发一注册表监控驱动代码

该代码利用微软提供的注册表回调函数CmRegisterCallback,无需任何SSDT hook
不仅能够进行注册表监控，还可以拦截。
驱动完整代码如下：
#define NTDDI_WINXPSP2                      0x05010200
#define OSVERSION_MASK      0xFFFF0000
#define SPVERSION_MASK      0x0000FF00
#define SUBVERSION_MASK     0x000000FF

//
// macros to extract various version fields from the NTDDI version
//
#define OSVER(Version)  ((Version) & OSVERSION_MASK)
#define SPVER(Version)  (((Version) & SPVERSION_MASK) >> 8)
#define SUBVER(Version) (((Version) & SUBVERSION_MASK) )
//#define NTDDI_VERSION   NTDDI_WINXPSP2
#include <ntifs.h>
#include <wdm.h>
#include <ntstrsafe.h>
#define FILE_DEVICE_UNKNOWN 0x00000022
#define IOCTL_UNKNOWN_BASE FILE_DEVICE_UNKNOWN
#define IOCTL_CAPTURE_GET_REGEVENTS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER,FILE_READ_DATA | FILE_WRITE_DATA)
#define USERSPACE_CONNECTION_TIMEOUT 10
#define REGISTRY_POOL_TAG 'pRE'
typedef unsigned int UINT;
typedef char * PCHAR;
typedef PVOID POBJECT;
/* Registry event */
typedef struct  _REGISTRY_EVENT {
REG_NOTIFY_CLASS eventType;
TIME_FIELDS time;
HANDLE processId;
ULONG dataType;
ULONG dataLengthB;
ULONG registryPathLengthB;
/* Contains path and optionally data */
UCHAR registryData[];
} REGISTRY_EVENT, * PREGISTRY_EVENT;
/* Storage for registry event to be put into a linked list */
typedef struct  _REGISTRY_EVENT_PACKET {
    LIST_ENTRY     Link;
PREGISTRY_EVENT pRegistryEvent;
} REGISTRY_EVENT_PACKET, * PREGISTRY_EVENT_PACKET;
/* Context stuff */
typedef struct _CAPTURE_REGISTRY_MANAGER
{
    PDEVICE_OBJECT deviceObject;
BOOLEAN bReady;
LARGE_INTEGER  registryCallbackCookie;
LIST_ENTRY lQueuedRegistryEvents;
KTIMER connectionCheckerTimer;
KDPC connectionCheckerFunction;
KSPIN_LOCK lQueuedRegistryEventsSpinLock;
ULONG lastContactTime;
} CAPTURE_REGISTRY_MANAGER , *PCAPTURE_REGISTRY_MANAGER;
/* Methods */
NTSTATUS KDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS KDispatchCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS RegistryCallback(IN PVOID CallbackContext, IN PVOID  Argument1, IN PVOID  Argument2);
//BOOLEAN GetRegistryObjectCompleteName(PREGISTRY_EVENT pRegistryEvent, PUNICODE_STRING pPartialObjectName, PVOID pRegistryObject);
//VOID QueueRegistryEvent(PREGISTRY_EVENT pRegistryEvent);
VOID UpdateLastContactTime();
ULONG GetCurrentTime();
NTSTATUS HandleIoctlGetRegEvents(IN PDEVICE_OBJECT DeviceObject, PIRP Irp,
       PIO_STACK_LOCATION pIoStackIrp, UINT *pdwDataWritten);
VOID ConnectionChecker(
    IN struct _KDPC  *Dpc,
    IN PVOID  DeferredContext,
    IN PVOID  SystemArgument1,
    IN PVOID  SystemArgument2
    );
/* Global values */
PDEVICE_OBJECT gpDeviceObject;

/* Main entry point into the driver, is called when the driver is loaded */
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
    NTSTATUS status;
    UNICODE_STRING uszDriverString;
    UNICODE_STRING uszDeviceString;
LARGE_INTEGER registryEventsTimeout;
    PDEVICE_OBJECT pDeviceObject;
    PCAPTURE_REGISTRY_MANAGER pRegistryManager;
   
// Point uszDriverString at the driver name
    RtlInitUnicodeString(&uszDriverString, L"[url=file://\\Device\\RegistryMonitor]\\Device\\RegistryMonitor[/url]");
    // Create and initialize device object
status = IoCreateDevice(
  DriverObject,
        sizeof(CAPTURE_REGISTRY_MANAGER),
        &uszDriverString,
        FILE_DEVICE_UNKNOWN,
        0,
        FALSE,
        &pDeviceObject
  );
    if(!NT_SUCCESS(status))
{
  DbgPrint("RegistryMonitor: ERROR IoCreateDevice ->  [url=file://\\Device\\RegistryMonitor]\\Device\\RegistryMonitor[/url] - %08x\n", status);
        return status;
}
   
