[ Lập trình 
Demo - FileS
Aug
12
Category :
Bước 1: Bạn tạo 1 project mới trong vb. Sau đó vào menu Project -> Refference. Tìm: Microsoft WMI Scripting Vx.x Library (trong đó Vx.x là phiên bản của thư viện WMI).
Bước 2: Dán đoạn code sau vào form
Lưu ý:
- Chương trình theo dõi sự thay đổi ở nhánh registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Bạn có thể sửa lại theo ý.
- Chương trình sẽ thông báo bằng cách in ra màn hình watch của IDE, bạn có thể sửa lại theo ý mình.
=================================================
1. Theo dõi Entry events:
2. Theo dõi Subkey events:
3. Theo dõi subtree events:
(ddth.com)
Bước 2: Dán đoạn code sau vào form
Lưu ý:
- Chương trình theo dõi sự thay đổi ở nhánh registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Bạn có thể sửa lại theo ý.
- Chương trình sẽ thông báo bằng cách in ra màn hình watch của IDE, bạn có thể sửa lại theo ý mình.
Code:
Option Explicit
Dim wmiServices As Object
Dim WithEvents wmiSink As WbemScripting.SWbemSink
'--
'--
Private Sub Form_Load()
Set wmiServices = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\.\root\default")
Set wmiSink = CreateObject("WbemScripting.SWbemSink", "")
wmiServices.ExecNotificationQueryAsync wmiSink, _
"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' " & _
"AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'"
Debug.Print "Listening for Registry Change Events..." & vbCrLf
End Sub
Private Sub wmiSink_OnCompleted(ByVal iHResult As WbemScripting.WbemErrorEnum, ByVal objWbemErrorObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
Debug.Print "Sink completed!"
End Sub
Private Sub wmiSink_OnObjectPut(ByVal objWbemObjectPath As WbemScripting.ISWbemObjectPath, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
Debug.Print "Object put!"
End Sub
Private Sub wmiSink_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
Debug.Print "Change event!" & objWbemObject.GetObjectText_()
End Sub
Private Sub wmiSink_OnProgress(ByVal iUpperBound As Long, ByVal iCurrent As Long, ByVal strMessage As String, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
Debug.Print "Progress: " & iCurrent & "/"; iUpperBound & ": " & strMessage
End Sub
1. Theo dõi Entry events:
Code:
Set wmiServices = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
wmiServices.ExecNotificationQueryAsync wmiSink, _
"SELECT * FROM RegistryValueChangeEvent WHERE " & _
"Hive='HKEY_LOCAL_MACHINE' AND " & _
"KeyPath='SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'" _
& " AND ValueName='CSDVersion'"
WScript.Echo "Listening for Registry Change Events..." & vbCrLf
While(1)
WScript.Sleep 1000
Wend
Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)
WScript.Echo "Received Registry Change Event" & vbCrLf & _
wmiObject.GetObjectText_()
End Sub Code:
' Monitor Registry Subkey Events
' Windows Server 2003 : Yes
' Windows XP : Yes
' Windows 2000 : Yes
' Windows NT 4.0 : Yes
' Windows 98 : Yes
Set wmiServices = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\default")
Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
wmiServices.ExecNotificationQueryAsync wmiSink, _
"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' " & _
"AND KeyPath='SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'"
WScript.Echo "Listening for Registry Change Events..." & vbCrLf
While(1)
WScript.Sleep 1000
Wend
Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)
WScript.Echo "Received Registry Change Event" & vbCrLf & _
wmiObject.GetObjectText_()
End Sub
Code:
' Monitor Registry Subtree Events
' Windows Server 2003 : Yes
' Windows XP : Yes
' Windows 2000 : Yes
' Windows NT 4.0 : Yes
' Windows 98 : Yes
Set wmiServices = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\default")
Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
wmiServices.ExecNotificationQueryAsync wmiSink, _
"SELECT * FROM RegistryTreeChangeEvent WHERE Hive= " _
& "'HKEY_LOCAL_MACHINE' AND RootPath=''"
WScript.Echo "Listening for Registry Change Events..." & vbCrLf
While(1)
WScript.Sleep 1000
Wend
Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)
WScript.Echo "Received Registry Change Event" & vbCrLf & _
wmiObject.GetObjectText_()
End Sub
:
C#:
[code]Listener regKeyListner;
regKeyListner = new Listener(Registry.LocalMachine,
@"system\currentcontrolset\services\modem\enum");
regKeyListner.RegChange += new
RegistryWatcher.Listener.RegistryChange(regKeyListner_RegChange);
regKeyListner.RegErr += new
RegistryWatcher.Listener.RegistryError(regKeyListner_RegErr);
regKeyListner.start();
Class:
using System;
using System.Runtime.InteropServices;
using Microsoft.Win32;
using System.Threading;
using System.Reflection;
namespace RegistryWatcher
{
///
/// Summary description for Listener.
