有什么办法或软件可以跟踪程序执行过程中访问注册表中的那些键

Question

有什么办法或软件可以跟踪程序执行过程中访问注册表中的那些键?

Answer 1

监视注册表的某一个位置的值的变化    
    
SHELL32.DLL:
RegNotifyChangeKeyValue
SHChangeNotifyDeregisterHANDLE WINAPI SHChangeNotifyRegister(HWND hWnd,DWORD dwFlags,LONG wEventMask,UINT uMsg,DWORD cItems, LPCNOTIFYREGISTER lpItems); index 2;BOOL WINAPI SHChangeNotifyDeregister(HANDLE hNotify);index 4; //hNotify Come form SHChangeNotifyRegisterHANDLE WINAPI SHChangeNotification_Lock(HANDLE hMemoryMap,DWORD dwProcessId,LPCITEMIDLIST **lppidls,LPLONG lpwEventId); index 644;BOOL WINAPI SHChangeNotification_Unlock(HANDLE hLock); index 645;
Ex:
LPCITEMIDLIST *pidls;
LONG wEventId;if (bRunningWindowsNT) {
HANDLE hLock;
hLock = SHChangeNotification_Lock(
(HANDLE)wParam, (DWORD)lParam,
&pidls, &wEventId);
if (hLock) {
ProcessEvent(wEventId,
pidls[0], pidls[1]);
SHChangeNotification_Unlock(hLock);
}
}
else {
pidls = (LPCITEMIDLIST*)wParam;
wEventId = (LONG)lParam;
ProcessEvent(wEventId,
pidls[0], pidls[1]);
}
 
//来自猛料，希望对你有帮助！
 

Answer 2

编写服务Hook得驱动程序
学RegMon软件，不是Delphi所能做到的