR
|
||||
MENUITEM "E&xit", IDM_EXIT
|
||||
END
|
||||
POPUP "&Options"
|
||||
BEGIN
|
||||
MENUITEM "&Filter...\tCtrl+F", IDM_FILTER
|
||||
MENUITEM SEPARATOR
|
||||
MENUITEM "&Capture Events\tCtrl+E", IDM_CAPTURE, CHECKED
|
||||
MENUITEM "&Auto Scroll\tCtrl+A", IDM_AUTOSCROLL, CHECKED
|
||||
MENUITEM "Always &On Top", IDM_ONTOP
|
||||
MENUITEM SEPARATOR
|
||||
MENUITEM "Regedit &Jump\tCtrl+J", IDM_JUMP
|
||||
MENUITEM SEPARATOR
|
||||
MENUITEM "C&lear Display\tCtrl+C", IDM_CLEAR
|
||||
END
|
||||
POPUP "&Search"
|
||||
BEGIN
|
||||
MENUITEM "&Find...\tF3", IDM_FIND
|
||||
END
|
||||
POPUP "&Help"
|
||||
BEGIN
|
||||
MENUITEM "&Help...", IDM_HELP
|
||||
MENUITEM "&About", IDM_ABOUT
|
||||
END
|
||||
END
|
||||
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Dialog
|
||||
//
|
||||
|
||||
FILTER DIALOG DISCARDABLE 160, 78, 238, 130
|
||||
STYLE DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU
|
||||
CAPTION "Regmon Filter"
|
||||
FONT 8, "MS Sans Serif"
|
||||
BEGIN
|
||||
EDITTEXT IDC_PROCFILTER,74,8,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_PROCEXCLUDE,74,25,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_PATHFILTER,74,42,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_EXCLUDEFILTER,74,59,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_HISTORY,74,76,30,14,ES_AUTOHSCROLL
|
||||
CONTROL "Log Reads",IDC_LOGREADS,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,7,96,57,10
|
||||
CONTROL "Log Writes",IDC_LOGWRITES,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,7,112,57,10
|
||||
CONTROL "Log Success",IDC_SUCCESS,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,92,96,57,10
|
||||
CONTROL "Log Errors",IDC_ERROR,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,92,112,45,10
|
||||
DEFPUSHBUTTON "&Apply",IDOK,182,8,50,14
|
||||
PUSHBUTTON "&Reset",IDRESET,182,26,50,14
|
||||
PUSHBUTTON "&Cancel",IDCANCEL,182,45,50,14
|
||||
LTEXT "Process Include(s):",IDC_STATIC,7,10,61,8
|
||||
LTEXT "Path Include(s):",IDC_STATIC,7,44,50,8
|
||||
LTEXT "Path Exclude(s):",IDC_STATIC,7,61,52,8
|
||||
LTEXT "History Depth:",IDC_STATIC,7,78,45,8
|
||||
LTEXT "Process Exclude(s):",IDC_STATIC,7,27,63,8
|
||||
END
|
||||
|
||||
ABOUTBOX DIALOG DISCARDABLE 22, 17, 221, 69
|
||||
STYLE DS_MODALFRAME | WS_CAPTION | WS_SYSMENU
|
||||
CAPTION "About Regmon"
|
||||
FONT 8, "MS Sans Serif"
|
||||
BEGIN
|
||||
ICON "ICON",IDC_STATIC,11,9,20,20
|
||||
LTEXT "Regmon for Windows NT/9x v4.13\n\nCopyright © 1998\nMark Russinovich\nBryce Cogswell\nhttp://www.sysinternals.com",
|
||||
IDC_STATIC,41,11,113,51
|
||||
PUSHBUTTON "&OK",IDOK,159,43,50,14
|
||||
END
|
||||
|
||||
INITFILTER DIALOG DISCARDABLE 160, 78, 238, 146
|
||||
STYLE DS_MODALFRAME | DS_SETFOREGROUND | DS_CENTER | WS_POPUP | WS_CAPTION |
|
||||
WS_SYSMENU
|
||||
CAPTION "Regmon Filter"
|
||||
FONT 8, "MS Sans Serif"
|
||||
BEGIN
|
||||
EDITTEXT IDC_PROCFILTER,74,27,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_PROCEXCLUDE,74,44,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_PATHFILTER,74,61,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_EXCLUDEFILTER,74,78,97,14,ES_AUTOHSCROLL
|
||||
EDITTEXT IDC_HISTORY,74,95,30,14,ES_AUTOHSCROLL
|
||||
CONTROL "Log Reads",IDC_LOGREADS,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,7,114,57,10
|
||||
CONTROL "Log Writes",IDC_LOGWRITES,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,7,128,57,10
|
||||
CONTROL "Log Success",IDC_SUCCESS,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,92,114,57,10
|
||||
CONTROL "Log Errors",IDC_ERROR,"Button",BS_AUTOCHECKBOX |
|
||||
WS_TABSTOP,92,128,45,10
|
||||
DEFPUSHBUTTON "&OK",IDOK,182,27,50,14
|
||||
PUSHBUTTON "&Reset",IDRESET,182,46,50,14
|
||||
LTEXT "Process Include(s):",IDC_STATIC,7,29,61,8
|
||||
LTEXT "Path Include(s):",IDC_STATIC,7,63,50,8
|
||||
LTEXT "Path Exclude(s):",IDC_STATIC,7,80,52,8
|
||||
LTEXT "History Depth:",IDC_STATIC,7,97,45,8
|
||||
LTEXT "Process Exclude(s):",IDC_STATIC,7,46,63,8
|
||||
