tracereg.cpp

使用微软的Detours执行一种注册表的监测方法；现在还有很多黑客高手在使用

        rv = Real_MoveFileW(a0, a1);
    } __finally {
        _PrintExit("MoveFileW(,) -> %lx\n", rv);
    };
    return rv;
}

HFILE WINAPI Mine_OpenFile(LPCSTR a0,
                              struct _OFSTRUCT* a1,
                              UINT a2)
{
    _PrintEnter("OpenFile(%hs,%lx,%lx)\n", a0, a1, a2);

    HFILE rv = 0;
    __try {
        rv = Real_OpenFile(a0, a1, a2);
    } __finally {
        _PrintExit("OpenFile(,,) -> %lx\n", rv);
    };
    return rv;
}

LONG WINAPI Mine_RegCreateKeyExA(HKEY a0,
                                    LPCSTR a1,
                                    DWORD a2,
                                    LPSTR a3,
                                    DWORD a4,
                                    REGSAM a5,
                                    LPSECURITY_ATTRIBUTES a6,
                                    PHKEY a7,
                                    LPDWORD a8)
{
    _PrintEnter("RegCreateKeyExA(%lx,%hs,%lx,%hs,%lx,%lx,%lx,%lx,%lx)\n", a0, a1, a2, a3, a4, a5, a6, a7, a8);

    LONG rv = 0;
    __try {
        rv = Real_RegCreateKeyExA(a0, a1, a2, a3, a4, a5, a6, a7, a8);
    } __finally {
        _PrintExit("RegCreateKeyExA(,,,,,,,,) -> %lx\n", rv);
    };
    return rv;
}

LONG WINAPI Mine_RegCreateKeyExW(HKEY a0,
                                    LPCWSTR a1,
                                    DWORD a2,
                                    LPWSTR a3,
                                    DWORD a4,
                                    REGSAM a5,
                                    LPSECURITY_ATTRIBUTES a6,
                                    PHKEY a7,
                                    LPDWORD a8)
{
	_PrintEnter(NULL);
    LONG rv = 0;
    __try {
        rv = Real_RegCreateKeyExW(a0, a1, a2, a3, a4, a5, a6, a7, a8);
    } __finally {
		_PrintExit("RegCreateKeyExW(%lx,%ls,%lx,%ls,%lx,%lx,%lx,%lx,%lx) -> %lx\n",
				   a0, a1, a2, a3, a4, a5, a6, a7, a8, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegDeleteKeyA(HKEY a0,
                                  LPCSTR a1)
{
	_PrintEnter(NULL);
    LONG rv = 0;
    __try {
        rv = Real_RegDeleteKeyA(a0, a1);
    } __finally {
		_PrintExit("RegDeleteKeyA(%lx,%hs) -> %lx\n", a0, a1, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegDeleteKeyW(HKEY a0,
                                  LPCWSTR a1)
{
	_PrintEnter(NULL);
    LONG rv = 0;
    __try {
        rv = Real_RegDeleteKeyW(a0, a1);
    } __finally {
		_PrintExit("RegDeleteKeyW(%lx,%ls) -> %lx\n", a0, a1, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegDeleteValueA(HKEY a0,
                                    LPCSTR a1)
{
    _PrintEnter("RegDeleteValueA(%lx,%hs)\n", a0, a1);

    LONG rv = 0;
    __try {
        rv = Real_RegDeleteValueA(a0, a1);
    } __finally {
        _PrintExit("RegDeleteValueA(,) -> %lx\n", rv);
    };
    return rv;
}

LONG WINAPI Mine_RegDeleteValueW(HKEY a0,
                                    LPCWSTR a1)
{
    _PrintEnter("RegDeleteValueW(%lx,%ls)\n", a0, a1);

    LONG rv = 0;
    __try {
        rv = Real_RegDeleteValueW(a0, a1);
    } __finally {
        _PrintExit("RegDeleteValueW(,) -> %lx\n", rv);
    };
    return rv;
}

