c - 如何检测访问指定注册表的进程名称(如进程监视器)

Question

如何像进程监视器一样检测访问指定注册表的进程名？

较旧的 regmon 使用 SSDT Hooking 来实现，但在 Windows 10 中，我们无法进行 hook使用它的注册表。 SSDT Hooking seem to be legacy technology 。

SSDT Hooking 有替代品吗？

Answer 1

您应该实现适当的 registry filtering driver .

A registry filtering driver is any kernel-mode driver that filters registry calls, such as the driver component of an antivirus software package. The configuration manager, which implements the registry, allows registry filtering drivers to filter any thread's calls to registry functions.