/* Set global device object to newly created object */
gpDeviceObject = pDeviceObject;
/* Get the registr manager from the extension of the device */
pRegistryManager = gpDeviceObject->DeviceExtension;
pRegistryManager->bReady = FALSE;
   
/* Point uszDeviceString at the device name */
    RtlInitUnicodeString(&uszDeviceString, L"[url=file://\\DosDevices\\RegistryMonitor]\\DosDevices\\RegistryMonitor[/url]");
/* Create symbolic link to the user-visible name */
    status = IoCreateSymbolicLink(&uszDeviceString, &uszDriverString);
    if(!NT_SUCCESS(status))
{
        DbgPrint("RegistryMonitor: ERROR IoCreateSymbolicLink ->  [url=file://\\DosDevices\\RegistryMonitor]\\DosDevices\\RegistryMonitor[/url] - %08x\n", status);
        IoDeleteDevice(pDeviceObject);
        return status;
    }
KeInitializeSpinLock(&pRegistryManager->lQueuedRegistryEventsSpinLock);
InitializeListHead(&pRegistryManager->lQueuedRegistryEvents);
    // Load structure to point to IRP handlers
    DriverObject->DriverUnload                         = UnloadDriver;
    DriverObject->MajorFunction[IRP_MJ_CREATE]         = KDispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_CLOSE]          = KDispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KDispatchIoctl;
status = CmRegisterCallback(RegistryCallback, pRegistryManager, &pRegistryManager->registryCallbackCookie);
if(!NT_SUCCESS(status))
{
  DbgPrint("RegistryMonitor: ERROR CmRegisterCallback - %08x\n", status);
  return status;
}
UpdateLastContactTime();
/* Create a DPC routine so that it can be called periodically */
KeInitializeDpc(&pRegistryManager->connectionCheckerFunction,
  (PKDEFERRED_ROUTINE) ConnectionChecker, pRegistryManager);
KeInitializeTimer(&pRegistryManager->connectionCheckerTimer);
registryEventsTimeout.QuadPart = 0;
/* Set the ConnectionChecker routine to be called every so often */
KeSetTimerEx(&pRegistryManager->connectionCheckerTimer,
  registryEventsTimeout,
  (USERSPACE_CONNECTION_TIMEOUT+(USERSPACE_CONNECTION_TIMEOUT/2))*1000,
  &pRegistryManager->connectionCheckerFunction);
pRegistryManager->bReady = TRUE;
DbgPrint("RegistryMonitor: Successfully Loaded\n");
    /* Return success */
    return STATUS_SUCCESS;
}
/* Checks to see if the registry monitor has received an IOCTL from a userspace
   program in a while. If it hasn't then all old queued registry events are
   cleared. This is called periodically when the driver is loaded */
VOID ConnectionChecker(
    IN struct _KDPC  *Dpc,
    IN PVOID  DeferredContext,
    IN PVOID  SystemArgument1,
    IN PVOID  SystemArgument2
    )
{
PCAPTURE_REGISTRY_MANAGER pRegistryManager = (PCAPTURE_REGISTRY_MANAGER)DeferredContext;
if( (GetCurrentTime()-pRegistryManager->lastContactTime) > (USERSPACE_CONNECTION_TIMEOUT+(USERSPACE_CONNECTION_TIMEOUT/2)))
{
  DbgPrint("RegistryMonitor: WARNING Userspace IOCTL timeout, clearing old queued registry events\n");
  while(!IsListEmpty(&pRegistryManager->lQueuedRegistryEvents))
  {
   PLIST_ENTRY head = ExInterlockedRemoveHeadList(&pRegistryManager->lQueuedRegistryEvents, &pRegistryManager->lQueuedRegistryEventsSpinLock);
   PREGISTRY_EVENT_PACKET pRegistryEventPacket = CONTAINING_RECORD(head, REGISTRY_EVENT_PACKET, Link);
   ExFreePoolWithTag(pRegistryEventPacket->pRegistryEvent, REGISTRY_POOL_TAG);
   ExFreePoolWithTag(pRegistryEventPacket, REGISTRY_POOL_TAG);
  }
}
}