LTEXT "These filters were in effect that last time you exited Regmon.\nThe configuration you enter will be active when monitoring starts.",
|
||||
IDC_STATIC,5,4,220,18
|
||||
END
|
||||
|
||||
|
||||
#ifdef APSTUDIO_INVOKED
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// TEXTINCLUDE
|
||||
//
|
||||
|
||||
1 TEXTINCLUDE DISCARDABLE
|
||||
BEGIN
|
||||
"resource.h\0"
|
||||
END
|
||||
|
||||
2 TEXTINCLUDE DISCARDABLE
|
||||
BEGIN
|
||||
"#define APSTUDIO_HIDDEN_SYMBOLS\r\n"
|
||||
"#include ""windows.h""\r\n"
|
||||
"#undef APSTUDIO_HIDDEN_SYMBOLS\r\n"
|
||||
"\0"
|
||||
END
|
||||
|
||||
3 TEXTINCLUDE DISCARDABLE
|
||||
BEGIN
|
||||
"\r\n"
|
||||
"\0"
|
||||
END
|
||||
|
||||
#endif // APSTUDIO_INVOKED
|
||||
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// DESIGNINFO
|
||||
//
|
||||
|
||||
#ifdef APSTUDIO_INVOKED
|
||||
GUIDELINES DESIGNINFO DISCARDABLE
|
||||
BEGIN
|
||||
"FILTER", DIALOG
|
||||
BEGIN
|
||||
LEFTMARGIN, 7
|
||||
RIGHTMARGIN, 231
|
||||
TOPMARGIN, 7
|
||||
BOTTOMMARGIN, 123
|
||||
END
|
||||
|
||||
"ABOUTBOX", DIALOG
|
||||
BEGIN
|
||||
RIGHTMARGIN, 209
|
||||
BOTTOMMARGIN, 64
|
||||
END
|
||||
|
||||
"INITFILTER", DIALOG
|
||||
BEGIN
|
||||
LEFTMARGIN, 7
|
||||
RIGHTMARGIN, 231
|
||||
TOPMARGIN, 7
|
||||
BOTTOMMARGIN, 139
|
||||
END
|
||||
END
|
||||
#endif // APSTUDIO_INVOKED
|
||||
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Accelerator
|
||||
//
|
||||
|
||||
ACCELERATORS ACCELERATORS DISCARDABLE
|
||||
BEGIN
|
||||
"A", IDM_AUTOSCROLL, VIRTKEY, CONTROL, NOINVERT
|
||||
"C", IDM_CLEAR, VIRTKEY, CONTROL, NOINVERT
|
||||
"E", IDM_CAPTURE, VIRTKEY, CONTROL, NOINVERT
|
||||
"F", IDM_FILTER, VIRTKEY, CONTROL, NOINVERT
|
||||
"J", IDM_JUMP, VIRTKEY, CONTROL, NOINVERT
|
||||
"S", IDM_SAVE, VIRTKEY, CONTROL, NOINVERT
|
||||
VK_F3, IDM_FIND, VIRTKEY, NOINVERT
|
||||
END
|
||||
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Bitmap
|
||||
//
|
||||
|
||||
IDB_TOOLBAR BITMAP DISCARDABLE "toolbar1.bmp"
|
||||
|
||||
#ifndef _MAC
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Version
|
||||
//
|
||||
|
||||
VS_VERSION_INFO VERSIONINFO
|
||||
FILEVERSION 4,13,0,0
|
||||
PRODUCTVERSION 4,13,0,0
|
||||
FILEFLAGSMASK 0x3fL
|
||||
#ifdef _DEBUG
|
||||
FILEFLAGS 0x1L
|
||||
#else
|
||||
FILEFLAGS 0x0L
|
||||
#endif
|
||||
FILEOS 0x40004L
|
||||
FILETYPE 0x1L
|
||||
FILESUBTYPE 0x0L
|
||||
BEGIN
|
||||
BLOCK "StringFileInfo"
|
||||
BEGIN
|
||||
BLOCK "040904b0"
|
||||
BEGIN
|
||||
VALUE "Comments", "\0"
|
||||
VALUE "CompanyName", "Systems Internals\0"
|
||||
VALUE "FileDescription", "Regmon\0"
|
||||
VALUE "FileVersion", "4.13\0"
|
||||
VALUE "InternalName", "Regmon\0"
|
||||
VALUE "LegalCopyright", "Copyright © 1996-1999\0"
|
||||
VALUE "LegalTrademarks", "\0"
|
||||
VALUE "OriginalFilename", "Regmon.exe\0"
|
||||
VALUE "PrivateBuild", "\0"
|
||||
VALUE "ProductName", "Systems Internals Regmon\0"
|
||||
VALUE "ProductVersion", "4.13\0"
|
||||
VALUE "SpecialBuild", "\0"
|
||||
END
|
||||
END
|
||||
BLOCK "VarFileInfo"
|
||||
BEGIN
|
||||
VALUE "Translation", 0x409, 1200
|
||||
END
|
||||
END
|
||||
|
||||
#endif // !_MAC
|
||||
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Icon
|
||||
//
|
||||
|
||||
// Icon with lowest ID value placed first to ensure application icon
|
||||
// remains consistent on all systems.
|
||||
ICON ICON PRELOAD DISCARDABLE "icon.ico"
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// String Table
|
||||
//
|
||||
|
||||
STRINGTABLE DISCARDABLE
|
||||
BEGIN
|
||||
IDM_CAPTURE "Capture (Ctrl+E)"
|
||||
IDM_AUTOSCROLL "Autoscroll (Ctrl+A)"
|
||||
IDM_CLEAR "Clear (Ctrl+C)"
|
||||
IDM_FILTER "Filter (Ctrl+F)"
|
||||
IDM_FIND "Find (F3)"
|
||||
IDM_JUMP "Regedit Jump (Ctrl+J)"
|
||||
END
|
||||
|
||||
STRINGTABLE DISCARDABLE
|
||||
BEGIN
|
||||
IDM_SAVE "Save (Ctrl+S)"
|
||||
END
|
||||
|
||||
#endif // English (U.S.) resources
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
|
||||
|
||||
#ifndef APSTUDIO_INVOKED
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// Generated from the TEXTINCLUDE 3 resource.