///
public class Listener
{
const int ERROR_KEY_DELETED = 1018;
[Flags] public enum NotifyFilterFlags
{
REG_NOTIFY_CHANGE_NAME = 1,
REG_NOTIFY_CHANGE_ATTRIBUTES = 2,
REG_NOTIFY_CHANGE_LAST_SET = 4,
REG_NOTIFY_CHANGE_SECURITY = 8
};
[DllImport("advapi32.dll", EntryPoint="RegNotifyChangeKeyValue")]
static extern long RegNotifyChangeKeyValue(IntPtr key, bool watchSubTree,
int notifyFilter, IntPtr regEvent, bool async);
private IntPtr keyHandle;
private RegistryKey KeyToMonitor;
public delegate void RegistryChange(string regValue);
public delegate void RegistryError(Exception ex);
public event RegistryChange RegChange;
public event RegistryError RegErr;
public Listener(RegistryKey key, string subKey)
{
KeyToMonitor = key.OpenSubKey(subKey, false);
}
public void start()
{
Type regKeyType = KeyToMonitor.GetType();
FieldInfo field = regKeyType.GetField("hkey", BindingFlags.Instance |
BindingFlags.NonPublic);
keyHandle = (IntPtr)field.GetValue(KeyToMonitor);
WaitHandle NotifyEvent = new AutoResetEvent(false);
long RetVal = RegNotifyChangeKeyValue(keyHandle, true,
(int)NotifyFilterFlags.REG_NOTIFY_CHANGE_LAST_SET, NotifyEvent.Handle,
true);
System.Threading.ThreadPool.RegisterWaitForSingleObject(NotifyEvent, new
WaitOrTimerCallback(ValueChange), KeyToMonitor, -1, false);
}
public void stop()
{
if (!(KeyToMonitor == null))
KeyToMonitor.Close();
}
public void ValueChange(object state, bool timedOut)
{
try
{
int count = (int)KeyToMonitor.GetValue("Count");
if (count > 0)
RegChange(state.ToString());
else
start();
}
catch (Exception ex)
{
RegErr(ex);
}
}
}
}[/code]
[code]Listener regKeyListner;
regKeyListner = new Listener(Registry.LocalMachine,
@"system\currentcontrolset\services\modem\enum");
regKeyListner.RegChange += new
RegistryWatcher.Listener.RegistryChange(regKeyListner_RegChange);
regKeyListner.RegErr += new
RegistryWatcher.Listener.RegistryError(regKeyListner_RegErr);
regKeyListner.start();
Class:
using System;
using System.Runtime.InteropServices;
using Microsoft.Win32;
using System.Threading;
using System.Reflection;
namespace RegistryWatcher
{
///
/// Summary description for Listener.
///
public class Listener
{
const int ERROR_KEY_DELETED = 1018;
[Flags] public enum NotifyFilterFlags
{
REG_NOTIFY_CHANGE_NAME = 1,
REG_NOTIFY_CHANGE_ATTRIBUTES = 2,
REG_NOTIFY_CHANGE_LAST_SET = 4,
REG_NOTIFY_CHANGE_SECURITY = 8
};
[DllImport("advapi32.dll", EntryPoint="RegNotifyChangeKeyValue")]
static extern long RegNotifyChangeKeyValue(IntPtr key, bool watchSubTree,
int notifyFilter, IntPtr regEvent, bool async);
private IntPtr keyHandle;
private RegistryKey KeyToMonitor;
public delegate void RegistryChange(string regValue);
public delegate void RegistryError(Exception ex);
public event RegistryChange RegChange;
public event RegistryError RegErr;
public Listener(RegistryKey key, string subKey)
{
KeyToMonitor = key.OpenSubKey(subKey, false);
}
public void start()
{
Type regKeyType = KeyToMonitor.GetType();
FieldInfo field = regKeyType.GetField("hkey", BindingFlags.Instance |
BindingFlags.NonPublic);
keyHandle = (IntPtr)field.GetValue(KeyToMonitor);
WaitHandle NotifyEvent = new AutoResetEvent(false);
long RetVal = RegNotifyChangeKeyValue(keyHandle, true,
(int)NotifyFilterFlags.REG_NOTIFY_CHANGE_LAST_SET, NotifyEvent.Handle,
true);
System.Threading.ThreadPool.RegisterWaitForSingleObject(NotifyEvent, new
WaitOrTimerCallback(ValueChange), KeyToMonitor, -1, false);
}
public void stop()
{
if (!(KeyToMonitor == null))
KeyToMonitor.Close();
}
public void ValueChange(object state, bool timedOut)
{
try
{
int count = (int)KeyToMonitor.GetValue("Count");
if (count > 0)
RegChange(state.ToString());
else
start();
}
catch (Exception ex)
{
RegErr(ex);
}
}
}
}[/code]
Xem thêm
http://objectmix.com/dotnet/108737-wmi-howto-monitor-registry-additions-only-registy-changes-only.html
http://objectmix.com/dotnet/108737-wmi-howto-monitor-registry-additions-only-registy-changes-only.html
Phân trang 1/1 
1 
1
