Sign in to follow this  
Followers 0
FuryCell

Count registry keys

16 posts in this topic

i need to count the amount of keys in a registry key every 300 milliseconds and if it is changed than act accordingly.i tried using regenumkey but this brings my cpu usage up to about 50%. :(

I see it can be done with this dll but dont know how to use dll call.

|look here|> http://msdn.microsoft.com/library/default....ueryinfokey.asp

(The part that gets the key count is the lpcSubKeys one)

can someone please show me how to.

any help would be greatly appreactated.

thanks in advance


HKTunes:Softpedia | GoogleCodeLyricToy:Softpedia | GoogleCodeRCTunes:Softpedia | GoogleCodeMichtaToolsProgrammer n. - An ingenious device that turns caffeine into code.

Share this post


Link to post
Share on other sites



1st you'll need the latest beta, that struct is all pointers excepth the handle.

Then you'll need to use the DllStruct functions


SciTE for AutoItDirections for Submitting Standard UDFs

 

Don't argue with an idiot; people watching may not be able to tell the difference.

 

Share this post


Link to post
Share on other sites

That's not a dll

<{POST_SNAPBACK}>

Your right, scanned the doc to quickly and that's a CE function no less.

SciTE for AutoItDirections for Submitting Standard UDFs

 

Don't argue with an idiot; people watching may not be able to tell the difference.

 

Share this post


Link to post
Share on other sites

#5 ·  Posted (edited)

Thanks for the help, gafrost and ejoc.

ok it cant be done with a dll but can it be done with a com object?

thanks in advance.

Edited by SolidSnake

HKTunes:Softpedia | GoogleCodeLyricToy:Softpedia | GoogleCodeRCTunes:Softpedia | GoogleCodeMichtaToolsProgrammer n. - An ingenious device that turns caffeine into code.

Share this post


Link to post
Share on other sites

diff keys:

#define HKEY_CLASSES_ROOT   ((HKEY)0x80000000)
#define HKEY_CURRENT_USER   ((HKEY)0x80000001)
#define HKEY_LOCAL_MACHINE  ((HKEY)0x80000002)
#define HKEY_USERS  ((HKEY)0x80000003)
#define HKEY_PERFORMANCE_DATA   ((HKEY)0x80000004)
#define HKEY_CURRENT_CONFIG ((HKEY)0x80000005)
#define HKEY_DYN_DATA   ((HKEY)0x80000006)

script:

#cs
vi:ts=4 sw=4:
Ejoc
#ce
Opt("MustDeclareVars",1)
Local $p
$p = DllStructCreate("dword")
DLLCall("Advapi32.dll","long","RegQueryInfoKey",_
        "int",0x80000000,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",DllstructGetPtr($p),_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0)
If @error Then
    msgbox(0,"","no dll / func")
    DllStructDelete($p)
    exit
EndIf
msgbox(0,"",DllStructGetData($p,1))
DllStructDelete($p)

Start -> Programs -> AutoIt v3 -> AutoIt Help File -> Index -> (The Function you are asking about)----- Links -----DllStruct UDFsRSA Crypto UDFs

Share this post


Link to post
Share on other sites

diff keys:

#define HKEY_CLASSES_ROOT    ((HKEY)0x80000000)
#define HKEY_CURRENT_USER    ((HKEY)0x80000001)
#define HKEY_LOCAL_MACHINE    ((HKEY)0x80000002)
#define HKEY_USERS    ((HKEY)0x80000003)
#define HKEY_PERFORMANCE_DATA    ((HKEY)0x80000004)
#define HKEY_CURRENT_CONFIG    ((HKEY)0x80000005)
#define HKEY_DYN_DATA    ((HKEY)0x80000006)

script:

#cs
vi:ts=4 sw=4:
Ejoc
#ce
Opt("MustDeclareVars",1)
Local $p
$p = DllStructCreate("dword")
DLLCall("Advapi32.dll","long","RegQueryInfoKey",_
        "int",0x80000000,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",DllstructGetPtr($p),_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0,_
        "ptr",0)
If @error Then
    msgbox(0,"","no dll / func")
    DllStructDelete($p)
    exit
EndIf
msgbox(0,"",DllStructGetData($p,1))
DllStructDelete($p)

<{POST_SNAPBACK}>

thanks but how would i do it for this key?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

P.S.

awesome work on adding dllstruct to autoit :(


HKTunes:Softpedia | GoogleCodeLyricToy:Softpedia | GoogleCodeRCTunes:Softpedia | GoogleCodeMichtaToolsProgrammer n. - An ingenious device that turns caffeine into code.

Share this post


Link to post
Share on other sites

#8 ·  Posted (edited)

I believe this is correct, Ejoc probably knows how to do it better

#cs
    #define HKEY_CLASSES_ROOT    ((HKEY)0x80000000)
    #define HKEY_CURRENT_USER    ((HKEY)0x80000001)
    #define HKEY_LOCAL_MACHINE    ((HKEY)0x80000002)
    #define HKEY_USERS    ((HKEY)0x80000003)
    #define HKEY_PERFORMANCE_DATA    ((HKEY)0x80000004)
    #define HKEY_CURRENT_CONFIG    ((HKEY)0x80000005)
    #define HKEY_DYN_DATA    ((HKEY)0x80000006)
    vi:ts=4 sw=4:
    Ejoc
#ce
Const $READ_CONTROL = 0x20000
Const $STANDARD_RIGHTS_READ = ($READ_CONTROL)
Const $KEY_QUERY_VALUE = 0x1
Const $KEY_ENUMERATE_SUB_KEYS = 0x8
Const $KEY_NOTIFY = 0x10


opt("MustDeclareVars", 1)
Local $p
Local $subkey = "SYSTEM\CurrentControlSet\Services"
Local $str = DllStructCreate ("char[" & StringLen($subkey) + 1 & "]")
DllStructSetData ($str, 1, $subkey)
Local $handle = DllStructCreate ("int")
DllCall("Advapi32.dll", "long", "RegOpenKeyEx", _
        "int", 0x80000002, _
        "ptr", DllStructGetPtr ($str), _
        "int", 0, _
        "long", BitOR($STANDARD_RIGHTS_READ, $KEY_QUERY_VALUE, $KEY_ENUMERATE_SUB_KEYS, $KEY_NOTIFY), _
        "ptr", DllStructGetPtr ($handle))
If @error Then
    MsgBox(0, "", "no dll / func")
    DllStructDelete ($str)
    DllStructDelete ($handle)
    Exit
EndIf

$p = DllStructCreate ("dword")
DllCall("Advapi32.dll", "long", "RegQueryInfoKey", _
        "int", DllStructGetData ($handle, 1), _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", DllstructGetPtr ($p), _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0)
If @error Then
    MsgBox(0, "", "no dll / func")
    DllStructDelete ($p)
    DllStructDelete ($str)
    DllStructDelete ($handle)
    Exit
EndIf
MsgBox(0, "", DllStructGetData ($p, 1))
DllStructDelete ($p)
DllStructDelete ($str)
DllCall("Advapi32.dll", "long", "RegCloseKey", "int", DllStructGetData ($handle, 1))
DllStructDelete ($handle)
Edited by gafrost

SciTE for AutoItDirections for Submitting Standard UDFs

 

Don't argue with an idiot; people watching may not be able to tell the difference.

