Asynchronous Registry Notification Using Strongly-typed WMI Classes in .NET

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;

using RegistryMonitor;

namespace RegistryMonitorSampleApplication
{
	public partial class MainForm : Form
	{
		#region Fields

        bool started = false;
		RegistryKeyChange keychange;
		RegistryTreeChange treechange;
		RegistryValueChange valuechange;

		#endregion Fields

		#region Constructors

		public MainForm()
		{
			InitializeComponent();
		}

		#endregion Constructors

		#region Private Methods

		private void MainForm_Load(object sender, EventArgs e)
		{
			cmbHive.SelectedIndex = 0;
		}

		private void btnStart_Click(object sender, EventArgs e)
		{
            if (started)
            {
                if (chkKeyChange.Checked)
                {
                    keychange.Stop();
                }

                if (chkTreeChange.Checked)
                {
                    treechange.Stop();
                }

                if (chkValueChange.Checked)
                {
                    valuechange.Stop();
                }

                btnStart.Text = "Start monitoring";
                grpOptions.Enabled = true;
            }
            else
            {
                if (!chkKeyChange.Checked && !chkTreeChange.Checked && !chkValueChange.Checked)
                {
                    MessageBox.Show("Select at least one of the events to monitor", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
                    return;
                }

                if (string.IsNullOrEmpty(txbKeyPath.Text))
                {
                    MessageBox.Show("KeyPath not specified", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
                    return;
                }

                if (chkValueChange.Checked && string.IsNullOrEmpty(txbValueName.Text))
                {
                    MessageBox.Show("ValueName not specified", "Error", MessageBoxButtons.OKCancel, MessageBoxIcon.Error);
                    return;
                }
                if (chkKeyChange.Checked)
                {
                    keychange = new RegistryKeyChange(cmbHive.SelectedItem.ToString(), new List<string>(txbKeyPath.Lines));
                    keychange.RegistryKeyChanged += new EventHandler<RegistryKeyChangedEventArgs>(keychange_RegistryKeyChanged);
                    keychange.Start();
                }

                if (chkTreeChange.Checked)
                {
                    treechange = new RegistryTreeChange(cmbHive.SelectedItem.ToString(), new List<string>(txbKeyPath.Lines));
                    treechange.RegistryTreeChanged += new EventHandler<RegistryTreeChangedEventArgs>(treechange_RegistryTreeChanged);
                    treechange.Start();
                }

                if (chkValueChange.Checked)
                {
                    valuechange = new RegistryValueChange(cmbHive.SelectedItem.ToString(), txbKeyPath.Lines[0], new List<string>(txbValueName.Lines));
                    valuechange.RegistryValueChanged += new EventHandler<RegistryValueChangedEventArgs>(valuechange_RegistryValueChanged);
                    valuechange.Start();
                }
                
                btnStart.Text = "Stop monitoring";
                grpOptions.Enabled = false;
            }

			started = !started;
		}

        void valuechange_RegistryValueChanged(object sender, RegistryValueChangedEventArgs e)
        {
            lsbDisplay.Invoke((MethodInvoker)(() =>
            {
                lsbDisplay.Items.Add(string.Format("RegistryValueChangeEvent detected at {0} Event data: Hive: {1} KeyPath: {2} ValueName: {3}",
                    DateTime.FromFileTime((long)e.RegistryValueChangeData.TIME_CREATED).ToString(),
                    e.RegistryValueChangeData.Hive,
                    e.RegistryValueChangeData.KeyPath,
                    e.RegistryValueChangeData.ValueName));
            }));
        }

        void treechange_RegistryTreeChanged(object sender, RegistryTreeChangedEventArgs e)
        {
            lsbDisplay.Invoke((MethodInvoker)(() =>
            {
                lsbDisplay.Items.Add(string.Format("RegistryTreeChangeEvent detected at {0} Event data: Hive: {1} RootPath: {2}",
                    DateTime.FromFileTime((long)e.RegistryTreeChangeData.TIME_CREATED).ToString(),
                    e.RegistryTreeChangeData.Hive,
                    e.RegistryTreeChangeData.RootPath));
            }));
        }

        void keychange_RegistryKeyChanged(object sender, RegistryKeyChangedEventArgs e)
        {
            lsbDisplay.Invoke((MethodInvoker)(() =>
            {
                lsbDisplay.Items.Add(string.Format("RegistryKeyChangeEvent detected at {0} Event data: Hive: {1} KeyPath: {2}",
                    DateTime.FromFileTime((long)e.RegistryKeyChangeData.TIME_CREATED).ToString(),
                    e.RegistryKeyChangeData.Hive,
                    e.RegistryKeyChangeData.KeyPath));
            }));
        }

		#endregion Private Methods
	}
}