CmRegisterCallback注册一个自定义回调，当有消息时则触发MyLySharkCallback其内部获取到lOperateType操作类型，并通过switch选择不同的处理例程，每个处理例程都通过GetFullPath得到注册表完整路径，并打印出来，这段代码实现如下 。
// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <windef.h>// 未导出函数声明 pEProcess -> PIDPUCHAR PsGetProcessImageFileName(PEPROCESS pEProcess);NTSTATUS ObQueryNameString( _In_ PVOID Object, _Out_writes_bytes_opt_(Length) POBJECT_NAME_INFORMATION ObjectNameInfo, _In_ ULONG Length, _Out_ PULONG ReturnLength );// 注册表回调CookieLARGE_INTEGER g_liRegCookie;// 获取注册表完整路径BOOLEAN GetFullPath(PUNICODE_STRING pRegistryPath, PVOID pRegistryObject){ // 判断数据地址是否有效 if ((FALSE == MmIsAddressValid(pRegistryObject)) ||(NULL == pRegistryObject)) {return FALSE; } // 申请内存 ULONG ulSize = 512; PVOID lpObjectNameInfo = ExAllocatePool(NonPagedPool, ulSize); if (NULL == lpObjectNameInfo) {return FALSE; } // 获取注册表路径 ULONG ulRetLen = 0; NTSTATUS status = ObQueryNameString(pRegistryObject, (POBJECT_NAME_INFORMATION)lpObjectNameInfo, ulSize, &ulRetLen); if (!NT_SUCCESS(status)) {ExFreePool(lpObjectNameInfo);return FALSE; } // 复制 RtlCopyUnicodeString(pRegistryPath, (PUNICODE_STRING)lpObjectNameInfo); // 释放内存 ExFreePool(lpObjectNameInfo); return TRUE;}// 注册表回调函数NTSTATUS MyLySharkCallback(_In_ PVOID CallbackContext, _In_opt_ PVOID Argument1, _In_opt_ PVOID Argument2){ NTSTATUS status = STATUS_SUCCESS; UNICODE_STRING ustrRegPath; // 获取操作类型 LONG lOperateType = (REG_NOTIFY_CLASS)Argument1; // 申请内存 ustrRegPath.Length = 0; ustrRegPath.MaximumLength = 1024 * sizeof(WCHAR); ustrRegPath.Buffer = ExAllocatePool(NonPagedPool, ustrRegPath.MaximumLength); if (NULL == ustrRegPath.Buffer) {return status; } RtlZeroMemory(ustrRegPath.Buffer, ustrRegPath.MaximumLength); // 判断操作 switch (lOperateType) {// 创建注册表之前 case RegNtPreCreateKey: {// 获取注册表路径GetFullPath(&ustrRegPath, ((PREG_CREATE_KEY_INFORMATION)Argument2)->RootObject);DbgPrint("[创建注册表][%wZ][%wZ]\n", &ustrRegPath, ((PREG_CREATE_KEY_INFORMATION)Argument2)->CompleteName);break; } // 打开注册表之前 case RegNtPreOpenKey: {// 获取注册表路径GetFullPath(&ustrRegPath, ((PREG_CREATE_KEY_INFORMATION)Argument2)->RootObject);DbgPrint("[打开注册表][%wZ][%wZ]\n", &ustrRegPath, ((PREG_CREATE_KEY_INFORMATION)Argument2)->CompleteName);break; } // 删除键之前 case RegNtPreDeleteKey: {// 获取注册表路径GetFullPath(&ustrRegPath, ((PREG_DELETE_KEY_INFORMATION)Argument2)->Object);DbgPrint("[删除键][%wZ] \n", &ustrRegPath);break; } // 删除键值之前 case RegNtPreDeleteValueKey: {// 获取注册表路径GetFullPath(&ustrRegPath, ((PREG_DELETE_VALUE_KEY_INFORMATION)Argument2)->Object);DbgPrint("[删除键值][%wZ][%wZ] \n", &ustrRegPath, ((PREG_DELETE_VALUE_KEY_INFORMATION)Argument2)->ValueName);// 获取当前进程, 即操作注册表的进程PEPROCESS pEProcess = PsGetCurrentProcess();if (NULL != pEProcess){UCHAR *lpszProcessName = PsGetProcessImageFileName(pEProcess);if (NULL != lpszProcessName){DbgPrint("进程 [%s] 删除了键值对 \n", lpszProcessName);}}break; } // 修改键值之前 case RegNtPreSetValueKey: {// 获取注册表路径GetFullPath(&ustrRegPath, ((PREG_SET_VALUE_KEY_INFORMATION)Argument2)->Object);DbgPrint("[修改键值][%wZ][%wZ] \n", &ustrRegPath, ((PREG_SET_VALUE_KEY_INFORMATION)Argument2)->ValueName);break; } default:break; } // 释放内存 if (NULL != ustrRegPath.Buffer) {ExFreePool(ustrRegPath.Buffer);ustrRegPath.Buffer = NULL; } return status;}VOID UnDriver(PDRIVER_OBJECT driver){ DbgPrint(("Uninstall Driver Is OK \n")); // 注销当前注册表回调 if (0 < g_liRegCookie.QuadPart) {CmUnRegisterCallback(g_liRegCookie); }}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){ DbgPrint(("hello lyshark.com \n")); // 设置注册表回调 NTSTATUS status = CmRegisterCallback(MyLySharkCallback, NULL, &g_liRegCookie); if (!NT_SUCCESS(status)) {g_liRegCookie.QuadPart = 0;return status; } Driver->DriverUnload = UnDriver; return STATUS_SUCCESS;}