|
||||
//
|
||||
|
||||
|
||||
/////////////////////////////////////////////////////////////////////////////
|
||||
#endif // not APSTUDIO_INVOKED
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
{\rtf1\ansi\ansicpg1252\uc1 \deff0\deflang1033\deflangfe1033{\fonttbl{\f0\froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}
|
||||
{\f16\fswiss\fcharset0\fprq2{\*\panose 00000000000000000000}Univers{\*\falt Arial};}{\f37\froman\fcharset238\fprq2 Times New Roman CE;}{\f38\froman\fcharset204\fprq2 Times New Roman Cyr;}{\f40\froman\fcharset161\fprq2 Times New Roman Greek;}
|
||||
{\f41\froman\fcharset162\fprq2 Times New Roman Tur;}{\f42\froman\fcharset186\fprq2 Times New Roman Baltic;}{\f43\fswiss\fcharset238\fprq2 Arial CE;}{\f44\fswiss\fcharset204\fprq2 Arial Cyr;}{\f46\fswiss\fcharset161\fprq2 Arial Greek;}
|
||||
{\f47\fswiss\fcharset162\fprq2 Arial Tur;}{\f48\fswiss\fcharset186\fprq2 Arial Baltic;}}{\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;
|
||||
\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\stylesheet{\widctlpar\adjustright \fs20
|
||||
\snext0 Normal;}{\s1\keepn\widctlpar\outlinelevel0\adjustright \b\f1\fs20\cf2 \sbasedon0 \snext0 heading 1;}{\*\cs10 \additive Default Paragraph Font;}{\s15\li2\ri2\sb80\nowidctlpar\adjustright \f16\fs20 \sbasedon0 \snext15 footnote text;}{\*\cs16
|
||||
\additive \super \sbasedon10 footnote reference;}{\*\cs17 \additive \ul\cf2 \sbasedon10 Hyperlink;}{\*\cs18 \additive \i \sbasedon10 Emphasis;}}{\info{\title NTFilemon}{\author Preferred Customer}{\operator Mark Russinovich}
|
||||
{\creatim\yr1998\mo12\dy4\hr9\min46}{\revtim\yr1998\mo12\dy4\hr9\min46}{\version2}{\edmins0}{\nofpages2}{\nofwords416}{\nofchars2373}{\*\company Micron Electronics, Inc.}{\nofcharsws0}{\vern89}}
|
||||
\widowctrl\ftnbj\aenddoc\hyphcaps0\formshade\viewkind4\viewscale100 \fet0\sectd \linex0\endnhere\sectdefaultcl {\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl2\pnucltr\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl3
|
||||
\pndec\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang{\pntxta )}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}
|
||||
{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}\pard\plain \widctlpar\adjustright \fs20
|
||||
{\cs16\super ${\footnote \pard\plain \s15\li2\ri2\sb80\widctlpar\adjustright \f16\fs20 {\cs16\super $}{ Regmon Help}}#{\footnote \pard\plain \s15\li2\ri2\sb80\widctlpar\adjustright \f16\fs20 {\cs16\super #}{ INTRO}}}{
|
||||
\par }{\b\i\f1\fs36\cf2 Regmon for Windows NT/9x}{\f1
|
||||
\par }{\b\f1 Copyright \'a9 1996-1998 Mark Russinovich and Bryce Cogswell
|
||||
\par http://www.sysinternals.com}{\f1
|
||||
\par
|
||||
\par }{\b\f1\cf2 Introduction}{\f1
|
||||
\par
|
||||
\par }{\i\f1 Regmon}{\f1
|
||||
is a GUI/device driver combination that together monitor and display all Registry activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way NT works, seeing how applications use the Registr
|
||||
y, or tracking down problems in system or application configurations.
|
||||
\par
|
||||
\par }{\i\f1 Regmon}{\f1 works on NT 3.51, NT 4.0, Windows 2000 (NT 5.0), Windows 95 and Windows 98.
|
||||
\par
|
||||
\par }{\b\f1\cf2 Starting Regmon}{\f1
|
||||
\par
|
||||
\par Simply run the }{\i\f1 Regmon}{\f1 GUI (Regmon.exe) from the same directory that the driver (regsys.sys) resides in. }{\i\f1 Windows NT Note: Regmon must be located on a non-network drive and you must have administrative privilege to run it}{\f1
|
||||
. Menus, hot-keys, or toolbar buttons can be used to clear the window, save the monitored data to a file, and to filter and search output.
|
||||
\par
|
||||
\par As events are printed to the output, they are tagged with a sequence number. If }{\i\f1 Regmon\rquote s }{\f1 internal buffers are overflowed during extremely heavy activity, this will be reflected with gaps in the sequence number.
|
||||
\par
|
||||
\par Each time you exit }{\i\f1 Regmon}{\f1 it remembers the position of the window and the widths of the output columns.
|
||||
\par
|
||||
\par }\pard\plain \s1\keepn\widctlpar\outlinelevel0\adjustright \b\f1\fs20\cf2 {Monitoring Boot-Time Registry Access (Windows NT/2K only)
|
||||
\par }\pard\plain \widctlpar\adjustright \fs20 {\f1
|
||||
\par }{\f1\cf1 To use }{\cs18\i\f1\cf1 Regmon's}{\f1\cf1 boot logging feature simply select the "Log Boot" menu entry. }{\cs18\i\f1\cf1 Regmon}{\f1\cf1 will indicate that starting
|
||||
the next time the system boots Registry activity will be monitored and recorded to a log file named REGMON.LOG in your system root directory. When you make this selection }{\cs18\i\f1\cf1 Regmon}{\f1\cf1
|
||||
configures itself as the very first driver to initialize in the system, enabli
|
||||
ng it to capture the Registry startup activity of all other device drivers and services, including critical boot drivers such as SCSI miniport drivers and boot file system drivers.}{
|
||||
\par
|
||||
\par }{\cs18\i\f1\cf1 Regmon}{\f1\cf1 stops recording to the log file when you start the }{\cs18\i\f1\cf1 Regmon}{\f1\cf1 GUI, and
|
||||
it will only log a single boot. Logging is therefore also stopped when the system shuts down, unless you have re-enabled boot-time logging for the subsequent boot. The format of the log file is the same tab-delineated text as a standard }{\cs18\i\f1\cf1
|
||||
Regmon}{\f1\cf1 output file that can be viewed with any editor.