 

Share this post


Link to post
Share on other sites

I believe this is correct, Ejoc probably knows how to do it better

#cs
    #define HKEY_CLASSES_ROOT    ((HKEY)0x80000000)
    #define HKEY_CURRENT_USER    ((HKEY)0x80000001)
    #define HKEY_LOCAL_MACHINE    ((HKEY)0x80000002)
    #define HKEY_USERS    ((HKEY)0x80000003)
    #define HKEY_PERFORMANCE_DATA    ((HKEY)0x80000004)
    #define HKEY_CURRENT_CONFIG    ((HKEY)0x80000005)
    #define HKEY_DYN_DATA    ((HKEY)0x80000006)
    vi:ts=4 sw=4:
    Ejoc
#ce
Const $READ_CONTROL = 0x20000
Const $STANDARD_RIGHTS_READ = ($READ_CONTROL)
Const $KEY_QUERY_VALUE = 0x1
Const $KEY_ENUMERATE_SUB_KEYS = 0x8
Const $KEY_NOTIFY = 0x10
opt("MustDeclareVars", 1)
Local $p
Local $subkey = "SYSTEM\CurrentControlSet\Services"
Local $str = DllStructCreate ("char[" & StringLen($subkey) + 1 & "]")
DllStructSetData ($str, 1, $subkey)
Local $handle = DllStructCreate ("int")
DllCall("Advapi32.dll", "long", "RegOpenKeyEx", _
        "int", 0x80000002, _
        "ptr", DllStructGetPtr ($str), _
        "int", 0, _
        "long", BitOR($STANDARD_RIGHTS_READ, $KEY_QUERY_VALUE, $KEY_ENUMERATE_SUB_KEYS, $KEY_NOTIFY), _
        "ptr", DllStructGetPtr ($handle))
If @error Then
    MsgBox(0, "", "no dll / func")
    DllStructDelete ($str)
    DllStructDelete ($handle)
    Exit
EndIf

$p = DllStructCreate ("dword")
DllCall("Advapi32.dll", "long", "RegQueryInfoKey", _
        "int", DllStructGetData ($handle, 1), _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", DllstructGetPtr ($p), _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0, _
        "ptr", 0)
If @error Then
    MsgBox(0, "", "no dll / func")
    DllStructDelete ($p)
    DllStructDelete ($str)
    DllStructDelete ($handle)
    Exit
EndIf
MsgBox(0, "", DllStructGetData ($p, 1))
DllStructDelete ($p)
DllStructDelete ($str)
DllCall("Advapi32.dll", "long", "RegCloseKey", "int", DllStructGetData ($handle, 1))
DllStructDelete ($handle)

<{POST_SNAPBACK}>

thanks gafrost. :( i am going to try it out now.

HKTunes:Softpedia | GoogleCodeLyricToy:Softpedia | GoogleCodeRCTunes:Softpedia | GoogleCodeMichtaToolsProgrammer n. - An ingenious device that turns caffeine into code.

Share this post


Link to post
Share on other sites

#10 ·  Posted (edited)

cleaned it up some, and turned it into a function

opt("MustDeclareVars", 1)

ConsoleWrite(_RegKeyCount("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services") & @LF)

Func _RegKeyCount($s_key)
    Const $HKEY_CLASSES_ROOT = 0x80000000
    Const $HKEY_CURRENT_USER = 0x80000001
    Const $HKEY_LOCAL_MACHINE = 0x80000002
    Const $HKEY_USERS = 0x80000003
    Const $HKEY_CURRENT_CONFIG = 0x80000005
    
    Const $READ_CONTROL = 0x20000
    Const $STANDARD_RIGHTS_READ = ($READ_CONTROL)
    Const $KEY_QUERY_VALUE = 0x1
    Const $KEY_ENUMERATE_SUB_KEYS = 0x8
    Const $KEY_NOTIFY = 0x10
    Local $p, $a_key = StringSplit($s_key, "\"), $key, $subkey, $i

    Select
        Case StringUpper($a_key[1]) = "HKLM" Or StringUpper($a_key[1]) = "HKEY_LOCAL_MACHINE"
            $key = $HKEY_LOCAL_MACHINE
        Case StringUpper($a_key[1]) = "HKU" Or StringUpper($a_key[1]) = "HKEY_USERS"
            $key = $HKEY_USERS
        Case StringUpper($a_key[1]) = "HKCU" Or StringUpper($a_key[1]) = "HKEY_CURRENT_USER"
            $key = $HKEY_CURRENT_USER
        Case StringUpper($a_key[1]) = "HKCR" Or StringUpper($a_key[1]) = "HKEY_CLASSES_ROOT"
            $key = $HKEY_CLASSES_ROOT
        Case StringUpper($a_key[1]) = "HKCC" Or StringUpper($a_key[1]) = "HKEY_CURRENT_CONFIG"
            $key = $HKEY_CURRENT_CONFIG
    EndSelect