LONG WINAPI Mine_RegEnumKeyExA(HKEY a0,
                                  DWORD a1,
                                  LPSTR a2,
                                  LPDWORD a3,
                                  LPDWORD a4,
                                  LPSTR a5,
                                  LPDWORD a6,
                                  struct _FILETIME* a7)
{
    _PrintEnter("RegEnumKeyExA(%lx,%lx,%lx,%lx,%lx,%hs,%lx,%lx)\n", a0, a1, a2, a3, a4, a5, a6, a7);

    LONG rv = 0;
    __try {
        rv = Real_RegEnumKeyExA(a0, a1, a2, a3, a4, a5, a6, a7);
    } __finally {
        _PrintExit("RegEnumKeyExA(,,%hs,,,%hs,,) -> %lx\n", a2, a5, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegEnumKeyExW(HKEY a0,
                                  DWORD a1,
                                  LPWSTR a2,
                                  LPDWORD a3,
                                  LPDWORD a4,
                                  LPWSTR a5,
                                  LPDWORD a6,
                                  struct _FILETIME* a7)
{
    _PrintEnter("RegEnumKeyExW(%lx,%lx,%lx,%lx,%lx,%ls,%lx,%lx)\n", a0, a1, a2, a3, a4, a5, a6, a7);

    LONG rv = 0;
    __try {
        rv = Real_RegEnumKeyExW(a0, a1, a2, a3, a4, a5, a6, a7);
    } __finally {
        _PrintExit("RegEnumKeyExW(,,%ls,,,%ls,,) -> %lx\n", a2, a5, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegEnumValueA(HKEY a0,
                                  DWORD a1,
                                  LPSTR a2,
                                  LPDWORD a3,
                                  LPDWORD a4,
                                  LPDWORD a5,
                                  LPBYTE a6,
                                  LPDWORD a7)
{
    _PrintEnter("RegEnumValueA(%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx)\n", a0, a1, a2, a3, a4, a5, a6, a7);

    LONG rv = 0;
    __try {
        rv = Real_RegEnumValueA(a0, a1, a2, a3, a4, a5, a6, a7);
    } __finally {
        _PrintExit("RegEnumValueA(,,%hs,,,,,) -> %lx\n", a2, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegEnumValueW(HKEY a0,
                                  DWORD a1,
                                  LPWSTR a2,
                                  LPDWORD a3,
                                  LPDWORD a4,
                                  LPDWORD a5,
                                  LPBYTE a6,
                                  LPDWORD a7)
{
    _PrintEnter("RegEnumValueW(%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx)\n", a0, a1, a2, a3, a4, a5, a6, a7);

    LONG rv = 0;
    __try {
        rv = Real_RegEnumValueW(a0, a1, a2, a3, a4, a5, a6, a7);
    } __finally {
        _PrintExit("RegEnumValueW(,,%ls,,,,,) -> %lx\n", a2, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegOpenKeyExA(HKEY a0,
                                  LPCSTR a1,
                                  DWORD a2,
                                  REGSAM a3,
                                  PHKEY a4)
{
    _PrintEnter(NULL);

    LONG rv = 0;
    __try {
        rv = Real_RegOpenKeyExA(a0, a1, a2, a3, a4);
    } __finally {
        _PrintExit("RegOpenKeyExA(%lx,%hs,%lx,%lx,%lx) -> %lx\n",
				   a0, a1, a2, a3, a4, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegOpenKeyExW(HKEY a0,
                                  LPCWSTR a1,
                                  DWORD a2,
                                  REGSAM a3,
                                  PHKEY a4)
{
    _PrintEnter(NULL);

    LONG rv = 0;
    __try {
        rv = Real_RegOpenKeyExW(a0, a1, a2, a3, a4);
    } __finally {
		_PrintExit("RegOpenKeyExW(%lx,%ls,%lx,%lx,%lx) -> %lx\n",
				   a0, a1, a2, a3, a4, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegQueryInfoKeyA(HKEY a0,
                                     LPSTR a1,
                                     LPDWORD a2,
                                     LPDWORD a3,
                                     LPDWORD a4,
                                     LPDWORD a5,
                                     LPDWORD a6,
                                     LPDWORD a7,
                                     LPDWORD a8,
                                     LPDWORD a9,
                                     LPDWORD a10,
                                     struct _FILETIME* a11)
{
    _PrintEnter("RegQueryInfoKeyA(%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx)\n",
				a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11);