NTSTATUS KDispatchCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information=0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}
NTSTATUS HandleIoctlGetRegEvents(IN PDEVICE_OBJECT DeviceObject, PIRP Irp,
       PIO_STACK_LOCATION pIoStackIrp, UINT *pdwDataWritten)
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PCHAR pOutputBuffer = Irp->UserBuffer;
    UINT dwOutputBufferSize = pIoStackIrp->Parameters.DeviceIoControl.OutputBufferLength;
PCAPTURE_REGISTRY_MANAGER pRegistryManager;
/* Get the registry manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
*pdwDataWritten = 0;
   
/* Check we are allowed to write into the buffer passed from the user space program */
    if(pOutputBuffer)
    {
        try {
   ProbeForWrite(pOutputBuffer,
    pIoStackIrp->Parameters.DeviceIoControl.OutputBufferLength,
    __alignof (REGISTRY_EVENT));
   if(pIoStackIrp->Parameters.DeviceIoControl.OutputBufferLength >= sizeof(REGISTRY_EVENT))
   {
    PLIST_ENTRY pRegistryListHead;
    PREGISTRY_EVENT_PACKET pRegistryPacket;
    UINT bufferSpace = dwOutputBufferSize;
    UINT bufferSpaceUsed = 0;
   
    /* Fill the buffer passed from userspace with registry events */
    while(!IsListEmpty(&pRegistryManager->lQueuedRegistryEvents) &&
     (bufferSpaceUsed < bufferSpace) &&
     ((bufferSpace-bufferSpaceUsed) >= sizeof(REGISTRY_EVENT)))
    {
     UINT registryEventSize = 0;
     pRegistryListHead = ExInterlockedRemoveHeadList(&pRegistryManager->lQueuedRegistryEvents, &pRegistryManager->lQueuedRegistryEventsSpinLock);
     pRegistryPacket = CONTAINING_RECORD(pRegistryListHead, REGISTRY_EVENT_PACKET, Link);
     
     registryEventSize = sizeof(REGISTRY_EVENT)+pRegistryPacket->pRegistryEvent->registryPathLengthB+pRegistryPacket->pRegistryEvent->dataLengthB;
     if((bufferSpace-bufferSpaceUsed) >= registryEventSize)
     {
      //DbgPrint("Sending-%i: %ls\n",bufferSpaceUsed, pRegistryPacket->pRegistryEvent->registryPath);
      RtlCopyMemory(pOutputBuffer+bufferSpaceUsed, pRegistryPacket->pRegistryEvent, registryEventSize);
      bufferSpaceUsed += registryEventSize;
      ExFreePoolWithTag(pRegistryPacket->pRegistryEvent, REGISTRY_POOL_TAG);
      ExFreePoolWithTag(pRegistryPacket, REGISTRY_POOL_TAG);
     } else {
      ExInterlockedInsertHeadList(&pRegistryManager->lQueuedRegistryEvents, &pRegistryPacket->Link, &pRegistryManager->lQueuedRegistryEventsSpinLock);
      break;
     }
    }
   
    /* Return the amount of space that is occupied with registry events */
    *pdwDataWritten = bufferSpaceUsed;
    status = STATUS_SUCCESS;
   } else {
    *pdwDataWritten = sizeof(REGISTRY_EVENT);
    status = STATUS_BUFFER_TOO_SMALL;
   }
        } except( EXCEPTION_EXECUTE_HANDLER ) {
   status = GetExceptionCode();   
   DbgPrint("RegistryMonitor: EXCEPTION IOCTL_CAPTURE_GET_REGEVENTS - %i\n", status);   
        }
    }
    return status;
}
NTSTATUS KDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
UINT dwDataWritten = 0;
    switch(irpStack->Parameters.DeviceIoControl.IoControlCode)
    {
  case IOCTL_CAPTURE_GET_REGEVENTS:
   UpdateLastContactTime();
   status = HandleIoctlGetRegEvents(DeviceObject, Irp, irpStack, &dwDataWritten);
   break;
        default:
            break;
    }
    Irp->IoStatus.Status = status;
   