    For $i = 2 To $a_key[0]
        $subkey = $subkey & $a_key[$i] & "\"
    Next
    $subkey = StringTrimRight($subkey, 1)

    Local $str = DllStructCreate ("char[" & StringLen($subkey) + 1 & "]")
    DllStructSetData ($str, 1, $subkey)
    Local $handle = DllStructCreate ("int")
    DllCall("Advapi32.dll", "long", "RegOpenKeyEx", _
            "int", $key, _
            "ptr", DllStructGetPtr ($str), _
            "int", 0, _
            "long", BitOR($STANDARD_RIGHTS_READ, $KEY_QUERY_VALUE, $KEY_ENUMERATE_SUB_KEYS, $KEY_NOTIFY), _
            "ptr", DllStructGetPtr ($handle))
    If @error Then
        DllStructDelete ($str)
        DllStructDelete ($handle)
        SetError(1)
        Return 0
    EndIf
    Local $i_handle = DllStructGetData ($handle, 1)
    DllStructDelete ($str)
    DllStructDelete ($handle)
    DllCall("Advapi32.dll", "long", "RegCloseKey", "int", DllStructGetData ($handle, 1))
    
    $p = DllStructCreate ("dword")
    DllCall("Advapi32.dll", "long", "RegQueryInfoKey", _
            "int", $i_handle, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", DllstructGetPtr ($p), _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0)
    If @error Then
        DllStructDelete ($p)
        SetError(2)
        Return 0
    EndIf
    Local $count = DllStructGetData ($p, 1)
    DllStructDelete ($p)
    Return $count
EndFunc  ;==>_RegKeyCount
Edited by gafrost

SciTE for AutoItDirections for Submitting Standard UDFs

 

Don't argue with an idiot; people watching may not be able to tell the difference.

 

Share this post


Link to post
Share on other sites

cleaned it up some, and turned it into a function

opt("MustDeclareVars", 1)

ConsoleWrite(_RegKeyCount("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services") & @LF)

Func _RegKeyCount($s_key)
    Const $HKEY_CLASSES_ROOT = 0x80000000
    Const $HKEY_CURRENT_USER = 0x80000001
    Const $HKEY_LOCAL_MACHINE = 0x80000002
    Const $HKEY_USERS = 0x80000003
    Const $HKEY_CURRENT_CONFIG = 0x80000005
    
    Const $READ_CONTROL = 0x20000
    Const $STANDARD_RIGHTS_READ = ($READ_CONTROL)
    Const $KEY_QUERY_VALUE = 0x1
    Const $KEY_ENUMERATE_SUB_KEYS = 0x8
    Const $KEY_NOTIFY = 0x10
    Local $p, $a_key = StringSplit($s_key, "\"), $key, $subkey, $i

    Select
        Case StringUpper($a_key[1]) = "HKLM" Or StringUpper($a_key[1]) = "HKEY_LOCAL_MACHINE"
            $key = $HKEY_LOCAL_MACHINE
        Case StringUpper($a_key[1]) = "HKU" Or StringUpper($a_key[1]) = "HKEY_USERS"
            $key = $HKEY_USERS
        Case StringUpper($a_key[1]) = "HKCU" Or StringUpper($a_key[1]) = "HKEY_CURRENT_USER"
            $key = $HKEY_CURRENT_USER
        Case StringUpper($a_key[1]) = "HKCR" Or StringUpper($a_key[1]) = "HKEY_CLASSES_ROOT"
            $key = $HKEY_CLASSES_ROOT
        Case StringUpper($a_key[1]) = "HKCC" Or StringUpper($a_key[1]) = "HKEY_CURRENT_CONFIG"
            $key = $HKEY_CURRENT_CONFIG
    EndSelect

