Foro de elhacker.net

'
'Coded by Slasher
'

Option Explicit

Public Declare Function CreateEvent Lib "kernel32" Alias "CreateEventA" (ByVal lpEventAttributes As Long, ByVal bManualReset As Long, ByVal bInitialState As Long, ByVal lpName As String) As Long

Public Declare Function RegCreateKeyEx Lib "advapi32.dll" Alias "RegCreateKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal Reserved As Long, ByVal lpClass As String, ByVal dwOptions As Long, ByVal samDesired As Long, ByVal lpSecurityAttributes As Long, phkResult As Long, lpdwDisposition As Long) As Long

Public Declare Function RegNotifyChangeKeyValue Lib "advapi32.dll" (ByVal hKey As Long, ByVal bWatchSubtree As Long, ByVal dwNotifyFilter As Long, ByVal hEvent As Long, ByVal fAsynchronus As Long) As Long

Public Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long
Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long

Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Public Const HKEY_CLASSES_ROOT = &H80000000
Public Const HKEY_LOCAL_MACHINE = &H80000002

Public Const KEY_NOTIFY = &H10

Public Const REG_OPENED_EXISTING_KEY = &H2
Public Const REG_NOTIFY_CHANGE_NAME = &H1
Public Const REG_NOTIFY_CHANGE_LAST_SET = &H4

Public Const DEFKEY = "Software\" 'Clave que se quiere monitorear.

Public Cancel As Boolean

Sub RegMon()

        Dim hEvent&
        Dim hKey&
        Dim r&

NewTest:
  'Crea un evento para responder a las modificaciones del registro.
  '
  hEvent = CreateEvent(0&, True, 0, vbNullString)
  
  'Abre la clave.
  '
  r = RegCreateKeyEx(HKEY_CLASSES_ROOT, DEFKEY, 0, vbNullString, 0, _
                     KEY_NOTIFY, 0, hKey, REG_OPENED_EXISTING_KEY)
  
  'Inicia el monitoreo de la clave.
  '
  r = RegNotifyChangeKeyValue(hKey, True, _
                              REG_NOTIFY_CHANGE_NAME Or _
                              REG_NOTIFY_CHANGE_LAST_SET, _
                              hEvent, True)
  
  Do While WaitForSingleObject(hEvent, 10)
    'Espera que se modifique, agregue, o elimine
    'algún valor de la clave.
    '
    If Cancel Then
      'Cancelar la espera.
      '
      Exit Sub
    End If
    
    DoEvents
  Loop
  
  'Si se modifica la clave...
  '
  If Not Cancel Then
    Stop
  End If
  
  r = RegCloseKey(hKey)
  r = CloseHandle(hEvent)
  
GoTo NewTest  'Vuelve a comenzar el monitoreo.

End Sub