|
||||
\par }{
|
||||
\par }{\f1\cf1 Before you use the boot-logging feature you should ensure that there is ample free space on your system drive. Capturing Registry activity from startup to shutdown on an NT 4.0 system will generate a log file with 90,
|
||||
000-120,000 records (7-10 MB in size), whereas an identically configured NT 5.0 system (Beta 2) will generate 140,000-160,000 records (15-25 MB's of log data). If }{\cs18\i\f1\cf1 Regmon}{\f1\cf1
|
||||
fills the disk while writing to the log it will truncate the log file and leave a message in it indicating that the disk did not have enough free space. }{\cs18\i\f1\cf1 Regmon}{\f1\cf1
|
||||
aborts logging and cleans up the log in such cases so that lack of disk space will not prevent a successful boot.}{
|
||||
\par }{\f1
|
||||
\par }{\b\f1\cf2 Filtering Output}{\f1
|
||||
\par
|
||||
\par Use the Filter dialog to select what data will be shown in the list view. The \lquote *\rquote
|
||||
wildcard matches arbitrary strings, filters are case-insensitive. Only matches shown in the path include filter, but that are not excluded with the path exclude filter, are displayed. Use \lquote ;\rquote
|
||||
to separate multiple filter component strings (e.g. \ldblquote *CurrentControl*;*Software*\rdblquote ). The process filter also accepts the wildcard character, and multiple process strings separated with \lquote ;\rquote .
|
||||
\par
|
||||
\par For example, if the path include filter is \ldblquote HKLM\\*\rdblquote , and the path exclude filter is \ldblquote HKLM\\System*\rdblquote , all references to keys and values under HLM\\, except to those under HKLM\\System would be monitored.
|
||||
\par }{\b\f1\cf2
|
||||
\par Limiting Output}{\f1
|
||||
\par
|
||||
\par The History Depth entry in the Filter dialog allows you to specify the maximum number of lines that will be remembered in the output window. A depth of 0 is used to signify no limit.
|
||||
\par
|
||||
\par }{\b\f1\cf2 Searching the Output}{\f1
|
||||
\par
|
||||
\par You can search the output window for strings using the Find menu item (or the find toolbar button). Once you have opened a Find dialog
|
||||
and hit the FindNext button, you can repeat the search without changing the focus back to the Find dialog by hitting the F3 key.
|
||||
\par
|
||||
\par To start a search at a particular line in the output, select the desired line by clicking it. If no line is selected a new search starts at the first entry in searching down, and at the last entry for searching up.
|
||||
\par
|
||||
\par }{\b\f1\cf2 Jumping to a Key or Value in }{\b\i\f1\cf2 Regedit}{\f1
|
||||
\par }{\f1
|
||||
\par If you come across a key or value name in the output that you want to modify or view in }{\i\f1 Regedit}{\f1 , you can do so simply by double-clicking on the line containing the name or pressing the }{\i\f1 Regedit}{\f1 toolbar button. }{\i\f1 Regmon}{
|
||||
\f1 will launch }{\i\f1 Regedit}{\f1 (if it hasn\rquote t been launched already) and navigate directly to the value or key. Note that if you select a non-existent value or key }{\i\f1 Regmon}{\f1 will take }{\i\f1 Regedit}{\f1 to a position }{\f1
|
||||
as close as possible }{\f1 to where the value or key would be located.
|
||||
\par
|
||||
\par }\pard\plain \s1\keepn\widctlpar\outlinelevel0\adjustright \b\f1\fs20\cf2 {Viewing Partially Obscured Fields
|
||||
\par }\pard\plain \widctlpar\adjustright \fs20 {\f1
|
||||
\par Fields within a row in }{\i\f1 Regmon\rquote s}{\f1 output may be partially hidden if the field\rquote s column is not wide enough to fully display the field\rquote s text. If you have a newer version of the Microsoft\rquote
|
||||
s common control dialog DLL then hovering the mouse over an obscured field will cause a tool-tip with the contents of the field to be displayed. If this does not occur, try right-clicking on the field.
|
||||
With old versions of the common control DLLs the only way to reveal an obscured field is to make its column wider.
|
||||
\par
|
||||
\par }{\b\f1\cf2 Reporting Bugs and Feedback}{\f1
|
||||
\par
|
||||
\par If you encounter a problem while running }{\i\f1 Regmon}{\f1 , please visit http://www.sysinternals.com to obtain the latest
|
||||
version. If you still have problems, please record all the information in the top few lines of a Blue Screen (if you encounter one), as well as the section of addresses and driver names just above the administrative message. Determine if the problem is re
|
||||
producible, and if so, how, and send this information to:
|
||||
\par
|
||||
\par \tab mark@sysinternals.com and
|
||||
\par \tab cogswell@winternals.com
|
||||
\par
|
||||
\par }}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,45 @@
|
||||
//{{NO_DEPENDENCIES}}
|
||||
// Microsoft Developer Studio generated include file.