    For $i = 2 To $a_key[0]
        $subkey = $subkey & $a_key[$i] & "\"
    Next
    $subkey = StringTrimRight($subkey, 1)

    Local $str = DllStructCreate ("char[" & StringLen($subkey) + 1 & "]")
    DllStructSetData ($str, 1, $subkey)
    Local $handle = DllStructCreate ("int")
    DllCall("Advapi32.dll", "long", "RegOpenKeyEx", _
            "int", $key, _
            "ptr", DllStructGetPtr ($str), _
            "int", 0, _
            "long", BitOR($STANDARD_RIGHTS_READ, $KEY_QUERY_VALUE, $KEY_ENUMERATE_SUB_KEYS, $KEY_NOTIFY), _
            "ptr", DllStructGetPtr ($handle))
    If @error Then
        DllStructDelete ($str)
        DllStructDelete ($handle)
        SetError(1)
        Return 0
    EndIf
    Local $i_handle = DllStructGetData ($handle, 1)
    DllStructDelete ($str)
    DllStructDelete ($handle)
    DllCall("Advapi32.dll", "long", "RegCloseKey", "int", DllStructGetData ($handle, 1))
    
    $p = DllStructCreate ("dword")
    DllCall("Advapi32.dll", "long", "RegQueryInfoKey", _
            "int", $i_handle, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", DllstructGetPtr ($p), _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0, _
            "ptr", 0)
    If @error Then
        DllStructDelete ($p)
        SetError(2)
        Return 0
    EndIf
    Local $count = DllStructGetData ($p, 1)
    DllStructDelete ($p)
    Return $count
EndFunc  ;==>_RegKeyCount

<{POST_SNAPBACK}>

Thanks a million Gafrost a function was exactly what i was looking for.

P.S in case you were wondering the program i am working on is called Startup Sentry. it alerts you when new program tries to add it self to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run key, the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key,the all users startup folder,the current user start up folder and i am using the regquery that you and ejoc helped me on to count add a feture to alert you when a service is added.when you get the alert you have the option to allow or deny the program. i will try to post it in the forums soon and i will credit you and Ejoc for helping me.


HKTunes:Softpedia | GoogleCodeLyricToy:Softpedia | GoogleCodeRCTunes:Softpedia | GoogleCodeMichtaToolsProgrammer n. - An ingenious device that turns caffeine into code.

Share this post


Link to post
Share on other sites

I believe this is correct, Ejoc probably knows how to do it better

No I don't :( I've just been doing C for over 10 years, so I can skim thru the MSDN descriptions pretty fast, I'd never done any Windows OS level programming before. AutoIt has gotten me into Windows OS programming, which I found out wasn't as bad as I thought it was :(

Start -> Programs -> AutoIt v3 -> AutoIt Help File -> Index -> (The Function you are asking about)----- Links -----DllStruct UDFsRSA Crypto UDFs

Share this post


Link to post
Share on other sites

Windows OS programming, which I found out wasn't as bad as I thought it was

That's gotta be the first time i've ever heard that! :(

AutoIt3 online docs Use it... Know it... Live it...MSDN libraryglobal Help and SupportWindows: Just another pane in the glass.

Share this post


Link to post
Share on other sites

Could someone help me fix the above code for the latest beta? The DllStructDelete is no longer a function so I tried to just comment them out, but I get a fatal error on this line...

DllCall("Advapi32.dll", "long", "RegQueryInfoKey", _

I also tried using the $Struct=0, however that gave me the undefined variable error. Any help would be great.

Share this post


Link to post
Share on other sites

Fixed it :lmao: Was apparently missing another "ptr", 0 at the end there. Instead of messing with the formatting for on here and such, I'm just gonna upload it.

Thanks for fixing it

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0