    // Set # of bytes to copy back to user-mode...
    if(NT_SUCCESS(status))
        Irp->IoStatus.Information = dwDataWritten;
    else
        Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
return status;
}
VOID UpdateLastContactTime()
{
PCAPTURE_REGISTRY_MANAGER pRegistryManager;
/* Get the process manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
pRegistryManager->lastContactTime = GetCurrentTime();
}
ULONG GetCurrentTime()
{
LARGE_INTEGER currentSystemTime;
LARGE_INTEGER currentLocalTime;
ULONG time;
KeQuerySystemTime(&currentSystemTime);
ExSystemTimeToLocalTime(&currentSystemTime,&currentLocalTime);
RtlTimeToSecondsSince1970(&currentLocalTime, &time);
return time;
}
BOOLEAN GetRegistryObjectCompleteName(PUNICODE_STRING pRegistryPath, PUNICODE_STRING pPartialRegistryPath, PVOID pRegistryObject)
{
PCAPTURE_REGISTRY_MANAGER pRegistryManager;
BOOLEAN foundCompleteName = FALSE;
BOOLEAN partial = FALSE;
/* Get the process manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
/* Check to see if everything is valid */
/* We sometimes see a partial registry object name which is actually complete
    however if fails one of these checks for some reason. Not sure whether to report
    this registry event */
if((!MmIsAddressValid(pRegistryObject)) ||
  (pRegistryObject == NULL))
{
  return FALSE;
}
/* Check to see if the partial name is really the complete name */
if(pPartialRegistryPath != NULL)
{
  if( (((pPartialRegistryPath->Buffer[0] == '\\') || (pPartialRegistryPath->Buffer[0] == '%')) ||
   ((pPartialRegistryPath->Buffer[0] == 'T') && (pPartialRegistryPath->Buffer[1] == 'R') && (pPartialRegistryPath->Buffer[2] == 'Y') && (pPartialRegistryPath->Buffer[3] == '\\'))) )
  {
   RtlUnicodeStringCopy(pRegistryPath, pPartialRegistryPath);
   partial = TRUE;
   foundCompleteName = TRUE;
  }
}
  
if(!foundCompleteName)
{
  /* Query the object manager in the kernel for the complete name */
  NTSTATUS status;
  ULONG returnedLength;
  PUNICODE_STRING pObjectName = NULL;
  
  status = ObQueryNameString(pRegistryObject, (POBJECT_NAME_INFORMATION)pObjectName, 0, &returnedLength );
  if(status == STATUS_INFO_LENGTH_MISMATCH)
  {
   pObjectName = ExAllocatePoolWithTag(NonPagedPool, returnedLength, REGISTRY_POOL_TAG);
   status = ObQueryNameString(pRegistryObject, (POBJECT_NAME_INFORMATION)pObjectName, returnedLength, &returnedLength );
   if(NT_SUCCESS(status))
   {
    RtlUnicodeStringCopy(pRegistryPath, pObjectName);
    foundCompleteName = TRUE;
   }
   ExFreePoolWithTag(pObjectName, REGISTRY_POOL_TAG);
  }
}
//ASSERT(foundCompleteName == TRUE);
return foundCompleteName;
}
BOOLEAN QueueRegistryEvent(PREGISTRY_EVENT pRegistryEvent)
{
PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    /* Get the registry manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;
/* Check the last contact time of the user space program before queuing */
if( (GetCurrentTime()-pRegistryManager->lastContactTime) <= USERSPACE_CONNECTION_TIMEOUT)
{
  PREGISTRY_EVENT_PACKET pRegistryEventPacket = ExAllocatePoolWithTag(NonPagedPool, sizeof(REGISTRY_EVENT_PACKET), REGISTRY_POOL_TAG);
  pRegistryEventPacket->pRegistryEvent = pRegistryEvent;
  
  /* Queue registry event */
  ExInterlockedInsertTailList(&pRegistryManager->lQueuedRegistryEvents, &pRegistryEventPacket->Link, &pRegistryManager->lQueuedRegistryEventsSpinLock);
  return TRUE;
}
return FALSE;
}
NTSTATUS RegistryCallback(IN PVOID CallbackContext,
        IN PVOID  Argument1,
        IN PVOID  Argument2)
{
//REGISTRY_EVENT registryEvent;
BOOLEAN registryEventIsValid = FALSE;
BOOLEAN exception = FALSE;
LARGE_INTEGER CurrentSystemTime;
LARGE_INTEGER CurrentLocalTime;
TIME_FIELDS TimeFields;
int type;
UNICODE_STRING registryPath;
UCHAR* registryData = NULL;
ULONG registryDataLength = 0;
ULONG registryDataType = 0;
/* Allocate a large 64kb string ... maximum path name allowed in windows */
registryPath.Length = 0;
registryPath.MaximumLength = NTSTRSAFE_UNICODE_STRING_MAX_CCH * sizeof(WCHAR);
registryPath.Buffer = ExAllocatePoolWithTag(NonPagedPool, registryPath.MaximumLength, REGISTRY_POOL_TAG);
if(registryPath.Buffer == NULL)
{
  return STATUS_SUCCESS;
}
/* Put the time this event occured into the registry event */
KeQuerySystemTime(&CurrentSystemTime);
ExSystemTimeToLocalTime(&CurrentSystemTime,&CurrentLocalTime);