    LONG rv = 0;
    __try {
        rv = Real_RegQueryInfoKeyA(a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11);
    } __finally {
        _PrintExit("RegQueryInfoKeyA(,%hs,,,,,,,,,,) -> %lx\n", a1, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegQueryInfoKeyW(HKEY a0,
                                     LPWSTR a1,
                                     LPDWORD a2,
                                     LPDWORD a3,
                                     LPDWORD a4,
                                     LPDWORD a5,
                                     LPDWORD a6,
                                     LPDWORD a7,
                                     LPDWORD a8,
                                     LPDWORD a9,
                                     LPDWORD a10,
                                     struct _FILETIME* a11)
{
    _PrintEnter("RegQueryInfoKeyW(%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx,%lx)\n",
				a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11);

    LONG rv = 0;
    __try {
        rv = Real_RegQueryInfoKeyW(a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11);
    } __finally {
        _PrintExit("RegQueryInfoKeyW(,%ls,,,,,,,,,,) -> %lx\n", a1, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegQueryValueExA(HKEY a0,
                                     LPCSTR a1,
                                     LPDWORD a2,
                                     LPDWORD a3,
                                     LPBYTE a4,
                                     LPDWORD a5)
{
    _PrintEnter(NULL);

    LONG rv = 0;
    __try {
        rv = Real_RegQueryValueExA(a0, a1, a2, a3, a4, a5);
    } __finally {
		_PrintExit("RegQueryValueExA(%lx,%hs,%lx,%lx,%lx,%lx) -> %lx\n",
				   a0, a1, a2, a3, a4, a5, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegQueryValueExW(HKEY a0,
                                     LPCWSTR a1,
                                     LPDWORD a2,
                                     LPDWORD a3,
                                     LPBYTE a4,
                                     LPDWORD a5)
{
	_PrintEnter(NULL);
    LONG rv = 0;
    __try {
        rv = Real_RegQueryValueExW(a0, a1, a2, a3, a4, a5);
    } __finally {
		_PrintExit("RegQueryValueExW(%lx,%ls,%lx,%lx,%lx,%lx) -> %lx\n",
					a0, a1, a2, a3, a4, a5, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegSetValueExA(HKEY a0,
                                   LPCSTR a1,
                                   DWORD a2,
                                   DWORD a3,
                                   BYTE* a4,
                                   DWORD a5)
{
    _PrintEnter(NULL);
    LONG rv = 0;
    __try {
        rv = Real_RegSetValueExA(a0, a1, a2, a3, a4, a5);
    } __finally {
		_PrintExit("RegSetValueExA(%lx,%hs,%lx,%lx,%lx,%lx) -> %lx\n",
				   a0, a1, a2, a3, a4, a5, rv);
    };
    return rv;
}

LONG WINAPI Mine_RegSetValueExW(HKEY a0,
                                   LPCWSTR a1,
                                   DWORD a2,
                                   DWORD a3,
                                   BYTE* a4,
                                   DWORD a5)
{
	_PrintEnter(NULL);
    LONG rv = 0;
    __try {
        rv = Real_RegSetValueExW(a0, a1, a2, a3, a4, a5);
    } __finally {
		_PrintExit("RegSetValueExW(%lx,%ls,%lx,%lx,%lx,%lx) -> %lx\n",
				   a0, a1, a2, a3, a4, a5, rv);
    };
    return rv;
}

HFILE WINAPI Mine__lcreat(LPCSTR a0, int a1)
{
	_PrintEnter(NULL);
    HFILE rv = 0;
    __try {
        rv = Real__lcreat(a0, a1);
    } __finally {
		_PrintExit("_lcreat(%hs,%lx) -> %lx\n", a0, a1, rv);
    };
    return rv;
}

HFILE WINAPI Mine__lopen(LPCSTR a0, int a1)
{
    _PrintEnter(NULL);
    HFILE rv = 0;
    __try {
        rv = Real__lopen(a0, a1);
    } __finally {
		_PrintEnter("_lopen(%hs,%lx) -> %lx\n", a0, a1, rv);
    };
    return rv;