1. Computing

Monitoring Registry Changes


Need to get notified about changes to the attributes or 
contents of a specified Registry key. Part 4 to your 
"Big Brother" Delphi code toolkit.

//Below you will find the source to 

The RegMonitorThread class

unit RegMonitorThread; interface uses Classes, Windows, Messages, Registry, SysUtils; const WM_REGCHANGE = WM_USER + 1973; //Need to redeclare the API function - instead of BOOL is uses DWORD. function RegNotifyChangeKeyValue(hKey: HKEY; bWatchSubtree: DWORD; dwNotifyFilter: DWORD; hEvent: THandle; fAsynchronus: DWORD): Longint; stdcall; external 'advapi32.dll' name 'RegNotifyChangeKeyValue'; type TChangeData = record Key : string; RootKey : HKey; end; TRegMonitorThread = class(TThread) private FReg: TRegistry; FEvent: Integer; fChangeData : TChangeData; fKey: string; fRootKey: HKey; fWatchSub: boolean; fFilter: integer; fWnd: THandle; procedure InitThread; procedure SetFilter(const Value: integer); function GetFilter: integer; function GetChangeData: TChangeData; public constructor Create; destructor Destroy; override; property Key: string read fKey write fKey; property RootKey: HKey read fRootKey write fRootKey; property WatchSub: boolean read fWatchSub write fWatchSub; property Filter: integer read GetFilter write SetFilter; property Wnd: THandle read fWnd write fWnd; property ChangeData : TChangeData read GetChangeData; protected procedure Execute; override; end; implementation { TRegMonitorThread } constructor TRegMonitorThread.Create; begin // Execute won’t be called until after Resume is called. inherited Create(True); FReg := TRegistry.Create; end; destructor TRegMonitorThread.Destroy; begin FReg.Free; inherited; end; procedure TRegMonitorThread.InitThread; begin FReg.RootKey := RootKey; if not FReg.OpenKeyReadOnly(Key) then begin raise Exception.Create('Unable to open registry key ' + Key); end; FEvent := CreateEvent(nil, True, False, 'RegMonitorChange'); RegNotifyChangeKeyValue(FReg.CurrentKey, 1, Filter, FEvent, 1); end; procedure TRegMonitorThread.Execute; begin InitThread; while not Terminated do begin if WaitForSingleObject(FEvent, INFINITE) = WAIT_OBJECT_0 then begin fChangeData.RootKey := RootKey; fChangeData.Key := Key; SendMessage(Wnd, WM_REGCHANGE, RootKey, LongInt(PChar(Key))); ResetEvent(FEvent); RegNotifyChangeKeyValue(FReg.CurrentKey, 1, Filter, FEvent, 1); end; end; end; procedure TRegMonitorThread.SetFilter(const Value: integer); begin if fFilter <> Value then begin fFilter := Value; end; end; function TRegMonitorThread.GetFilter: integer; begin if fFilter = 0 then begin fFilter:= REG_NOTIFY_CHANGE_NAME or REG_NOTIFY_CHANGE_ATTRIBUTES or REG_NOTIFY_CHANGE_LAST_SET or REG_NOTIFY_CHANGE_SECURITY; end; Result := fFilter; end; function TRegMonitorThread.GetChangeData: TChangeData; begin Result := fChangeData; end; end.

Sample Delphi application

//Add a TMemo component (name: Memo1) to a Delphi form (name: Form1). unit Unit1; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls, RegMonitorThread; type TForm1 = class(TForm) Memo1: TMemo; procedure FormCreate(Sender: TObject); procedure FormDestroy(Sender: TObject); private procedure WMREGCHANGE(var Msg : TMessage); message WM_REGCHANGE; public { Public declarations } end; var Form1: TForm1; RegMonitorThread : TRegMonitorThread; implementation {$R *.dfm} procedure TForm1.FormCreate(Sender: TObject); begin RegMonitorThread := TRegMonitorThread.Create; with RegMonitorThread do begin FreeOnTerminate:=True; Wnd := Form1.Handle; Key := 'Software\ADP'; RootKey := HKEY_LOCAL_MACHINE; WatchSub := True; Resume; end; end; procedure TForm1.FormDestroy(Sender: TObject); begin RegMonitorThread.Terminate; end; procedure TForm1.WMREGCHANGE(var Msg: TMessage); begin Memo1.Lines.Add('-------------------------------------------'); Memo1.Lines.Add('Registry change at ' + DateTimeToStr(Now)); Memo1.Lines.Add(IntToStr(RegMonitorThread.ChangeData.RootKey) + ' - ' + RegMonitorThread.ChangeData.Key); end; end. { ******************************************** Zarko Gajic About.com Guide to Delphi Programming http://delphi.about.com email: delphi@aboutguide.com free newsletter: http://delphi.about.com/library/blnewsletter.htm forum: http://forums.about.com/ab-delphi/start/ ******************************************** }

©2014 About.com. All rights reserved.