//registryEvent.processId = PsGetCurrentProcessId();
//registryEvent.eventType = (REG_NOTIFY_CLASS)Argument1;
type = (REG_NOTIFY_CLASS)Argument1;
try
{
  /* Large switch statement for all registry events ... fairly easy to understand */
  switch(type)
  {
  case RegNtPostCreateKey:
  {
   PREG_POST_CREATE_KEY_INFORMATION createKey = (PREG_POST_CREATE_KEY_INFORMATION)Argument2;
   if(NT_SUCCESS(createKey->Status))
   {
    PVOID* registryObject = createKey->Object;
    registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, createKey->CompleteName, *registryObject);
   }
   break;
  }
  case RegNtPostOpenKey:
  {
   PREG_POST_OPEN_KEY_INFORMATION openKey = (PREG_POST_OPEN_KEY_INFORMATION)Argument2;
   if(NT_SUCCESS(openKey->Status))
   {
    PVOID* registryObject = openKey->Object;
    registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, openKey->CompleteName, *registryObject);
   }
   break;
  }
  case RegNtPreDeleteKey:
  {
   PREG_DELETE_KEY_INFORMATION deleteKey = (PREG_DELETE_KEY_INFORMATION)Argument2;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, deleteKey->Object);
   break;
  }
  case RegNtDeleteValueKey:
  {
   PREG_DELETE_VALUE_KEY_INFORMATION deleteValueKey = (PREG_DELETE_VALUE_KEY_INFORMATION)Argument2;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, deleteValueKey->Object);
   if((registryEventIsValid) && (deleteValueKey->ValueName->Length > 0))
   {
    RtlUnicodeStringCatString(&registryPath,L"\\");
    RtlUnicodeStringCat(&registryPath, deleteValueKey->ValueName);
   }
   break;
  }
  case RegNtPreSetValueKey:
  {
   PREG_SET_VALUE_KEY_INFORMATION setValueKey = (PREG_SET_VALUE_KEY_INFORMATION)Argument2;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, setValueKey->Object);
   if((registryEventIsValid) && (setValueKey->ValueName->Length > 0))
   {
    registryDataType = setValueKey->Type;
    registryDataLength = setValueKey->DataSize;
    registryData = ExAllocatePoolWithTag(NonPagedPool, registryDataLength, REGISTRY_POOL_TAG);
    if(registryData != NULL)
    {
     RtlCopyBytes(registryData,setValueKey->Data,setValueKey->DataSize);
    } else {
     DbgPrint("RegistryMonitor: ERROR can't allocate memory for setvalue data\n");
    }
    RtlUnicodeStringCatString(&registryPath,L"\\");
    RtlUnicodeStringCat(&registryPath, setValueKey->ValueName);
   }
   break;
  }
  case RegNtEnumerateKey:
  {
   PREG_ENUMERATE_KEY_INFORMATION enumerateKey = (PREG_ENUMERATE_KEY_INFORMATION)Argument2;
   registryDataType = enumerateKey->KeyInformationClass;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, enumerateKey->Object);
   break;
  }
  case RegNtEnumerateValueKey:
  {
   PREG_ENUMERATE_VALUE_KEY_INFORMATION enumerateValueKey = (PREG_ENUMERATE_VALUE_KEY_INFORMATION)Argument2;
   registryDataType = enumerateValueKey->KeyValueInformationClass;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, enumerateValueKey->Object);
   break;
  }
  case RegNtQueryKey:
  {
   PREG_QUERY_KEY_INFORMATION queryKey = (PREG_QUERY_KEY_INFORMATION)Argument2;
   registryDataType = queryKey->KeyInformationClass;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, queryKey->Object);
   break;
  }
  case RegNtQueryValueKey:
  {
   PREG_QUERY_VALUE_KEY_INFORMATION queryValueKey = (PREG_QUERY_VALUE_KEY_INFORMATION)Argument2;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, queryValueKey->Object);
   if((registryEventIsValid) && (queryValueKey->ValueName->Length > 0))
   {
    registryDataType = queryValueKey->KeyValueInformationClass;
    RtlUnicodeStringCatString(&registryPath,L"\\");
    RtlUnicodeStringCat(&registryPath, queryValueKey->ValueName);
   }
   break;
  }
  case RegNtKeyHandleClose:
  {
   PREG_KEY_HANDLE_CLOSE_INFORMATION closeKey = (PREG_KEY_HANDLE_CLOSE_INFORMATION)Argument2;
   registryEventIsValid = GetRegistryObjectCompleteName(&registryPath, NULL, closeKey->Object);
   break;
  }
  default:
   break;
  }
} except( EXCEPTION_EXECUTE_HANDLER ) {
  /* Do nothing if an exception occured ... event won't be queued */
  registryEventIsValid = FALSE;
  exception = TRUE;
}
if(registryEventIsValid)
{
  PREGISTRY_EVENT pRegistryEvent;
  UINT eventSize = sizeof(REGISTRY_EVENT)+registryPath.Length+(sizeof(WCHAR))+registryDataLength;
  pRegistryEvent = ExAllocatePoolWithTag(NonPagedPool, eventSize, REGISTRY_POOL_TAG);
  
