Click here to Skip to main content
12,356,784 members (64,217 online)
Click here to Skip to main content

Stats

73.8K views
3K downloads
66 bookmarked
Posted

Asynchronous Registry Notification Using Strongly-typed WMI Classes in .NET

, 14 Nov 2008 CPOL
How to receive asynchronous events about Registry changes, using WMI.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;

using RegistryMonitor;

namespace RegistryMonitorSampleApplication
{
	public partial class MainForm : Form
	{
		#region Fields

        bool started = false;
		RegistryKeyChange keychange;
		RegistryTreeChange treechange;
		RegistryValueChange valuechange;

		#endregion Fields

		#region Constructors

		public MainForm()
		{
			InitializeComponent();
		}

		#endregion Constructors

		#region Private Methods

		private void MainForm_Load(object sender, EventArgs e)
		{
			cmbHive.SelectedIndex = 0;
		}

		private void btnStart_Click(object sender, EventArgs e)
		{
            if (started)
            {
                if (chkKeyChange.Checked)
                {
                    keychange.Stop();
                }

                if (chkTreeChange.Checked)
                {
                    treechange.Stop();
                }

                if (chkValueChange.Checked)
                {
                    valuechange.Stop();
                }

                btnStart.Text = "Start monitoring";
                grpOptions.Enabled = true;
            }
            else
            {
                if (!chkKeyChange.Checked && !chkTreeChange.Checked && !chkValueChange.Checked)
                {
                    MessageBox.Show("Select at least one of the events to monitor", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
                    return;
                }

                if (string.IsNullOrEmpty(txbKeyPath.Text))
                {
                    MessageBox.Show("KeyPath not specified", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
                    return;
                }

                if (chkValueChange.Checked && string.IsNullOrEmpty(txbValueName.Text))
                {
                    MessageBox.Show("ValueName not specified", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
                    return;
                }
                if (chkKeyChange.Checked)
                {
                    keychange = new RegistryKeyChange(cmbHive.SelectedItem.ToString(), new List<string>(txbKeyPath.Lines));
                    keychange.RegistryKeyChanged += new EventHandler<RegistryKeyChangedEventArgs>(keychange_RegistryKeyChanged);
                    keychange.Start();
                }

                if (chkTreeChange.Checked)
                {
                    treechange = new RegistryTreeChange(cmbHive.SelectedItem.ToString(), new List<string>(txbKeyPath.Lines));
                    treechange.RegistryTreeChanged += new EventHandler<RegistryTreeChangedEventArgs>(treechange_RegistryTreeChanged);
                    treechange.Start();
                }

                if (chkValueChange.Checked)
                {
                    valuechange = new RegistryValueChange(cmbHive.SelectedItem.ToString(), txbKeyPath.Lines[0], new List<string>(txbValueName.Lines));
                    valuechange.RegistryValueChanged += new EventHandler<RegistryValueChangedEventArgs>(valuechange_RegistryValueChanged);
                    valuechange.Start();
                }
                
                btnStart.Text = "Stop monitoring";
                grpOptions.Enabled = false;
            }

			started = !started;
		}

        void valuechange_RegistryValueChanged(object sender, RegistryValueChangedEventArgs e)
        {
            lsbDisplay.Invoke((MethodInvoker)(() =>
            {
                lsbDisplay.Items.Add(string.Format("RegistryValueChangeEvent detected at {0} Event data: Hive: {1} KeyPath: {2} ValueName: {3}",
                    DateTime.FromFileTime((long)e.RegistryValueChangeData.TIME_CREATED).ToString(),
                    e.RegistryValueChangeData.Hive,
                    e.RegistryValueChangeData.KeyPath,
                    e.RegistryValueChangeData.ValueName));
            }));
        }

        void treechange_RegistryTreeChanged(object sender, RegistryTreeChangedEventArgs e)
        {
            lsbDisplay.Invoke((MethodInvoker)(() =>
            {
                lsbDisplay.Items.Add(string.Format("RegistryTreeChangeEvent detected at {0} Event data: Hive: {1} RootPath: {2}",
                    DateTime.FromFileTime((long)e.RegistryTreeChangeData.TIME_CREATED).ToString(),
                    e.RegistryTreeChangeData.Hive,
                    e.RegistryTreeChangeData.RootPath));
            }));
        }

        void keychange_RegistryKeyChanged(object sender, RegistryKeyChangedEventArgs e)
        {
            lsbDisplay.Invoke((MethodInvoker)(() =>
            {
                lsbDisplay.Items.Add(string.Format("RegistryKeyChangeEvent detected at {0} Event data: Hive: {1} KeyPath: {2}",
                    DateTime.FromFileTime((long)e.RegistryKeyChangeData.TIME_CREATED).ToString(),
                    e.RegistryKeyChangeData.Hive,
                    e.RegistryKeyChangeData.KeyPath));
            }));
        }

		#endregion Private Methods
	}
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Giorgi Dalakishvili
Software Developer
Georgia Georgia
No Biography provided

You may also be interested in...

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.160621.1 | Last Updated 14 Nov 2008
Article Copyright 2008 by Giorgi Dalakishvili
Everything else Copyright © CodeProject, 1999-2016
Layout: fixed | fluid