So was:
RegMon? Ganz unten auf der Seite kannst du dir den Source runterladen.
| Zitat: |
The heart of Regmon on Windows 9x is in the virtual device driver, Regvxd.vxd. It is dynamically loaded, and in its initialization it uses VxD service hooking (see our May 1996 Dr. Dobb's Journal article on VxD service hooking for more information) to insert itself onto the call chain of 16 registry access functions in the Windows 95 kernel (Virtual Machine Manager). All registry activity, be it from 16-bit programs, Win32 applications, or device drivers, are directed at these routines, so Regmon catches all registry activity taking place on a machine.
On Windows NT, 2000 and XP the Regmon loads a device driver that uses a technique we pioneered for NT called system-call hooking. When a user-mode component makes a privileged system call, control is transfered to a software interrupt handler in NTOSKRNL.EXE (the core of the Windows NT operating system). This handler takes a system call number, which is passed in a machine register, and indexes into a system service table to find the address of the NT function that will handle the request. By replacing entries in this table with pointers to hooking functions, it is possible to intercept and replace, augment, or monitor NT system services. Regmon, which obviously hooks just the Registry-related services, is merely one example of this capability in action.
|
Auch wenn es die Registry laufend überwacht, ähnlich müßte es gehen. Du schmeißt bei einer Installation das Programm an, die Zugriffe vom Explorer ignoriest du und läßt den den Rest schön mit protokollieren.
Luckie wünscht viel Spaß beim Studieren des Source, Programmieren und Rebooten.
