|
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using RegistryMonitor;
namespace RegistryMonitorSampleApplication
{
public partial class MainForm : Form
{
#region Fields
bool started = false;
RegistryKeyChange keychange;
RegistryTreeChange treechange;
RegistryValueChange valuechange;
#endregion Fields
#region Constructors
public MainForm()
{
InitializeComponent();
}
#endregion Constructors
#region Private Methods
private void MainForm_Load(object sender, EventArgs e)
{
cmbHive.SelectedIndex = 0;
}
private void btnStart_Click(object sender, EventArgs e)
{
if (started)
{
if (chkKeyChange.Checked)
{
keychange.Stop();
}
if (chkTreeChange.Checked)
{
treechange.Stop();
}
if (chkValueChange.Checked)
{
valuechange.Stop();
}
btnStart.Text = "Start monitoring";
grpOptions.Enabled = true;
}
else
{
if (!chkKeyChange.Checked && !chkTreeChange.Checked && !chkValueChange.Checked)
{
MessageBox.Show("Select at least one of the events to monitor", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
return;
}
if (string.IsNullOrEmpty(txbKeyPath.Text))
{
MessageBox.Show("KeyPath not specified", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
return;
}
if (chkValueChange.Checked && string.IsNullOrEmpty(txbValueName.Text))
{
MessageBox.Show("ValueName not specified", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
return;
}
if (chkKeyChange.Checked)
{
keychange = new RegistryKeyChange(cmbHive.SelectedItem.ToString(), new List<string>(txbKeyPath.Lines));
keychange.RegistryKeyChanged += new EventHandler<RegistryKeyChangedEventArgs>(keychange_RegistryKeyChanged);
keychange.Start();
}
if (chkTreeChange.Checked)
{
treechange = new RegistryTreeChange(cmbHive.SelectedItem.ToString(), new List<string>(txbKeyPath.Lines));
treechange.RegistryTreeChanged += new EventHandler<RegistryTreeChangedEventArgs>(treechange_RegistryTreeChanged);
treechange.Start();
}
if (chkValueChange.Checked)
{
valuechange = new RegistryValueChange(cmbHive.SelectedItem.ToString(), txbKeyPath.Lines[0], new List<string>(txbValueName.Lines));
valuechange.RegistryValueChanged += new EventHandler<RegistryValueChangedEventArgs>(valuechange_RegistryValueChanged);
valuechange.Start();
}
btnStart.Text = "Stop monitoring";
grpOptions.Enabled = false;
}
started = !started;
}
void valuechange_RegistryValueChanged(object sender, RegistryValueChangedEventArgs e)
{
lsbDisplay.Invoke((MethodInvoker)(() =>
{
lsbDisplay.Items.Add(string.Format("RegistryValueChangeEvent detected at {0} Event data: Hive: {1} KeyPath: {2} ValueName: {3}",
DateTime.FromFileTime((long)e.RegistryValueChangeData.TIME_CREATED).ToString(),
e.RegistryValueChangeData.Hive,
e.RegistryValueChangeData.KeyPath,
e.RegistryValueChangeData.ValueName));
}));
}
void treechange_RegistryTreeChanged(object sender, RegistryTreeChangedEventArgs e)
{
lsbDisplay.Invoke((MethodInvoker)(() =>
{
lsbDisplay.Items.Add(string.Format("RegistryTreeChangeEvent detected at {0} Event data: Hive: {1} RootPath: {2}",
DateTime.FromFileTime((long)e.RegistryTreeChangeData.TIME_CREATED).ToString(),
e.RegistryTreeChangeData.Hive,
e.RegistryTreeChangeData.RootPath));
}));
}
void keychange_RegistryKeyChanged(object sender, RegistryKeyChangedEventArgs e)
{
lsbDisplay.Invoke((MethodInvoker)(() =>
{
lsbDisplay.Items.Add(string.Format("RegistryKeyChangeEvent detected at {0} Event data: Hive: {1} KeyPath: {2}",
DateTime.FromFileTime((long)e.RegistryKeyChangeData.TIME_CREATED).ToString(),
e.RegistryKeyChangeData.Hive,
e.RegistryKeyChangeData.KeyPath));
}));
}
#endregion Private Methods
}
}
|
By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.
If a file you wish to view isn't highlighted, and is a text file (not binary), please
let us know and we'll add colourisation support for it.
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.