  if(pRegistryEvent != NULL)
  {
   pRegistryEvent->registryPathLengthB = registryPath.Length+sizeof(WCHAR);
   pRegistryEvent->dataType = registryDataType;
   pRegistryEvent->dataLengthB = registryDataLength;
   //RtlStringCbCopyUnicodeString(pRegistryEvent->registryPath, pRegistryEvent->registryPathLength, &registryPath);
   RtlCopyBytes(pRegistryEvent->registryData, registryPath.Buffer, registryPath.Length);
   pRegistryEvent->registryData[registryPath.Length] = '\0';
   pRegistryEvent->registryData[registryPath.Length+1] = '\0';
   RtlCopyBytes(pRegistryEvent->registryData+pRegistryEvent->registryPathLengthB, registryData, registryDataLength);
   if(registryData != NULL)
   {
    ExFreePoolWithTag(registryData, REGISTRY_POOL_TAG);
   }
   
   pRegistryEvent->processId = PsGetCurrentProcessId();
   RtlTimeToTimeFields(&CurrentLocalTime,&pRegistryEvent->time);
   pRegistryEvent->eventType = (REG_NOTIFY_CLASS)Argument1;
   if(!QueueRegistryEvent(pRegistryEvent))
   {
    ExFreePoolWithTag(pRegistryEvent, REGISTRY_POOL_TAG);
   }
  }
}
if(registryPath.Buffer != NULL)
{
  ExFreePoolWithTag(registryPath.Buffer, REGISTRY_POOL_TAG);
}
/* Always return a success ... we aren't doing any filtering, just monitoring */
return STATUS_SUCCESS;
}
void UnloadDriver(IN PDRIVER_OBJECT DriverObject)
{
    UNICODE_STRING  uszDeviceString;
NTSTATUS        ntStatus;
PCAPTURE_REGISTRY_MANAGER pRegistryManager;
    /* Get the registry manager from the device extension */
    pRegistryManager = gpDeviceObject->DeviceExtension;

if(pRegistryManager->bReady == TRUE)
{
  KeCancelTimer(&pRegistryManager->connectionCheckerTimer);
  CmUnRegisterCallback(pRegistryManager->registryCallbackCookie);
  pRegistryManager->bReady = FALSE;
}
while(!IsListEmpty(&pRegistryManager->lQueuedRegistryEvents))
{
  PLIST_ENTRY head = ExInterlockedRemoveHeadList(&pRegistryManager->lQueuedRegistryEvents, &pRegistryManager->lQueuedRegistryEventsSpinLock);
  PREGISTRY_EVENT_PACKET pRegistryEventPacket = CONTAINING_RECORD(head, REGISTRY_EVENT_PACKET, Link);
  ExFreePoolWithTag(pRegistryEventPacket->pRegistryEvent, REGISTRY_POOL_TAG);
  ExFreePoolWithTag(pRegistryEventPacket, REGISTRY_POOL_TAG);
}
RtlInitUnicodeString(&uszDeviceString, L"[url=file://\\DosDevices\\RegistryMonitor]\\DosDevices\\RegistryMonitor[/url]");
    IoDeleteSymbolicLink(&uszDeviceString);
    if(DriverObject->DeviceObject != NULL)
{
  IoDeleteDevice(DriverObject->DeviceObject);
}
}