|
||||
// Used by REGMON.RC
|
||||
//
|
||||
#define IDRESET 3
|
||||
#define IDM_EXIT 104
|
||||
#define IDM_SAMPLE 105
|
||||
#define IDM_ABOUT 300
|
||||
#define IDB_TOOLBAR 400
|
||||
#define ID_LIST 1000
|
||||
#define IDC_PROCFILTER 1000
|
||||
#define IDC_PATHFILTER 1001
|
||||
#define IDC_EXCLUDEFILTER 1002
|
||||
#define IDC_HISTORY 1003
|
||||
#define IDC_PROCEXCLUDE 1004
|
||||
#define IDC_SUCCESS 1006
|
||||
#define IDC_ERROR 1007
|
||||
#define IDC_LOGREADS 1008
|
||||
#define IDC_LOGWRITES 1009
|
||||
#define IDC_DRIVE 1050
|
||||
#define IDM_SAVE 40007
|
||||
#define IDM_SAVEAS 40012
|
||||
#define IDM_ZEROSTATS 40016
|
||||
#define IDM_HELP 40017
|
||||
#define IDM_CAPTURE 40018
|
||||
#define IDM_AUTOSCROLL 40019
|
||||
#define IDM_CLEAR 40020
|
||||
#define IDM_FILTER 40022
|
||||
#define IDM_FIND 40024
|
||||
#define IDM_BOOTLOG 40026
|
||||
#define IDM_ONTOP 40027
|
||||
#define IDM_JUMP 40028
|
||||
#define IDC_STATIC -1
|
||||
|
||||
// Next default values for new objects
|
||||
//
|
||||
#ifdef APSTUDIO_INVOKED
|
||||
#ifndef APSTUDIO_READONLY_SYMBOLS
|
||||
#define _APS_NO_MFC 1
|
||||
#define _APS_NEXT_RESOURCE_VALUE 123
|
||||
#define _APS_NEXT_COMMAND_VALUE 40029
|
||||
#define _APS_NEXT_CONTROL_VALUE 1011
|
||||
#define _APS_NEXT_SYMED_VALUE 106
|
||||
#endif
|
||||
#endif
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 958 B |
Binary file not shown.
|
After Width: | Height: | Size: 1.3 KiB |
+49
@@ -0,0 +1,49 @@
|
||||
|
||||
Regmon for Windows NT/9x
|
||||
Copyright (C) 1996-1998 Mark Russinovich and Bryce Cogswell
|
||||
http://www.sysinternals.com
|
||||
|
||||
Using Regmon
|
||||
------------
|
||||
|
||||
Start Regmon.exe from its home directory. Complete usage
|
||||
instructions are available in the on-line help file.
|
||||
|
||||
Building Regmon
|
||||
----------------
|
||||
|
||||
Regmon consists of a device driver and a GUI. The NT driver was built with
|
||||
the Windows NT DDK Build environment and the GUI was compiled with
|
||||
Microsoft Visual C++ 6.0. The VxD was built using Vireo Software's
|
||||
(now NuMega Labs) VtoolsD 2.0.
|
||||
|
||||
The help was entered with Microsoft Word 97 and Help Workshop
|
||||
for Word 97.
|
||||
|
||||
To install, copy Regmon.exe, Regvxd.vxd and regsys.sys to the same
|
||||
directory.
|
||||
|
||||
Terms of Use
|
||||
------------
|
||||
|
||||
This software is provided "as is", without any guarantee made
|
||||
as to its suitability or fitness for any particular use. It may
|
||||
contain bugs, so use of this tool is at your own risk. We take
|
||||
no responsilbity for any damage that may unintentionally be caused
|
||||
through its use.
|
||||
|
||||
You may not use Regmon source code in a product, either free or
|
||||
commercial, without the express written permission of Mark
|
||||
Russinovich or Bryce Cogswell
|
||||
|
||||
You may not distribute Regmon in any form without express written
|
||||
permission of Mark Russinovich or Bryce Cogswell.
|
||||
|
||||
Reporting Problems
|
||||
------------------
|
||||
|
||||
If you encounter problems, please visit http://www.sysinternals.com
|
||||
and download the latest version to see if the issue has been resolved.
|
||||
If not, please send a bug report to:
|
||||
|
||||
mark@sysinternals.com and cogswell@winternals.com
|
||||
@@ -0,0 +1,18 @@
|
||||
# REGMON.mak - makefile for VxD REGMON
|
||||
|
||||
PATH=c:\vtd31\bin;$(PATH)
|
||||
DEVICENAME = REGVXD
|
||||
DYNAMIC = 1
|
||||
FRAMEWORK = C
|
||||
DEBUG = 0
|
||||
OBJECTS = regmon.OBJ
|
||||
|
||||
all: $(DEVICENAME).vxd
|
||||
copy *.vxd ..\gui\.
|
||||
copy *.vxd ..\gui\release\.
|
||||
copy *.vxd ..\gui\debug\.
|
||||
|
||||
!include $(VTOOLSD)\include\vtoolsd.mak
|
||||
!include $(VTOOLSD)\include\vxdtarg.mak
|
||||
|
||||
regmon.OBJ: regmon.c regmon.h
|
||||
+1728
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,27 @@
|
||||
VXD REGMON DYNAMIC
|
||||
SEGMENTS
|
||||
_LTEXT CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_LDATA CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_TEXT CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_DATA CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_LPTEXT CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_CONST CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_BSS CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_TLS CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_ITEXT CLASS 'ICODE' DISCARDABLE
|
||||
_IDATA CLASS 'ICODE' DISCARDABLE
|
||||
_PTEXT CLASS 'PCODE' NONDISCARDABLE
|
||||
_PDATA CLASS 'PCODE' NONDISCARDABLE
|
||||
_STEXT CLASS 'SCODE' RESIDENT
|
||||
_SDATA CLASS 'SCODE' RESIDENT
|
||||
_MSGTABLE CLASS 'MCODE' PRELOAD NONDISCARDABLE IOPL
|
||||
_MSGDATA CLASS 'MCODE' PRELOAD NONDISCARDABLE IOPL
|
||||
_IMSGTABLE CLASS 'MCODE' PRELOAD DISCARDABLE IOPL
|
||||
_IMSGDATA CLASS 'MCODE' PRELOAD DISCARDABLE IOPL
|
||||
_DBOSTART CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
|
||||
_DBOCODE CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
|
||||
_DBODATA CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
|
||||
_16ICODE CLASS '16ICODE' PRELOAD DISCARDABLE
|
||||
_RCODE CLASS 'RCODE'
|
||||
EXPORTS
|
||||
_The_DDB @1
|
||||
@@ -0,0 +1,79 @@
|
||||
//======================================================================
|
||||
//
|
||||
// REGMON.h - include file for VxD REGMON
|
||||
//
|
||||
// Copyright (C) 1996 Mark Russinovich and Bryce Cogswell
|
||||
//
|
||||
//======================================================================
|
||||
#include <vtoolsc.h>
|
||||
|
||||
//----------------------------------------------------------------------
|
||||
// D E F I N E S
|
||||
//----------------------------------------------------------------------
|
||||
#define REGMON_Major 1
|
||||
#define REGMON_Minor 0
|
||||
#define REGMON_DeviceID UNDEFINED_DEVICE_ID
|
||||
#define REGMON_Init_Order UNDEFINED_INIT_ORDER
|
||||
|
||||
//
|
||||
// Number of hash buckets
|
||||
//
|
||||
#define NUMHASH 0x100
|
||||
#define HASHOBJECT(_hkey) (((ULONG)_hkey)>>2)%NUMHASH
|
||||
|
||||
//
|
||||
// Size of storage buffer in pages
|
||||
//
|
||||
#define STORESIZE (MAX_STORE/0x1000+1)
|
||||
|
||||
//
|
||||
// Maximum path length
|
||||
//
|
||||
#define MAXPATHLEN 1024
|
||||
|
||||
//
|
||||
// Sizes of various buffers
|
||||
//
|
||||
#define STRINGLEN 240
|
||||
#define DATASIZE 512
|
||||
#define NAMELEN 256
|
||||
#define PROCESSLEN 16
|
||||
#define BINARYLEN 8
|
||||
|
||||
//
|
||||
// Maximum seperate filter components
|
||||
//
|
||||
#define MAXFILTERS 64
|
||||
|
||||
//
|
||||
// Entries in VMM Win32 service table
|
||||
//
|
||||
#define VMMWIN32QUERYINFOKEY (0x1E * 2 )
|
||||
|
||||
//----------------------------------------------------------------------
|
||||
// S T R U C T U R E S
|
||||
//----------------------------------------------------------------------
|
||||
|
||||
//
|
||||
// Structure for our name hash table
|
||||
//
|
||||
typedef struct _nameentry {
|
||||
|
||||
HKEY hkey;
|
||||
PCHAR FullName;
|
||||
struct _nameentry *Next;
|
||||
} HASH_ENTRY, *PHASH_ENTRY;
|
||||
|
||||
//
|
||||
// Structure for keeping linked lists of output buffers
|
||||
//
|
||||
typedef struct _store {
|
||||
ULONG Len;
|
||||
struct _store *Next;
|
||||
char Data[ MAX_STORE ];
|
||||
} STORE_BUF, *PSTORE_BUF;
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
CompanyName = "Company Name"
|
||||
FileDescription = "VxD File Description"
|
||||
FileVersion = "Version 1.00"
|
||||
InternalName = "DEVNAME"
|
||||
LegalCopyright = "Copyright \251 1995, Company Name. "
|
||||
OriginalFilename = "device.vxd"
|
||||
ProductName = "Product Name"
|
||||
ProductVersion = "Version 1.00"
|
||||
Translation = 0x409, 0x4E4
|
||||
@@ -0,0 +1,27 @@
|
||||
VXD REGVXD DYNAMIC
|
||||
SEGMENTS
|
||||
_LTEXT CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_LDATA CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_TEXT CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_DATA CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_LPTEXT CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_CONST CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_BSS CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_TLS CLASS 'LCODE' PRELOAD NONDISCARDABLE
|
||||
_ITEXT CLASS 'ICODE' DISCARDABLE
|
||||
_IDATA CLASS 'ICODE' DISCARDABLE
|
||||
_PTEXT CLASS 'PCODE' NONDISCARDABLE
|
||||
_PDATA CLASS 'PCODE' NONDISCARDABLE
|
||||
_STEXT CLASS 'SCODE' RESIDENT
|
||||
_SDATA CLASS 'SCODE' RESIDENT
|
||||
_MSGTABLE CLASS 'MCODE' PRELOAD NONDISCARDABLE IOPL
|
||||
_MSGDATA CLASS 'MCODE' PRELOAD NONDISCARDABLE IOPL
|
||||
_IMSGTABLE CLASS 'MCODE' PRELOAD DISCARDABLE IOPL
|
||||
_IMSGDATA CLASS 'MCODE' PRELOAD DISCARDABLE IOPL
|
||||
_DBOSTART CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
|
||||
_DBOCODE CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
|
||||
_DBODATA CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
|
||||
_16ICODE CLASS '16ICODE' PRELOAD DISCARDABLE
|
||||
_RCODE CLASS 'RCODE'
|
||||
EXPORTS
|
||||
_The_DDB @1
|
||||
Binary file not shown.
Binary file not shown.
+150
@@ -0,0 +1,150 @@
|
||||
REGVXD
|
||||
|
||||
Timestamp is 36c89b30 (Mon Feb 15 14:09:52 1999)
|
||||
|
||||
Preferred load address is 00400000
|
||||
|
||||
Start Length Name Class
|
||||
0001:00000000 000012c0H .bss CODE
|
||||
0001:000012c0 00000544H _LDATA CODE
|
||||
0001:00001804 00002798H _LTEXT CODE
|
||||
0002:00000000 00000004H ICRTTEXT CODE
|
||||
0002:00000004 00000004H ICRTXXXX CODE
|
||||
0002:00000008 0000003cH _IDATA CODE
|
||||
0002:00000044 00000018H _ITEXT CODE
|
||||
|
||||
Address Publics by Value Rva+Base Lib:Object
|
||||
|
||||
0001:00000400 _RealRegSetValue 00401400 <common>
|
||||
0001:00000404 _RealRegEnumKey 00401404 <common>
|
||||
0001:00000408 _RealRegSetValueEx 00401408 <common>
|
||||
0001:00000420 _PathExcludeFilters 00401420 <common>
|
||||
0001:00000520 _RealRegQueryValue 00401520 <common>
|
||||
0001:00000524 _RealRegDeleteKey 00401524 <common>
|
||||
0001:00000540 _ROKThunk 00401540 <common>
|
||||
0001:00000554 _RealRegCreateDynKey 00401554 <common>
|
||||
0001:00000560 _RCRKThunk 00401560 <common>
|
||||
0001:00000574 _FilterMutex 00401574 <common>
|
||||
0001:00000578 _RealRegCloseKey 00401578 <common>
|
||||
0001:0000057c _StoreMutex 0040157c <common>
|
||||
0001:00000580 _RQVEThunk 00401580 <common>
|
||||
0001:000005a0 _RCKThunk 004015a0 <common>
|
||||
0001:000005c0 _RFKThunk 004015c0 <common>
|
||||
0001:000005e0 _RSVEThunk 004015e0 <common>
|
||||
0001:000005f4 _RealRegRemapPreDefKey 004015f4 <common>
|
||||
0001:00000600 _ProcessExcludeFilters 00401600 <common>
|
||||
0001:00000700 _RealRegQueryMultipleValues 00401700 <common>
|
||||
0001:00000720 _ProcessFilters 00401720 <common>
|
||||
0001:00000820 _FilterDef 00401820 <common>
|
||||
0001:00000c40 _RDVThunk 00401c40 <common>
|
||||
0001:00000c60 _RSVThunk 00401c60 <common>
|
||||
0001:00000c74 _RealRegQueryInfoKey 00401c74 <common>
|
||||
0001:00000c80 _RDKThunk 00401c80 <common>
|
||||
0001:00000c94 _HashMutex 00401c94 <common>
|
||||
0001:00000c98 _RealRegEnumValue 00401c98 <common>
|
||||
0001:00000c9c _VMMWin32ServiceTable 00401c9c <common>
|
||||
0001:00000ca0 _RQVThunk 00401ca0 <common>
|
||||
0001:00000cc0 _RCDKThunk 00401cc0 <common>
|
||||
0001:00000cd4 _RealRegQueryValueEx 00401cd4 <common>
|
||||
0001:00000ce0 _RRPDKThunk 00401ce0 <common>
|
||||
0001:00000cf4 _RealWin32RegQueryInfoKey 00401cf4 <common>
|
||||
0001:00000cf8 _RealRegFlushKey 00401cf8 <common>
|
||||
0001:00000d00 _REVThunk 00401d00 <common>
|
||||
0001:00000d20 _errstring 00401d20 <common>
|
||||
0001:00000d40 _RealRegCreateKey 00401d40 <common>
|
||||
0001:00000d60 _RQMVThunk 00401d60 <common>
|
||||
0001:00000d74 _RealRegDeleteValue 00401d74 <common>
|
||||
0001:00000d80 _RQIKThunk 00401d80 <common>
|
||||
0001:00000d94 _RealRegOpenKey 00401d94 <common>
|
||||
0001:00000da0 _REKThunk 00401da0 <common>
|
||||
0001:00000dc0 _PathIncludeFilters 00401dc0 <common>
|
||||
0001:00000ec0 _HashTable 00401ec0 <common>
|
||||
0001:000012c0 _FilterOn 004022c0 regmon.OBJ
|
||||
0001:000012c4 _NumProcessFilters 004022c4 regmon.OBJ
|
||||
0001:000012c8 _NumProcessExcludeFilters 004022c8 regmon.OBJ
|
||||
0001:000012cc _NumPathIncludeFilters 004022cc regmon.OBJ
|
||||
0001:000012d0 _NumPathExcludeFilters 004022d0 regmon.OBJ
|
||||
0001:000012d4 _FreeEntries 004022d4 regmon.OBJ
|
||||
0001:000012d8 _Store 004022d8 regmon.OBJ
|
||||
0001:000012dc _Sequence 004022dc regmon.OBJ
|
||||
0001:000012e0 _NumStore 004022e0 regmon.OBJ
|
||||
0001:000012e4 _MaxStore 004022e4 regmon.OBJ
|
||||
0001:000012e8 _The_DDB 004022e8 regmon.OBJ
|
||||
0001:00001694 _VXD_SERVICE_TABLE 00402694 cfMS540:vsvctab.obj
|
||||
0001:00001694 _VXD_SERVICE_TABLE_SIZE 00402694 cfMS540:vsvctab.obj
|
||||
0001:00001704 _LOCK__CTAB 00402704 rtMS540:C002l.obj
|
||||
0001:00001804 _ControlDispatcher 00402804 f regmon.OBJ
|
||||
0001:00001835 _MatchOkay 00402835 f regmon.OBJ
|
||||
0001:0000184d _MatchWithPattern 0040284d f regmon.OBJ
|
||||
0001:000018e3 _RegmonFreeStore 004028e3 f regmon.OBJ
|
||||
0001:00001907 _RegmonNewStore 00402907 f regmon.OBJ
|
||||
0001:0000196c _RegmonOldestStore 0040296c f regmon.OBJ
|
||||
0001:00001990 _RegmonResetStore 00402990 f regmon.OBJ
|
||||
0001:000019be _UpdateStore 004029be f regmon.OBJ
|
||||
0001:00001a49 _RegmonHashCleanup 00402a49 f regmon.OBJ
|
||||
0001:00001aa5 _RegmonStoreHash 00402aa5 f regmon.OBJ
|
||||
0001:00001b40 _RegmonFreeHashEntry 00402b40 f regmon.OBJ
|
||||
0001:00001bbc _ErrorString 00402bbc f regmon.OBJ
|
||||
0001:00001c81 _RegmonFreeFilters 00402c81 f regmon.OBJ
|
||||
0001:00001d36 _MakeFilterArray 00402d36 f regmon.OBJ
|
||||
0001:00001da1 _RegmonUpdateFilters 00402da1 f regmon.OBJ
|
||||
0001:00001e12 _GetProcess 00402e12 f regmon.OBJ
|
||||
0001:00001efb _ApplyNameFilter 00402efb f regmon.OBJ
|
||||
0001:00001f7c _GetFullName 00402f7c f regmon.OBJ
|
||||
0001:00002150 _HookRegOpenKey 00403150 f regmon.OBJ
|
||||
0001:00002226 _HookRegCreateKey 00403226 f regmon.OBJ
|
||||
0001:000022fc _HookRegDeleteKey 004032fc f regmon.OBJ
|
||||
0001:00002390 _HookRegDeleteValue 00403390 f regmon.OBJ
|
||||
0001:00002424 _HookRegCloseKey 00403424 f regmon.OBJ
|
||||
0001:000024bd _HookRegFlushKey 004034bd f regmon.OBJ
|
||||
0001:0000254d _HookRegEnumKey 0040354d f regmon.OBJ
|
||||
0001:000025f4 _HookRegEnumValue 004035f4 f regmon.OBJ
|
||||
0001:00002839 _HookRegQueryInfoKey 00403839 f regmon.OBJ
|
||||
0001:00002940 _HookRegQueryValue 00403940 f regmon.OBJ
|
||||
0001:00002a55 _HookRegQueryValueEx 00403a55 f regmon.OBJ
|
||||
0001:00002c3d _HookRegSetValue 00403c3d f regmon.OBJ
|
||||
0001:00002d4c _HookRegSetValueEx 00403d4c f regmon.OBJ
|
||||
0001:00002f08 _HookRegRemapPreDefKey 00403f08 f regmon.OBJ
|
||||
0001:00002fa7 _HookRegQueryMultipleValues 00403fa7 f regmon.OBJ
|
||||
0001:00003043 _HookRegCreateDynKey 00404043 f regmon.OBJ
|
||||
0001:000030fd _HookWin32RegQueryInfoKey@32 004040fd f regmon.OBJ
|
||||
0001:00003200 _OnSysDynamicDeviceInit 00404200 f regmon.OBJ
|
||||
0001:0000341a _OnSysDynamicDeviceExit 0040441a f regmon.OBJ
|
||||
0001:0000352e _OnW32Deviceiocontrol 0040452e f regmon.OBJ
|
||||
0001:000036ab _LocalPMhandler 004046ab f cfMS540:control.obj
|
||||
0001:000036b5 _LocalV86handler 004046b5 f cfMS540:control.obj
|
||||
0001:000036bf _LocalControlDispatcher 004046bf f cfMS540:control.obj
|
||||
0001:000036f4 _PM_Api_Handler 004046f4 f cfMS540:pmapi.obj
|
||||
0001:000036f8 _V86_Api_Handler 004046f8 f cfMS540:v86api.obj
|
||||
0001:000036f9 _LOCK_vsprintf 004046f9 f rtMS540:C048l.obj
|
||||
0001:00003711 _LOCK_sprintf 00404711 f rtMS540:C041l.obj
|
||||
0001:0000372a _LOCK_strncpy 0040472a f rtMS540:C028l.obj
|
||||
0001:00003751 _LOCK_strncat 00404751 f rtMS540:C030l.obj
|
||||
0001:00003780 _LOCK__vsnprintf 00404780 f rtMS540:C047l.obj
|
||||
0001:00003cba _LOCK_free 00404cba f rtMS540:C001l.obj
|
||||
0001:00003ccb _LOCK__ltoa 00404ccb f rtMS540:C012l.obj
|
||||
0001:00003d5b _LOCK__strupr 00404d5b f rtMS540:C025l.obj
|
||||
0001:00003d81 _LOCK__ultoa 00404d81 f rtMS540:C010l.obj
|
||||
0001:00003df7 _LOCK_malloc 00404df7 f rtMS540:C043l.obj
|
||||
0001:00003e08 _LOCK__PageFree 00404e08 f wr0MS940:VW058l.obj
|
||||
0001:00003e10 _LOCK__PageAllocate@40 00404e10 f wr0MS940:VW061l.obj
|
||||
0001:00003e50 _LOCK_Signal_Semaphore@4 00404e50 f wr0MS940:VW022l.obj
|
||||
0001:00003e60 _LOCK_Wait_Semaphore@8 00404e60 f wr0MS940:VW003l.obj
|
||||
0001:00003e74 _LOCK__HeapFree 00404e74 f wr0MS940:VW110l.obj
|
||||
0001:00003e7c _LOCK__HeapAllocate 00404e7c f wr0MS940:VW111l.obj
|
||||
0001:00003e84 _LOCK__SelectorMapFlat 00404e84 f wr0MS940:VW040l.obj
|
||||
0001:00003e8c _LOCK_Get_Sys_VM_Handle@0 00404e8c f wr0MS940:VW121l.obj
|
||||
0001:00003e9c _LOCK_Get_DDB@8 00404e9c f wr0MS940:VW242l.obj
|
||||
0001:00003eb4 _LOCK_Create_Semaphore@4 00404eb4 f wr0MS940:VW186l.obj
|
||||
0001:00003ec8 _LOCK_VWIN32_GetCurrentProcessHandle 00404ec8 f wr3MS940:VW812l.obj
|
||||
0001:00003ed0 _LOCK_Hook_Device_Service_C@12 00404ed0 f wr3MS940:VW904l.obj
|
||||
0001:00003f14 _LOCK_Unhook_Device_Service_C@8 00404f14 f wr3MS940:VW905l.obj
|
||||
0001:00003f34 _LOCK_UniToBCS 00404f34 f wr3MS940:VW733l.obj
|
||||
0001:00003f5c __InitThunk 00404f5c f wr3MS940:VW970.obj
|
||||
0001:00003f84 _DeviceServiceC_thunkTEMPLATE 00404f84 wr3MS940:VW989.obj
|
||||
0002:00000044 INITCRT 00405044 ICRTMS9.OBJ
|
||||
|
||||
entry point at 0000:00000000
|
||||
|
||||
Static symbols
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
CompanyName = "Mark Russinovich and Bryce Cogswell"
|
||||
FileDescription = "Registry Monitor VxD"
|
||||
FileVersion = "Version 4.11"
|
||||
InternalName = "REGMON"
|
||||
LegalCopyright = "Copyright \251 1996-1999, Mark Russinovich and Bryce Cogswell"
|
||||
OriginalFilename = "regvxd.vxd"
|
||||
ProductName = "Regmon"
|
||||
ProductVersion = "Version 4.11"
|
||||
Translation = 0x409, 0x4E4
|
||||
Binary file not shown.
Reference in New Issue
Block a user